Getting Started with GitOps and ArgoCD — 4(Authentication and Authorization)
Authentication and Authorization
As part of a standard platform deployment, Argo CD includes a default administrator user with unlimited access to configure the platform through the user interface (UI), API, or CLI. Providing this functionality out of the box simplifies the initial user experience and makes it easier for users to understand the capabilities offered by Argo CD and the fundamental concepts of the GitOps methodology.
As the use of Argo CD grows beyond a single administrator, the need arises to support additional users and integrate with centralized user management systems, such as an identity provider compatible with LDAP or OIDC. However, simply allowing different users to access the system is not sufficient. It is also necessary to define which resources each user or group can access and which actions they can perform.
In this section, we will examine how users are managed in Argo CD, where and how users are defined, which actions they can perform, and how Role-Based Access Control (RBAC) policies are defined to manage their access levels.
Managing Users
Although Argo CD supports multiple users, by default, only the admin user is available during the initial deployment. As mentioned earlier, the admin user is provided both to make it easy to quickly explore the capabilities offered by Argo CD and to provide unlimited access to all features of the platform.
If Argo CD is going to be used by only one person, the admin user alone may be sufficient. However, when the use of the platform expands to multiple users, additional users need to be defined and granted the appropriate access permissions. At this point, the admin user can either continue to be used or, depending on security requirements, it can be disabled.
Now, let us examine what the admin user is and how it can be managed at different stages of using Argo CD, particularly during and after the initial deployment.
Administrator User
When Argo CD is deployed for the first time, a Secret named argocd-initial-admin-secret is created in the namespace where Argo CD is deployed. This Secret contains the initial password for the admin user.
Assuming that Argo CD is installed in the argocd namespace, the initial password can be obtained using the following command:
kubectl -n argocd get secret argocd-initial-admin-secret \
-o jsonpath="{.data.password}" | base64 -dHow to obtain the administrator password was covered in the previous sections, where we examined the different ways of interacting with Argo CD. Now, let us take a closer look at how the admin user can be managed.
Log in to Argo CD using the command-line interface (CLI). You can log in to the cluster where Argo CD was previously deployed using the administrator password obtained with the previous command:
argocd login 'your argo server url'\
--insecure \
--grpc-web \
--username admin \
--password="$(kubectl -n argocd get secret argocd-initial-admin-secret \
-o jsonpath="{.data.password}" | base64 -d)"Details about a user can be viewed using the argocd account get-user-info command.
To get information about the admin user, run the following command:
argocd account get-user-infoThe admin user should only be used for initial access, and for security reasons, the initial password should be changed as soon as possible. This is because anyone who has access to the Secrets in the argocd namespace can obtain the initial password of the privileged admin user.
The argocd account update-password command can be used to change a user's password.
To change the password of the admin user to your desired new password, run the following command:
argocd account update-password \
--account admin \
--current-password "$(kubectl -n argocd get secret argocd-initial-admin-secret \
-o jsonpath="{.data.password}" | base64 -d)" \
--new-password "<new_password_value>"By default, the argocd account update-password command updates the account of the current user. Therefore, the --account option can be omitted in this case. However, it is included here to explicitly specify which user's password will be updated and to demonstrate how you can target a different user when necessary.
After updating the account information, let’s verify that the updated password works successfully by authenticating through the Argo CD web interface. Open a browser and enter admin in the username field and the new password you just set in the password field. If the credentials are accepted, you have successfully updated the administrator password.
Now that the administrator user’s password has been changed, you can safely delete the Secret containing the initial password. To delete the initial administrator Secret, run the following command:
kubectl delete secret argocd-initial-admin-secret -n argocdLocal Users
To allow users to access Argo CD without having to use the admin user, Argo CD provides the ability to manage users that are defined locally within the tool.
Local users serve two main purposes:
- Creating authentication tokens: Authentication tokens can be created so that tools integrated with Argo CD, such as CI/CD, configuration management, and monitoring tools, can perform administrative operations.
- Creating additional users: Additional local users can be defined for small teams and environments where integration with an external user management system is not required or preferred.
Additional users are defined in the argocd-cm ConfigMap using keys in the accounts.<username> format. The value of this key specifies the capabilities that will be granted to the user.
Below is an example of how a new local user named alice can be defined in the argocd-cm ConfigMap:
apiVersion: v1
kind: ConfigMap
metadata:
name: argocd-cm
namespace: argocd
labels:
app.kubernetes.io/name: argocd-cm
app.kubernetes.io/part-of: argocd
data:
accounts.alice: apiKey, loginThis can be done by patching the argocd-cm ConfigMap using the following command:
kubectl patch -n argocd cm argocd-cm --type='merge' \
-p='{"data": {"accounts.alice": "apiKey, login"}}'After the ConfigMap is updated, the information for the new user can be viewed using the following command:
argocd account listIn most local user creation scenarios, the login capability, which is typically associated with human users, is expected to be sufficient on its own. However, in this exercise, we have granted the alice user both available capabilities.
Similar to the administrator user, the first thing that should be done when creating new local users is to set a password for the user. Since no password is defined initially, the user cannot log in.
To update the password for the alice user, use the following command. Replace <new_password> with the password you want to associate with the user:
argocd account update-password --account=alice --new-password=<new_password>You will then be prompted to enter the current user’s password, and once the password is entered, it will be changed.
Verify that the new user, Alice, can successfully authenticate by opening a web browser, navigating to the Argo CD web console, and logging in with the username and password previously specified for Alice.
If the credentials are accepted, the new user has been successfully created and is ready to use.
Disabling Users
Once users have been created in Argo CD, their access can be disabled. By setting the accounts.<username>.enabled property to false in the argocd-cm ConfigMap, the user's access to both the web interface and the command-line interface (CLI) can be disabled.
