pomerium/docs/guides/argo.md

107 lines
3.6 KiB
Markdown

---
title: Argo
lang: en-US
meta:
- name: keywords
content: pomerium identity-access-proxy argo argo-cd
description: >-
This guide covers how to add authentication and authorization to an instance
of argo.
---
# Securing Argo
[Argo](https://argoproj.github.io/projects/argo) is an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes. This guide covers how to add authentication and authorization to Argo using Pomerium.
## Install Argo
To install Argo in Kubernetes you can either follow the instructions [here](https://github.com/argoproj/argo/blob/master/docs/getting-started.md), or use [Helm](https://github.com/argoproj/argo-helm/tree/master/charts/argo). This guide will use the Helm chart.
Run the following commands:
```bash
helm repo add argo https://argoproj.github.io/argo-helm
helm repo update
helm install \
--namespace kube-system \
--set minio.install=true \
--set installCRD=false \
argo argo/argo
kubectly apply \
--namespace kube-system \
--file https://raw.githubusercontent.com/argoproj/argo/master/manifests/base/crds/workflow-crd.yaml
```
You should now have a working Argo installation using [Minio](https://min.io/) to store artifacts. Both Argo and Minio provide web-based GUIs. Confirm that Minio is working by running:
```bash
kubectl --namespace kube-system port-forward svc/argo-minio 9000:9000
```
You should now be able to reach the Minio UI by accessing <http://localhost:9000/minio>. If you're curious the Access Key and Secret Key are generated by the Helm chart and stored in a Kubernetes secret:
```bash
kubectl --namespace=kube-system get secret argo-minio -o yaml
```
For now though, let's terminate the Minio `kubectl port-forward` and create one for the Argo UI:
```bash
kubectl --namespace kube-system port-forward svc/argo-server 2746:2746
```
Visiting <http://localhost:2746> should take you to the Argo Workflows dashboard.
## Install NGINX Ingress Controller
We will use [NGINX](https://kubernetes.github.io/ingress-nginx/deploy/#using-helm) as our ingress controller. To install it with Helm run the following commands:
```bash
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm install --namespace kube-system ingress-nginx ingress-nginx/ingress-nginx
```
## Install Pomerium
Like with Argo we will install Pomerium using the [Helm chart](https://github.com/pomerium/pomerium-helm). First create a `values.yaml` file (replacing the `allowed_users` and IDP `provider`/`clientID`/`clientSecret` with your own):
```yaml
config:
rootDomain: localhost.pomerium.io
policy:
- from: https://argo.localhost.pomerium.io
to: http://argo-server.kube-system.svc.cluster.local:2746
allowed_users:
- REPLACE_ME
authenticate:
idp:
provider: google
clientID: REPLACE_ME
clientSecret: REPLACE_ME
ingress:
annotations:
nginx.ingress.kubernetes.io/backend-protocol: https
```
Run the following commands (replacing the IDP `provider`/`clientID`/`clientSecret` with your own):
```bash
helm repo add pomerium https://helm.pomerium.io
helm repo update
helm install \
--set config.sharedSecret="$(head -c32 /dev/urandom | base64)" \
--set config.cookieSecret="$(head -c32 /dev/urandom | base64)" \
--values values.yaml \
pomerium pomerium/pomerium
```
You should now be able to reach argo by using `kubectl port-forward` with the NGINX ingress controller (binding :443 may require using sudo with kubectl):
```bash
kubectl --namespace kube-system port-forward svc/ingress-nginx-controller 443:443
```
And visit: <https://argo.localhost.pomerium.io/>.