Access control and user management

Procedure

1. Edit the argocd CR:

   $ oc edit argocd [argocd-instance-name] -n [namespace]

   Output

   metadata
   ...
   ...
     rbac:
       policy: 'g, rbacsystem:cluster-admins, role:admin'
       scopes: '[groups]'

2. Add the policy configuration to the rbac section and add the name and the desired role to be applied to the user:

   metadata
   ...
   ...
   rbac:
       policy: g, <name>, role:<admin>
       scopes: '[groups]'

1. Delete the Dex configuration by removing the .spec.sso.dex parameter from the Argo CD custom resource (CR), and save the CR:

   dex:
       openShiftOAuth: true
       resources:
         limits:
           cpu:
           memory:
         requests:
           cpu:
           memory:

2. Set the value of the provider parameter to keycloak in the Argo CD CR.

3. Configure Keycloak by performing one of the following steps:

   • For a secure connection, set the value of the rootCA parameter as shown in the following example:

     apiVersion: argoproj.io/v1beta1
     kind: ArgoCD
     metadata:
       name: example-argocd
       labels:
         example: basic
     spec:
       sso:
         provider: keycloak
         keycloak:
           rootCA: "<PEM-encoded-root-certificate>" 1
       server:
         route:
           enabled: true

     1

     A custom certificate used to verify the Keycloak’s TLS certificate.

     The Operator reconciles changes in the .spec.sso.keycloak.rootCA parameter and updates the oidc.config parameter with the PEM encoded root certificate in the argocd-cm configuration map.

   • For an insecure connection, leave the value of the rootCA parameter empty and use the oidc.tls.insecure.skip.verify parameter as shown below:

     apiVersion: argoproj.io/v1beta1
     kind: ArgoCD
     metadata:
       name: example-argocd
       labels:
         example: basic
     spec:
       extraConfig:
         oidc.tls.insecure.skip.verify: "true"
       sso:
         provider: keycloak
         keycloak:
           rootCA: ""

   • Optional: Customize the spec.sso.keycloak field to add the route name for the keycloak provider in the ArgoCD CR. Use this feature to support advanced routing use cases, such as balancing incoming traffic load among multiple Ingress Controller sharding.

     • Add a host parameter in the ArgoCD CR by using the following example YAML:

       Example ArgoCD CR

       apiVersion: argoproj.io/v1alpha1
       kind: ArgoCD
       metadata:
         name: <resource_name> 1
         labels:
           example: route
       spec:
         sso:
           provider: keycloak
           keycloak:
            host: <hostname> 2
         server:
           ingress:
             enabled: true
           insecure: true

       1

       Replace <resource_name> with the name of the ArgoCD CR.

       2

       Replace <hostname> with the name of the host key, for example, sso.test.example.com.

     • To create the ArgoCD CR, run the following command:

       $ oc create -f <argocd_filename>.yaml -n <your-namespace>

     • To edit the ArgoCD CR, run the following command:

       $ oc edit -f <argocd_filename>.yaml -n <your_namespace>

     • Save the file to apply the changes.

     • To apply the ArgoCD CR, run the following command:

       $ oc apply -f <argocd_filename>.yaml -n <your_namespace>

     • Verify that the host attribute is added by running the following command:

       $ oc get route keycloak -n <your_namespace> -o yaml

       Example output

       kind: Route
       metadata:
         name: keycloak 1
         labels:
           application: keycloak
       spec:
         host: sso.test.example.com
       status:
         ingress:
           - host: sso.test.example.com 2

       1

       Specifies the name of the route.

       2

       Specifies the name of the host key.

       Note

       The Keycloak instance takes 2-3 minutes to install and run.

Procedure

1. Get the Keycloak route URL for login:

   $ oc -n argocd get route keycloak
   
   NAME        HOST/PORT                                                        PATH   SERVICES   PORT    TERMINATION   WILDCARD
   keycloak    keycloak-default.apps.ci-ln-******.origin-ci-int-aws.dev.**.com         keycloak   <all>    reencrypt     None

2. Get the Keycloak pod name that stores the user name and password as environment variables:

   $ oc -n argocd get pods
   
   NAME                      READY   STATUS           RESTARTS   AGE
   keycloak-1-2sjcl           1/1    Running            0        45m

   1. Get the Keycloak user name:

      $ oc -n argocd exec keycloak-1-2sjcl -- "env" | grep SSO_ADMIN_USERNAME
      
      SSO_ADMIN_USERNAME=Cqid54Ih

   2. Get the Keycloak password:

      $ oc -n argocd exec keycloak-1-2sjcl -- "env" | grep SSO_ADMIN_PASSWORD
      
      SSO_ADMIN_PASSWORD=GVXxHifH

3. On the login page, click LOG IN VIA KEYCLOAK.

   Note

   You only see the option LOGIN VIA KEYCLOAK after the Keycloak instance is ready.

4. Click Login with OpenShift.

   Note

   Login using kubeadmin is not supported.

5. Enter the OpenShift credentials to log in.

6. Optional: By default, any user logged in to Argo CD has read-only access. You can manage the user level access by updating the argocd-rbac-cm config map:

   policy.csv:
   <name>, <email>, role:admin