Chapter 3. Configuring SSO for Argo CD using Keycloak

1. Delete the Dex configuration by removing the .spec.sso.dex parameter from the Argo CD custom resource (CR), and save the CR:

   dex:
       openShiftOAuth: true
       resources:
         limits:
           cpu:
           memory:
         requests:
           cpu:
           memory:

   Copy to Clipboard Toggle word wrap
2. Set the value of the provider parameter to keycloak in the Argo CD CR.

3. Configure Keycloak by performing one of the following steps:

   • For a secure connection, set the value of the rootCA parameter as shown in the following example:

     apiVersion: argoproj.io/v1beta1
     kind: ArgoCD
     metadata:
       name: example-argocd
       labels:
         example: basic
     spec:
       sso:
         provider: keycloak
         keycloak:
           rootCA: "<PEM-encoded-root-certificate>" 

     1

     
       server:
         route:
           enabled: true

     Copy to Clipboard Toggle word wrap

     1

     A custom certificate used to verify the Keycloak’s TLS certificate.

     The Operator reconciles changes in the .spec.sso.keycloak.rootCA parameter and updates the oidc.config parameter with the PEM encoded root certificate in the argocd-cm configuration map.

   • For an insecure connection, leave the value of the rootCA parameter empty and use the oidc.tls.insecure.skip.verify parameter as shown below:

     apiVersion: argoproj.io/v1beta1
     kind: ArgoCD
     metadata:
       name: example-argocd
       labels:
         example: basic
     spec:
       extraConfig:
         oidc.tls.insecure.skip.verify: "true"
       sso:
         provider: keycloak
         keycloak:
           rootCA: ""

     Copy to Clipboard Toggle word wrap

Procedure

1. Get the Keycloak route URL for login:

   $ oc -n argocd get route keycloak
   
   NAME        HOST/PORT                                                        PATH   SERVICES   PORT    TERMINATION   WILDCARD
   keycloak    keycloak-default.apps.ci-ln-******.origin-ci-int-aws.dev.**.com         keycloak   <all>    reencrypt     None

   Copy to Clipboard Toggle word wrap

2. Get the Keycloak pod name that stores the user name and password as environment variables:

   $ oc -n argocd get pods
   
   NAME                      READY   STATUS           RESTARTS   AGE
   keycloak-1-2sjcl           1/1    Running            0        45m

   Copy to Clipboard Toggle word wrap

   1. Get the Keycloak user name:

      $ oc -n argocd exec keycloak-1-2sjcl -- "env" | grep SSO_ADMIN_USERNAME
      
      SSO_ADMIN_USERNAME=Cqid54Ih

      Copy to Clipboard Toggle word wrap

   2. Get the Keycloak password:

      $ oc -n argocd exec keycloak-1-2sjcl -- "env" | grep SSO_ADMIN_PASSWORD
      
      SSO_ADMIN_PASSWORD=GVXxHifH

      Copy to Clipboard Toggle word wrap

3. On the login page, click LOG IN VIA KEYCLOAK.

   Note

   You only see the option LOGIN VIA KEYCLOAK after the Keycloak instance is ready.

4. Click Login with OpenShift.

   Note

   Login using kubeadmin is not supported.

5. Enter the OpenShift credentials to log in.

6. Optional: By default, any user logged in to Argo CD has read-only access. You can manage the user level access by updating the argocd-rbac-cm config map:

   policy.csv:
   <name>, <email>, role:admin

   Copy to Clipboard Toggle word wrap