Access control and user management

Procedure

1. Edit the

   argocd

   CR:

   $ oc edit argocd [argocd-instance-name] -n [namespace]

   Output:

   metadata
   ...
   ...
     rbac:
       policy: 'g, rbacsystem:cluster-admins, role:admin'
       scopes: '[groups]'

2. Add the

   policy

   configuration to the

   rbac

   section and add the

   name

   and the desired

   role

   to be applied to the user:

   metadata
   ...
   ...
   rbac:
       policy: g, <name>, role:<admin>
       scopes: '[groups]'

Procedure

1. Edit the ArgoCD custom resource for your instance:

   $ oc edit argocd <argocd_instance_name> -n <argocd_instance_namespace>

   Replace

   <argocd_instance_name>

   with the name of your Argo CD instance, for example,

   openshift-gitops

   , and

   <argocd_instance_namespace>

   with the namespace where the instance is deployed, for example,

   openshift-gitops

   .

2. Add or update the

   spec.oidcConfig

   parameter with your OIDC provider details:

   apiVersion: argoproj.io/v1beta1
   kind: ArgoCD
   metadata:
     name: <argocd_instance_name>
     namespace: <argocd_instance_namespace>
   spec:
     oidcConfig: |
       name: <provider_name>
       issuer: https://<issuer-url>
       clientID: <client_id>
       clientSecret: <client_secret>
       requestedScopes:
         - openid
         - profile
         - email
         - groups
       requestedIDTokenClaims:
         groups:
           essential: true
       logoutURL: https://<optional-logout-url>

   where:

   metadata.name

   Specifies the name of your Argo CD instance.

   metadata.namespace

   Specifies the namespace where your Argo CD instance is deployed.

   spec.oidcConfig.issuer

   Specifies the OIDC issuer URL provided by your identity provider.

   spec.oidcConfig.clientid

   Specifies the client ID obtained from your OIDC provider.

   spec.oidcConfig.clientSecret

   Specifies the client secret obtained from your OIDC provider.

   spec.oidcConfig.requestedScopes

   Specifies the OIDC scopes to request during authentication. Common scopes include openid, profile, email, and groups. Adjust based on your provider’s supported scopes.

   spec.oidcConfig.requestedIDTokenClaims

   Specifies the claims to request in the ID token. This parameter is optional.

   spec.oidcConfig.logoutURL

   Specifies the logout URL provided by your identity provider. This parameter is optional.

   <provider_name>

   Specifies a a unique identifier for the OIDC provider configuration.

3. Save the changes into a YAML file, for example,

   argocd-oidc.yaml

   .

4. Apply the configuration by running the following command.

   $ oc apply -f argocd-oidc.yaml

5. Restart the Argo CD server to apply the OIDC configuration:

   $ oc rollout restart deployment/<argocd_instance_name>-server -n <argocd_instance_namespace>

6. Run the following command to verify that the rollout completed successfully:

   $ oc rollout status deployment/<argocd_instance_name>-server -n <argocd_instance_namespace>

   Example output:

   deployment "openshift-gitops-server" successfully rolled out

Procedure

1. Open the Argo CD route URL in a web browser.
2. On the Argo CD login page, verify that a login option appears with the name you configured in the

   spec.oidcConfig.name

   parameter. For example,

   LOG IN VIA <provider_name>

   .
3. Authenticate using your identity provider credentials.
4. After successful authentication, verify the access and role-based permissions.

Procedure

1. Edit the Argo CD custom resource (CR) for your instance by running the following command:

   $ oc edit argocd <argocd-instance-name> -n <namespace>

2. In the

   spec

   section of the Argo CD CR, add a

   localUsers

   configuration. For example:

   spec:
     localUsers:
     - name: "alice"
       enabled: true
       apiKey: true
       login: false
       tokenLifetime: "24h"
       autoRenewToken: true
     - name: "service-account"
       enabled: true
       apiKey: true
       login: false
       tokenLifetime: "0h"  # Infinite lifetime
       autoRenewToken: false

3. Save and close the file.

   The Operator reconciles the changes and creates the required secrets and API tokens automatically.