/api/configs/workflow

Workflow config is used to configure workflow execution and management.

Top-Level Configuration

Field	Type	Description	Default Values
workflow_data	Workflow Data	Cloud storage configuration for workflow artifacts, such as workflow spec and Kubernetes pod spec.	Default configuration
workflow_log	Workflow Log	Cloud storage configuration for workflow logs and error logs.	Default configuration
workflow_app	Workflow App	Cloud storage configuration for OSMO apps.	Default configuration
workflow_info	Workflow Information	Miscellaneous workflow configurations.	Default configuration
backend_images	Backend Images	Container images used by the workflow (i.e. init and osmo-ctrl containers).	Default configuration
workflow_alerts	Workflow Alerts	Configuration for workflow alerts.	Default configuration
credential_config	Credential Configuration	Settings for credential validation.	Default configuration
user_workflow_limits	User Workflow Limits	Limits and constraints for users and their workflows.	Default configuration
plugins_config	Plugins	Configuration for workflow plugins.	See Plugins section
labels_config	Workflow Labels	Workflow-label policies, accepted values, staged enforcement, and the optional pod-label prefix.	policy: []
max_num_tasks	Integer	Maximum number of tasks allowed in a workflow.	20
max_num_ports_per_task	Integer	Maximum number of ports allowed per task to be forwarded at a time.	30
max_retry_per_task	Integer	Maximum number of retries allowed per task.	0
max_retry_per_job	Integer	Maximum number of retries allowed per job.	5
default_schedule_timeout	Integer	Default timeout for task scheduling in seconds.	30
default_exec_timeout	String	Default per-group execution timeout, applied independently to each group’s RUNNING phase. Must be in the format of <integer><unit> (for example, 10m, 1h, 1d).	60d
default_queue_timeout	String	Default per-group queue timeout, measured from when each group enters SCHEDULING until it is assigned a node (enters INITIALIZING). Must be in the format of <integer><unit> (for example, 10m, 1h, 1d).	60d
max_exec_timeout	String	Maximum allowed per-group execution timeout. Must be in the format of <integer><unit> (for example, 10m, 1h, 1d).	60d
max_queue_timeout	String	Maximum allowed per-group queue timeout. Must be in the format of <integer><unit> (for example, 10m, 1h, 1d).	60d
force_cleanup_delay	String	Amount of time after a workflow has failed to force cleanup of resources. Must be in the format of <integer><unit> (for example, 10m, 1h, 1d).	1h
max_log_lines	Integer	Maximum number of log lines to retain for a workflow.	10000
max_task_log_lines	Integer	Maximum number of log lines per task.	1000
max_error_log_lines	Integer	Maximum number of error log lines to retain.	100
max_event_log_lines	Integer	Maximum number of event log lines to retain.	100
task_heartbeat_frequency	String	Frequency of task heartbeat signals.	10m

Workflow Data

Field	Type	Description	Default Values
credential	Credential	Credentials for accessing workflow data storage.	None
base_url	String	Base URL for workflow data access, enabling users to view their intermediate output data from workflows on the browser.	None
websocket_timeout	Integer	Timeout for websocket connections in seconds.	1440
data_timeout	Integer	Timeout for data operations in seconds.	10

Workflow Log

Field	Type	Description	Default Values
credential	Credential	Credentials for accessing workflow logs and error logs in cloud storage.	None

Workflow App

Field	Type	Description	Default Values
credential	Credential	Credentials for accessing OSMO apps in cloud storage.	None

Credential

Field	Type	Description	Default Values
access_key_id	String	Access key ID for cloud storage authentication.	None
access_key	String	Access key for cloud storage authentication.	None
endpoint	String	Cloud storage endpoint URI including protocol, container, and prefix (if any).	None
region	String	Cloud storage region.	None

Rotating mounted credentials

Each service process checks explicitly referenced credential files every 30 seconds. This applies to workflow_data, workflow_log, and workflow_app access keys, and backend_images registry login credentials. Use secretName / secretKey or secret_file directly under the corresponding credential setting. Kubernetes must first project the updated Secret into the pod, so total propagation time includes the kubelet’s projection delay. Mount Secret directories, not subPath files, to receive Kubernetes updates.

At startup, detected dependency changes during credential reads are retried within the existing 30-second startup retry window. Stable malformed, missing, or invalid credential references remain startup errors.

Valid replacements are published together for subsequent credential reads. Missing, invalid, or concurrently changing files leave the last accepted credentials active; the next check retries automatically. Already-created task pods and in-flight operations retain their captured credentials. Keep old credentials valid until those tasks finish and all service replicas have observed the replacement.

