mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-02 03:46:29 +02:00
106 lines
3.6 KiB
Markdown
106 lines
3.6 KiB
Markdown
---
|
|
title: Argo
|
|
lang: en-US
|
|
meta:
|
|
- name: keywords
|
|
content: pomerium identity-access-proxy argo argo-cd
|
|
description: >-
|
|
This guide covers how to add authentication and authorization to an instance
|
|
of argo.
|
|
---
|
|
|
|
# Securing Argo
|
|
|
|
[Argo](https://argoproj.github.io/projects/argo) is an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes. This guide covers how to add authentication and authorization to Argo using Pomerium.
|
|
|
|
## Install Argo
|
|
|
|
To install Argo in Kubernetes you can either follow the instructions [here](https://github.com/argoproj/argo/blob/master/docs/getting-started.md), or use [Helm](https://github.com/argoproj/argo-helm/tree/master/charts/argo). This guide will use the Helm chart.
|
|
|
|
Run the following commands:
|
|
|
|
```bash
|
|
helm repo add argo https://argoproj.github.io/argo-helm
|
|
helm repo update
|
|
helm install \
|
|
--namespace kube-system \
|
|
--set minio.install=true \
|
|
--set installCRD=false \
|
|
argo argo/argo
|
|
kubectly apply \
|
|
--namespace kube-system \
|
|
--file https://raw.githubusercontent.com/argoproj/argo/master/manifests/base/crds/workflow-crd.yaml
|
|
```
|
|
|
|
You should now have a working Argo installation using [Minio](https://min.io/) to store artifacts. Both Argo and Minio provide web-based GUIs. Confirm that Minio is working by running:
|
|
|
|
```bash
|
|
kubectl --namespace kube-system port-forward svc/argo-minio 9000:9000
|
|
```
|
|
|
|
You should now be able to reach the Minio UI by accessing <http://localhost:9000/minio>. If you're curious the Access Key and Secret Key are generated by the Helm chart and stored in a Kubernetes secret:
|
|
|
|
```bash
|
|
kubectl --namespace=kube-system get secret argo-minio -o yaml
|
|
```
|
|
|
|
For now though, let's terminate the Minio `kubectl port-forward` and create one for the Argo UI:
|
|
|
|
```bash
|
|
kubectl --namespace kube-system port-forward svc/argo-server 2746:2746
|
|
```
|
|
|
|
Visiting <http://localhost:2746> should take you to the Argo Workflows dashboard.
|
|
|
|
## Install NGINX Ingress Controller
|
|
|
|
We will use [NGINX](https://kubernetes.github.io/ingress-nginx/deploy/#using-helm) as our ingress controller. To install it with Helm run the following commands:
|
|
|
|
```bash
|
|
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
|
|
helm repo update
|
|
helm install --namespace kube-system ingress-nginx ingress-nginx/ingress-nginx
|
|
```
|
|
|
|
## Install Pomerium
|
|
|
|
Like with Argo we will install Pomerium using the [Helm chart](https://github.com/pomerium/pomerium-helm). First create a `values.yaml` file (replacing the `allowed_users` and IDP `provider`/`clientID`/`clientSecret` with your own):
|
|
|
|
```yaml
|
|
config:
|
|
policy:
|
|
- from: https://argo.localhost.pomerium.io
|
|
to: http://argo-server.kube-system.svc.cluster.local:2746
|
|
allowed_users:
|
|
- REPLACE_ME
|
|
|
|
authenticate:
|
|
idp:
|
|
provider: google
|
|
clientID: REPLACE_ME
|
|
clientSecret: REPLACE_ME
|
|
|
|
ingress:
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/backend-protocol: https
|
|
```
|
|
|
|
Run the following commands (replacing the IDP `provider`/`clientID`/`clientSecret` with your own):
|
|
|
|
```bash
|
|
helm repo add pomerium https://helm.pomerium.io
|
|
helm repo update
|
|
helm install \
|
|
--set config.sharedSecret="$(head -c32 /dev/urandom | base64)" \
|
|
--set config.cookieSecret="$(head -c32 /dev/urandom | base64)" \
|
|
--values values.yaml \
|
|
pomerium pomerium/pomerium
|
|
```
|
|
|
|
You should now be able to reach argo by using `kubectl port-forward` with the NGINX ingress controller (binding :443 may require using sudo with kubectl):
|
|
|
|
```bash
|
|
kubectl --namespace kube-system port-forward svc/ingress-nginx-controller 443:443
|
|
```
|
|
|
|
And visit: <https://argo.localhost.pomerium.io/>.
|