User Management(60 Minutes)

a) Local Users/Accounts(20 Minutes)

ArgoCD allows us to create to local users/accounts for authenticating and authorizing the different users and groups and restrict access to the ArgoCD and its resources. Argo CD does not have its own user management system and has only one built-in user admin. The admin user is a superuser and it has unrestricted access to the system. ArgoCD allows restrict access to ArgoCD resources using RBAC permissions.

• [Read]Local Users/Accounts
• [Read]RBAC Rules

Assignment(10 Minutes)

💻 Create a new user for Argocd and give the permissions to get, create, update and delete appplications in default AppProject

Answer

argocd-cm:

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
  name: argocd-cm
  namespace: argocd
data:
  accounts.Newuser: apiKey,login

argocd-rbac-cm:

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: argocd-rbac-cm
    app.kubernetes.io/part-of: argocd
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.csv: |-
    p,role:defaul-applications-CRUD-role,applications,get,default/*,allow
    p,role:defaul-applications-CRUD-role,applications,create,default/*,allow
    p,role:defaul-applications-CRUD-role,applications,update,default/*,allow
    p,role:defaul-applications-CRUD-role,applications,get,default/*,allow
    g,NewUser,role:defaul-applications-CRUD-role

b) SSO(40 Minutes)

ArgoCD allows us to integrate SSO to use our existing identity provider to access ArgoCD resources, since we already know ArgoCD don't its own user management system but allow us to restrict access to its resource using RBAC permissions so we can use our existing identity provider for authenticating and RBAC permission for authorization.

• [Read]ArgoCD SSO Configuration

Assignment(20 Minutes)

💻 Configure ArgoCD SSO using Okta via SAML method

Answer

Follow this guide for ArgoCD SSO integration using Okta

03-ArgCD Sync Phases and Waves

Argo CD executes a sync operation in a number of steps. At a high-level, there are three phases pre-sync, sync and post-sync.

Within each phase you can have one or more waves, that allows you to ensure certain resources are healthy before subsequent resources are synced.

• [Read]ArgoCD Phases and Syncs
• [Read]Phase Configuration
• [Read]Wave Configuration