Integrating Azure SSO with Argo Workflows: A Step-by-Step Guide

Argo Workflows is a powerful Kubernetes-native workflow engine, but configuring Single Sign-On (SSO) with Azure can be challenging . This guide walks you through setting up Azure SSO with Argo Workflows.

Argo Workflow SSO with Azure App Registration.

Prerequisites

Before you begin, ensure you have:

• A Kubernetes cluster with kubectl access.
• Helm installed for deploying Argo Workflows.
• Azure AD with access to create App Registrations and Groups.

Register Your Application in Azure

• Go to Azure → App registrations → New registration. and create your application.
• For Redirect URI, enter:
  https://<your-argo-domain>/oauth2/callback

oauth2/callback URL

• For token configuration select claim email and groups.

Claims in Token configuration.

• Create a client secret and store it securely. Also, copy the client ID, as both will be used in the later steps.

App registration Overview.

• Create a user group in Azure Groups and link the group to the Argo Workflow app you created (You can create multiple group as well for editor and read-only permissions).

Azure Group for Argo Workflow.

Note the Object ID of the group, as it will be used when creating the service account for SSO and while filtering the groups.

• Add a user to the group that you have created for argo workflow.

Adding User to the SSO Group.

Set up SSO in Argo

First, you need to create secrets in the same namespace where the ArgoWorkflow application is deployed. You can use below given secret yaml to create secrets.

---
apiVersion: v1
data:
  client-id-key: xxxxxxxxxxxxxxxxxx 
kind: Secret
metadata:
  name: client-id-secret
  namespace: <argo-workflow-namespace>
type: Opaque

---
apiVersion: v1
data:
  client-secret-key: xxxxxxxxxxxx
kind: Secret
metadata:
  name: client-secret-secret
  namespace: <argo-workflow-namespace>
type: Opaque

You can get the value of the client-ID from the App Registration page in the Azure portal, and use the client-secret created in the previous step on Azure.

#Note:- You can create a single secret that includes both the client ID and client secret, or you can do it the same way I did.

Now we have created the client id and secret in the namespace where argo workflow is deployed. Lets create Service account because all users of the Argo Server must ultimately use a service account. Argo allow us to define rules that map a user to a service account in the same namespace as argo server by annotating the service account.

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: argo-admin
  namespace: argo-workflow
  annotations:
    workflows.argoproj.io/rbac-rule: "'85r90e63-xxx-xxxx-xxxx-xxxxxxx' in groups" #Use object ID of the Group that we have created.
    workflows.argoproj.io/rbac-rule-precedence: "3"

#Note:- If you have a read-only service account, make sure its precedence is set to the lowest among all your service accounts.

To allow service accounts to manage resources in other namespaces create a role and role binding in the target namespace. For this blog I am using cluster role and cluster role binding.

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: argo-admin
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - pods/log
  - events
  verbs:
  - "*"
- apiGroups:
  - argoproj.io
  resources:
  - workflows
  - workfloweventbindings
  - workflowtemplates
  - cronworkflows
  - cronworkflows/finalizers
  - clusterworkflowtemplates
  verbs:
  - "*"

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: argo-admin-access
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: argo-admin 
subjects:
- kind: ServiceAccount
  name: argo-admin
  namespace: argo-workflow

Note:- You can change the resource permissions according to your needs.

Now, create a values.yaml file for new values, or modify the existing values.yaml file. In the file, change the authModes to SSO, and add the IDs of the groups you integrated with your app during the app registration process. You can configure filterGroupsRegex to filter the groups returned by the OIDC provider.

    # Argo Server Values
    server:
      authModes:
        - sso
      logging:
        level: error
      sso:
        enabled: true
        filterGroupsRegex:
          - "85r90e63-xxx-xxxx-xxxx-xxxxxxx" #Use object ID of the Group that we have created on azure portal.
        rbac:
          enabled: true
        issuer: https://login.microsoftonline.com/<tenand id>/v2.0
        redirectUrl: https://<DNS-NAME>.com/oauth2/callback
        clientId: 
          key: client-id-key #Detail of the client-Id secret that we have created in previous step.
          name: client-id-secret
        clientSecret:
          key: client-secret-key #Detail of the client-secret that we have created in previous step.
          name: client-secret-secret
        sessionExpiry: 2h #Change the session time accordingly.

Note that in the filter groups section, if you have ‘Editor’ and ‘ReadOnly’ groups, make sure to include the Group IDs for those groups as well.

Now deploy the helm chart using the values.yaml file that we have just created. You can consume this repo to get argo-workflow helm chart.

Get Sagar Parmar’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Once you have deployed the app and the server pod is created or re-created, go to the Argo Workflow login URL and click on Single Sign-On.

Argo workflow sign-in page.

After clicking on login, you will be redirected to the Microsoft sign-in page, where you can enter your credentials.

User Info Page.

Upon successful authentication, you will be taken into Argo Workflows. Once inside, navigate to the user info page to verify details such as your email ID, groups, role, and more.

Summary

By using the SSO option in Argo Workflows, you can securely integrate it with Azure SSO, allowing your team to access Argo Workflows using their existing Microsoft credentials in a streamlined and secure way.

I hope you found this post informative and engaging. I would love to hear your thoughts on this post, so do start a conversation on Twitter or LinkedIn 😉.

Here are some of my other articles that you may find interesting.

Creating Infra Using Backstage Templates, Terraform and GitHub actions.

Integration of Opentelemetry (Auto Instrumentation) with Jaeger

Bye-Bye 👋

References

Argo Server SSO - Argo Workflows - The workflow engine for Kubernetes