For example, to disable access for the alice user we created earlier, the following value can be set in the argocd-cm ConfigMap:
apiVersion: v1
kind: ConfigMap
metadata:
name: argocd-cm
namespace: argocd
labels:
app.kubernetes.io/name: argocd-cm
app.kubernetes.io/part-of: argocd
data:
accounts.alice: apiKey, login
# Disables Alice's Local User Account
accounts.alice.enabled: "false"The ConfigMap can be updated directly using kubectl. You can disable access for the alice user by running the following command:
kubectl patch -n argocd cm argocd-cm --type='merge' \
-p='{"data": {"accounts.alice.enabled": "false"}}'Open a web browser and try to authenticate as the alice user to verify that the user can no longer access Argo CD. You will see a message indicating that the user account has been disabled.
Get Tuğrulhan Karslı’s stories in your inbox
Join Medium for free to get updates from this writer.
To re-enable the account, you can set the accounts.alice.enabled field to true or remove the field entirely. The following shows how to re-enable the alice user account by patching the argocd-cm ConfigMap and removing the accounts.alice.enabled field:
kubectl patch -n argocd cm argocd-cm --type=json \
-p='[{"op": "remove", "path": "/data/accounts.alice.enabled"}]'Once the field is removed from the argocd-cm ConfigMap, the alice user can authenticate again.
In addition to the ability to disable local user accounts, the Argo CD admin account can also be disabled. After local users have been created and at least one of these accounts has been granted the necessary administrative privileges, it is recommended to disable the admin account to improve the overall security posture of Argo CD.
Similar to disabling a local user, the admin user can also be disabled by setting the admin.enabled field to "false" in the argocd-cm ConfigMap:
apiVersion: v1
kind: ConfigMap
metadata:
name: argocd-cm
namespace: argocd
labels:
app.kubernetes.io/name: argocd-cm
app.kubernetes.io/part-of: argocd
data:
# Disables the admin account
admin.enabled: "false"This can also be done using kubectl. You can disable the admin user by running the following command:
kubectl patch -n argocd cm argocd-cm --type='merge' \
-p='{"data": {"admin.enabled": "false"}}'Authentication Tokens
In addition to defining additional users to access Argo CD, local users provide another function: the ability to create authentication tokens that can be used by external systems to perform automation tasks.
Examples of where authentication tokens can be used include CI/CD tools, which are used to control and monitor the synchronization of applications as part of their deployment processes, as well as other automation tools that perform automated operations on Argo CD.
When users are defined, you may have noticed that they have two different capabilities: login and apiKey. Earlier, we covered the use of the login capability to grant a user access to the Argo CD web console. The apiKey capability allows the user to create an authentication token associated with their account.
Now, let’s examine step by step how an authentication token is created and used.
First, create a new local user named automation for demonstration purposes. Apply the following command to the argocd-cm ConfigMap to demonstrate how authentication tokens can be created, managed, and used:
kubectl patch -n argocd cm argocd-cm --type='merge' \
-p='{"data": {"accounts.automation": "apiKey"}}'Authentication tokens can be generated using the argocd account generate-token command. The specific user account for which the token will be generated can be specified using the --account parameter. If this parameter is not used, the token will be generated for the currently logged-in user.
To generate an authentication token for the automation user we just created, run the following command:
argocd account generate-token --account automationThe output of the command is a JSON Web Token (JWT). This token can be used to interact with the Argo CD CLI or API.
Within the Argo CD CLI, the token can be specified using the --auth-token parameter when running any command. To verify that the user supported by the token is correctly recognized by the CLI, run the following command to display information about the currently logged-in user:
argocd account get-user-info --auth-token=<token>Replace the <token> value with the authentication token you generated earlier. A response similar to the following should be displayed:
Alternatively, the ARGOCD_AUTH_TOKEN environment variable can be used. This allows the authentication token to be defined once, eliminating the need to provide it again as the --auth-token parameter with every CLI invocation.
When an authentication token is specified through the --auth-token parameter or the ARGOCD_AUTH_TOKEN environment variable, it takes higher precedence over credentials associated with other users who have previously been authenticated.
By default, authentication tokens do not have an expiration time. This can pose a security risk. To improve the security of authentication tokens, it is recommended that they expire after a specific period of time. The duration for which the token remains valid can be specified using the --expires-in parameter. For example, this duration can be set to 1 hour or 90 days.
To create an authentication token that will remain valid for 90 days, use the following command:
argocd account generate-token --account automation --expires-in 90dAuthentication tokens associated with a user can be viewed using the argocd account get command. To display detailed information about the automation user, including the two tokens we created earlier, use the following command:
argocd account get --account automationNote that one token has no expiration, while the other token will expire after a specific period of time based on when it was created.
Tokens can be explicitly revoked when necessary. Situations that may require an authentication token to be revoked include the token being accidentally exposed or being used by a team member who no longer needs access to Argo CD.
Tokens are stored in the argocd-secret Secret under the accounts.<account>.tokens key. Although this value can be modified manually, using the Argo CD CLI to manage tokens is much easier.
To delete one of the tokens we created earlier, the argocd account delete-token command can be used. The command requires the name of the account associated with the token and the token's ID.
The IDs of all authentication tokens are displayed when the argocd account get command is run. The token ID is the Universally Unique Identifier (UUID) generated when the token is created. To use a more user-friendly ID, the --id parameter can be used with the argocd account generate-token command.
Revoke an authentication token by running the following command:
argocd account delete-token --account <account> <ID>In this section, we covered authentication and authorization in Argo CD. If you found this article helpful, don’t forget to like and follow me for more content in the series.
Linkedln → www.linkedin.com/in/tuğrulhan-karslı-9683b7256
Sources
Website
Book → Argo CD: Up and Running
