Argo CD supports local authentication and is also integrated with the Deckhouse Kubernetes Platform identity and access subsystem. You can learn more about configuring authentication and authorization in the DKP documentation.
If no additional settings are defined in the ArgoCD object, the local admin account with the admin role is active by default.
You can learn about managing user and group permissions in the Configuring role-based access control section.
Local authentication
When an ArgoCD object is created, the admin user with the admin role is created automatically. The admin user password is generated automatically. To retrieve it, run:
d8 k -n argocd get secret argocd-cluster -o jsonpath='{.data.admin\.password}' | base64 -d
Creating additional local users
When creating a local user, you can define whether the user has access to the Argo CD web interface (the login attribute) and/or to the Argo CD API (the apiKey attribute).
To create local users, set the spec.localUsers parameter of ArgoCD, for example:
d8 k create -f - <<EOF
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: argocd
namespace: argocd
spec:
localUsers:
# The "deploy" user with rights to sign in to the web interface and generate tokens.
- name: deploy
apiKey: true
login: true
enabled: true
# The "ci-bot" user for automation only, without web interface access.
- name: ci-bot
apiKey: true
login: false
enabled: true
EOF
After creating the user and applying the ArgoCD object manifest, generate a password for web interface access if the user has been granted the corresponding rights.
To set a password through a Secret, first calculate its bcrypt hash, then encode the result in Base64:
ARGOCD_USER=<USER_NAME>
ARGOCD_PASS=$(echo -n '<USER_PASSWORD>' | htpasswd -BinC 10 "" | cut -d: -f2 | tr -d '\n' | base64 -w0)
d8 k -n argocd patch secret argocd-secret -p "{\"data\":{\"accounts.$ARGOCD_USER.password\":\"$ARGOCD_PASS\"}}"
You can set or change a local user password with the argocd CLI utility:
argocd login <ARGOCD_DOMAIN>:443 --username admin --password <ADMIN_PASSWORD>
argocd account update-password \
--account <ACCOUNT> \
--current-password <ADMIN_PASSWORD> \
--new-password <NEW_PASSWORD>
Creating a user token
To work with the API, the user must have the corresponding rights (the apiKey parameter; see the example in the section above). To issue a token, use the Argo CD web interface or the argocd CLI utility.
To issue a token through the web interface, go to “Settings” → “Accounts”, select the required user, and click “Generate New” in the “Tokens” section.
To issue a token with the argocd CLI utility, run the following commands (provide the required values):
argocd login <ARGOCD_DOMAIN>:443 --username admin
argocd account generate-token --account <ACCOUNT>
If the user does not have web interface access rights (login), another user with administrator rights can issue a token for them.
Disabling local authentication
To disable local authentication, disable the admin user by setting the spec.disableAdmin parameter of ArgoCD to true. Also remove all additional local users if they were created earlier (for details, see Creating additional local users).
After disabling local authentication, review the access rules in the Configuring role-based access control section.
SSO authentication
Before configuring the ArgoCD object, create a DexClient object. It is used as an OAuth2 client and is required for integration with Deckhouse Kubernetes Platform:
d8 k create -f -<<EOF
apiVersion: deckhouse.io/v1
kind: DexClient
metadata:
name: argocd
namespace: argocd
spec:
redirectURIs:
- https://<ARGOCD_DOMAIN>/api/dex/callback
- https://<ARGOCD_DOMAIN>/api/dex/callback-reserve
EOF
<ARGOCD_DOMAIN> is the fully qualified domain name (FQDN) set in the .spec.server.host section of ArgoCD.
Wait until Deckhouse Kubernetes Platform creates a Secret with the client secret key:
d8 k -n argocd get secret/dex-client-argocd
Configure the ArgoCD object to use SSO in Deckhouse Kubernetes Platform:
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: argocd
namespace: argocd
spec:
rbac:
scopes: "[groups, email]"
sso:
dex:
config: |
connectors:
- type: oidc
id: deckhouse
name: deckhouse
config:
issuer: "https://dex.<CLUSTER_DOMAIN>/"
clientID: "dex-client-argocd@argocd"
clientSecret: "$dex-client-argocd:clientSecret"
insecureEnableGroups: true
scopes:
- profile
- email
- openid
- groups
provider: dex
server:
host: <ARGOCD_DOMAIN>
ingress:
enabled: true
ingressClassName: <INGRESS_CLASS_NAME>
tls:
- hosts:
- <ARGOCD_DOMAIN>
secretName: argocd-ingress-tls
insecure: true
Restart the Argo CD server:
d8 k -n argocd rollout restart deploy/argocd-server
If you do not restart the Argo CD server, the sign-in attempt fails, and an error message appears in the Argo CD server log (issue argoproj/argo-cd#13526).
Using a self-signed certificate
First obtain the self-signed certificate used by the Deckhouse Kubernetes Platform identity and access subsystem:
d8 k -n d8-user-authn get secret ingress-tls -o jsonpath='{.data.tls\.crt}' | base64 -d
Then add the obtained certificate to the OIDC connector configuration in the rootCAs section of ArgoCD:
apiVersion: argoproj.io/v1beta1
kind: ArgoCD
metadata:
name: argocd
namespace: argocd
spec:
sso:
dex:
config: |
connectors:
- type: oidc
id: deckhouse
name: deckhouse
config:
issuer: "https://dex.<CLUSTER_DOMAIN>/"
rootCAs:
- |
-----BEGIN CERTIFICATE-----
<Self-signed certificate obtained in the previous step>
-----END CERTIFICATE-----
clientID: "dex-client-argocd@argocd"
clientSecret: "$dex-client-argocd:clientSecret"
insecureEnableGroups: true
scopes:
- profile
- email
- openid
- groups
provider: dex
server:
host: <ARGOCD_DOMAIN>
ingress:
enabled: true
tls:
- hosts:
- <ARGOCD_DOMAIN>
secretName: argocd-ingress-tls
insecure: true
Creating a user token
Argo CD does not allow issuing permanent tokens for users authenticated with SSO. At the same time, such users can use the argocd CLI utility by specifying the --sso flag during authentication:
argocd login <ARGOCD_DOMAIN>:443 --sso
When this command runs on the administrator workstation, a web browser opens with the Deckhouse Kubernetes Platform authentication form.
To issue a permanent token, create a local Argo CD user and set the apiKey attribute for them. In this case, the user has access rights only to the Argo CD API. For details, see Creating additional local users.