Argo CD Ldap Authentication And RBAC Configuration

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s straightforward to install and use. So that it is so popular.

There are several options to install Argo CD. I prefer Helm Chart to install Argo CD because It is useful to make some modifications and also more suitable for on-prem environments.

If you have already installed Argo CD and you just need to configure it for LDAP authentication you can skip the installation part below and go to the configuration part directly.

1. Install Argo CD using Helm Chart

Argo CD Helm chart is a community-maintained chart that can be found here.

argoproj/argo-helm

To install the chart, run the commands below. If you want to customize your installation, you can modify values.yaml file before running helm install.

$ kubectl create namespace argocd
$ helm repo add argo https://argoproj.github.io/argo-helm
"argo" has been added to your repositories

$ helm install --name argocd argo/argo-cd --namespace argocd
NAME: argocd
...

After installation complete pods should look like the below.

$ kubectl -n argocd get pods
NAME                                             READY   STATUS 
argocd-application-controller-564ddd995d-z4fvj   1/1     Running
argocd-dex-server-64ddd5b4df-j8pvt               1/1     Running
argocd-redis-ha-haproxy-9f44649d8-47jg7          1/1     Running
argocd-redis-ha-haproxy-9f44649d8-h7fjv          1/1     Running
argocd-redis-ha-haproxy-9f44649d8-qph4t          1/1     Running
argocd-redis-ha-server-0                         3/3     Running
argocd-redis-ha-server-1                         3/3     Running
argocd-redis-ha-server-2                         3/3     Running
argocd-repo-server-85459559cd-dmkhj              1/1     Running
argocd-server-6c8bc7b5dc-9tmrw                   1/1     Running

Also, a configmap called argocd-cm should be created. That is the file we are going to modify to enable ldap authentication.

$ kubectl -n argocd get configmaps 
NAME                        DATA   AGE
argocd-cm                   4      5m
...

2. LDAP Configuration

Argo CD does not have built-in ldap support. However, it embeds and bundles Dex as part of its installation, for the purpose of delegating authentication to an external identity provider. Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Multiple types of identity providers are supported (OIDC, SAML, LDAP, GitHub, etc…).

To enable ldap authentication we have to add dex.config to configmap called argocd-cm. Dex server read dex.config field in argocd-cm configmap.

First of all, create a file that contains ldap configuration like below.

cat << EOF > patch-dex.yaml                  
apiVersion: v1
data:
  dex.config: |
    connectors:
    - type: ldap
      name: myad.local
      id: ad
      config:
        # Ldap server address
        host: ldaps.myad.local:636
        insecureNoSSL: false
        insecureSkipVerify: true
        # Variable name stores ldap bindDN in argocd-secret
        bindDN: "$dex.ldap.bindDN"
        # Variable name stores ldap bind password in argocd-secret
        bindPW: "$dex.ldap.bindPW"
        usernamePrompt: Username
        # Ldap user serch attributes
        userSearch:
          baseDN: "DC=mydomain,DC=local"
          filter: ""
          username: sAMAccountName
          idAttr: distinguishedName
          emailAttr: mail
          nameAttr: displayName
        # Ldap group serch attributes
        groupSearch:
          baseDN: "DC=mydomain,DC=local"
          filter: ""
          userAttr: distinguishedName
          groupAttr: member
          nameAttr: name
EOF

Patch argocd-cm configmap with the file you created.

$ kubectl -n argocd patch configmaps argocd-cm \ 
--patch "$(cat patch-dex.yaml)"

We have preferred to use variables for parameters bindDN and bindPW in dex.config instead of writing this sensitive information directly into argocd-cm configmap. Variables dex.ldap.bindDN and dex.ldap.bindPW are defined in argocd-secret.

dex.ldap.bindDN and dex.ldap.bindPW variables can be set using kubectl patch command below.

$ kubectl -n argocd patch secrets argocd-secret --patch \ 
"{\"data\":{\"dex.ldap.bindPW\":\"$(echo my-password | base64 -w 0)\"}}"
$ kubectl -n argocd patch secrets argocd-secret --patch \ 
"{\"data\":{\"dex.ldap.bindDN\":\"$(echo CN=ldapuser,OU=Service Accounts,OU=Resource,DC=mydomain,DC=local | base64 -w 0)\"}}"

After patching argocd-cm and argocd-secret, restart dex and server pods and wait until they are ready.

$ kubectl -n argocd delete pod argocd-dex-server-xxxxxxxxxx-xxxxx
$ kubectl -n argocd delete pod argocd-server-xxxxxxxxxx-xxxxx

Browse the argocd-server ingress address or external service IP. Ldap login is available now.

3. Configure RBAC for Ldap

After configuring dex ldap authentication successfully we can create rbac policies. Rbac configuration is stored in argocd-rbac-cm configmap. Detailed information can be found on Argo CD official rbac documentation page.

Argo CD has two pre-defined roles below.

• role:readonly - read-only access to all resources
• role:admin - unrestricted access to all resources

The anonymous access can be enabled using user.anonymous.enabled field in argocd-cm. The anonymous users get default role permissions specified by policy.default in argocd-rbac-cm. For read-only access, you can set policy.default: role:readonly. But in the example below, we prefer to have more security by setting policy.default: role:none and setting up a deny policy for role:none in policy.csv field. So, the default behavior is giving no access to any resource in Argo CD.

In the policy.csv field there are also two policy rules. One of them gives readonly acces for ldap group called Developers Ldap Group. Other rule gives admin rights to ldap user called myLdapUser.

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.default: role:none
  scopes: '[groups, email]'
  policy.csv: |
    p, role:none, *, *, */*, deny
    g, Developers Ldap Group, role:readonly
    g, myLdapUser, role:admin

Another policy.csv example taken from Argo CD official documentation can be found below. In this example, a custom role called stating-db-admins was created with seven permissions that allow performing the actions (create/delete/get/override/sync/update applications, and get appprojects) against * (all) objects in the staging-db-admins Argo CD AppProject.

p, role:staging-db-admins, applications, create, staging-db-admins/*, allow 
p, role:staging-db-admins, applications, delete, staging-db-admins/*, allow 
p, role:staging-db-admins, applications, get, staging-db-admins/*, allow 
p, role:staging-db-admins, applications, override, staging-db-admins/*, allow 
p, role:staging-db-admins, applications, sync, staging-db-admins/*, allow 
p, role:staging-db-admins, applications, update, staging-db-admins/*, allow 
p, role:staging-db-admins, projects, get, staging-db-admins, allow g, db-admins, role:staging-db-admins

Conclusion

To sum up, Argo CD is a powerful and straightforward continues delivery tool for Kubernetes. It is very popular in the community and the number of Argo CD users is increasing day to day. To enable developers and other colleges on Kubernetes environment and increase productivity setting up authentication and RBAC policies arevery important. Ldap integration is one of the ways to achieve this task. In this article installation of Argo CD and the configuration of Ldap authentication and RBAC policies are described by providing examples.