Kubernetes event notifications are best effort: their separate client uses one-second connection and read timeouts with automatic retries disabled. Notification failures do not prevent subsequent credential-refresh attempts. Durable startup reconciliation uses its existing client and is not affected by these event-delivery limits.

The ConfigMap remains startup-only. Changing Secret references, storage endpoints, regions, addressing options, registry addresses, or authentication mode requires a restart. Generic Secret-backed configuration and other secrets (including database, signing, and encryption keys) are not refreshed by this mechanism. ConfigMap changes do not affect which credential files an already running process checks.

Workflow Information

Field	Type	Description	Default Values
tags	Array[String]	Available legacy tags for the tag API and older clients. The 6.4 CLI uses Workflow Labels for new workflows instead.	[]
max_name_length	Integer	Maximum allowed length for workflow names.	64

Workflow Labels

Policy and prefix behavior, enforcement rollout, and the exported metrics are described in Workflow Labels.

Field	Type	Description	Default Values
policy	List of Label Policy	One entry per label key to check. At most 16 entries; duplicate keys are rejected.	[]
pod_label_prefix	String	Prepended to each workflow label key on task pods only. Empty disables it. Rejected at configuration time if it contains a space, tab, or line break, or exceeds 253 characters.	""

Label Policy

Field	Type	Description	Default Values
key	String	Kubernetes label key to check.	Required
allow_list	List of Strings	Exact accepted values. An empty list accepts any well-formed value.	[]
enforcement	String ("off", warn, enforce)	off accepts without policy warnings. warn accepts but warns when the key is missing or its value is outside a non-empty allow-list. enforce rejects those violations.	"off"

Backend Images

Field	Type	Description	Default Values
init	String	Container images for osmo-init.	None
client	String	Container images for osmo-ctrl.	None
credential	Registry Credentials	Registry credentials for pulling container images.	Default configuration

Registry Credentials

Field	Type	Description	Default Values
registry	String	Container registry hostname.	None
username	String	Registry username for authentication.	None
auth	String	Registry authentication token or password.	None

Workflow Alerts

Field	Type	Description	Default Values
slack_token	String	Slack API token for notifications.	None
smtp_settings	SMTP Settings Configuration	SMTP configuration for email notifications.	Default configuration

SMTP Settings Configuration

Field	Type	Description	Default Values
host	String	SMTP server hostname.	None
sender	String	Email address for sending notifications.	None
password	String	SMTP server authentication password.	None

Credential Configuration

Field	Type	Description	Default Values
disable_registry_validation	Array[String]	List of registries to skip validation for.	[]
disable_data_validation	Array[String]	List of data sources to skip validation for.	[]

User Workflow Limits

Field	Type	Description	Default Values
max_num_workflows	Optional[Integer]	Maximum number of workflows per user. If not set, there is no limit.	None
max_num_tasks	Optional[Integer]	Maximum number of tasks per user. If not set, there is no limit.	None
jinja_sandbox_workers	Integer	Number of worker processes for Jinja template sandbox.	2
jinja_sandbox_max_time	Float	Maximum execution time for Jinja template rendering in seconds.	0.5
jinja_sandbox_memory_limit	Integer	Memory limit for Jinja template rendering in bytes.	104857600

Note

The Jinja template sandbox is used to safely render Jinja templates in a sandboxed worker subprocess. It is used to prevent the execution of unsafe usage in the Jinja template, such as unrolling an infinite loop.

Plugins

Field	Type	Description	Default Values
rsync	Rsync Plugin	Configuration for the rsync plugin.	See Rsync Plugin section

Rsync Plugin

Field	Type	Description	Default Values
enabled	Boolean	Whether the rsync plugin is enabled.	False
enable_telemetry	Boolean	Whether to enable telemetry for rsync operations.	False
read_bandwidth_limit	Integer	Read bandwidth limit in bytes per second.	2621440
write_bandwidth_limit	Integer	Write bandwidth limit in bytes per second.	2621440
allowed_paths	Rsync Allowed Paths	Configuration for allowed file system paths.	{}
daemon_debounce_delay	Float	Delay in seconds before processing file changes.	30.0
daemon_poll_interval	Float	Interval in seconds for polling file changes.	120.0
daemon_reconcile_interval	Float	Interval in seconds for reconciling file states.	60.0
client_upload_rate_limit	Integer	Upload rate limit for clients in bytes per second.	2097152

Rsync Allowed Paths

Field	Type	Description	Default Values
path	String	File system path that is allowed for rsync operations.	Required field
writable	Boolean	Whether the path is writable for rsync operations.	Required field