Chapter 3. Configuring SSO for Argo CD using Keycloak

1. Delete the Dex configuration by removing the .spec.sso.dex parameter from the Argo CD custom resource (CR), and save the CR:

   Copy to Clipboard Toggle word wrap

   dex:
       openShiftOAuth: true
       resources:
         limits:
           cpu:
           memory:
         requests:
           cpu:
           memory:

2. Set the value of the provider parameter to keycloak in the Argo CD CR.

3. Configure Keycloak by performing one of the following steps:

   • For a secure connection, set the value of the rootCA parameter as shown in the following example:

     Copy to Clipboard Toggle word wrap

     apiVersion: argoproj.io/v1beta1
     kind: ArgoCD
     metadata:
       name: example-argocd
       labels:
         example: basic
     spec:
       sso:
         provider: keycloak
         keycloak:
           rootCA: "<PEM-encoded-root-certificate>" 

     1

     
       server:
         route:
           enabled: true

     1

     A custom certificate used to verify the Keycloak’s TLS certificate.

     The Operator reconciles changes in the .spec.sso.keycloak.rootCA parameter and updates the oidc.config parameter with the PEM encoded root certificate in the argocd-cm configuration map.

   • For an insecure connection, leave the value of the rootCA parameter empty and use the oidc.tls.insecure.skip.verify parameter as shown below:

     Copy to Clipboard Toggle word wrap

     apiVersion: argoproj.io/v1beta1
     kind: ArgoCD
     metadata:
       name: example-argocd
       labels:
         example: basic
     spec:
       extraConfig:
         oidc.tls.insecure.skip.verify: "true"
       sso:
         provider: keycloak
         keycloak:
           rootCA: ""

Procedure

1. Get the Keycloak route URL for login:

   Copy to Clipboard Toggle word wrap

   $ oc -n argocd get route keycloak
   
   NAME        HOST/PORT                                                        PATH   SERVICES   PORT    TERMINATION   WILDCARD
   keycloak    keycloak-default.apps.ci-ln-******.origin-ci-int-aws.dev.**.com         keycloak   <all>    reencrypt     None

2. Get the Keycloak pod name that stores the user name and password as environment variables:

   Copy to Clipboard Toggle word wrap

   $ oc -n argocd get pods
   
   NAME                      READY   STATUS           RESTARTS   AGE
   keycloak-1-2sjcl           1/1    Running            0        45m

   1. Get the Keycloak user name:

      Copy to Clipboard Toggle word wrap

      $ oc -n argocd exec keycloak-1-2sjcl -- "env" | grep SSO_ADMIN_USERNAME
      
      SSO_ADMIN_USERNAME=Cqid54Ih

   2. Get the Keycloak password:

      Copy to Clipboard Toggle word wrap

      $ oc -n argocd exec keycloak-1-2sjcl -- "env" | grep SSO_ADMIN_PASSWORD
      
      SSO_ADMIN_PASSWORD=GVXxHifH

3. On the login page, click LOG IN VIA KEYCLOAK.

   Note

   You only see the option LOGIN VIA KEYCLOAK after the Keycloak instance is ready.

4. Click Login with OpenShift.

   Note

   Login using kubeadmin is not supported.

5. Enter the OpenShift credentials to log in.

6. Optional: By default, any user logged in to Argo CD has read-only access. You can manage the user level access by updating the argocd-rbac-cm config map:

   Copy to Clipboard Toggle word wrap

   policy.csv:
   <name>, <email>, role:admin