Securing Argo
Argo is an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes. This guide covers how to add authentication and authorization to Argo using Pomerium.
Install Argo
To install Argo in Kubernetes you can either follow the instructions here, or use Helm. This guide will use the Helm chart.
Run the following commands:
helm repo add argo https://argoproj.github.io/argo-helm
helm repo update
helm install \
--namespace kube-system \
--set minio.install=true \
--set installCRD=false \
argo argo/argo
kubectl apply \
--namespace kube-system \
--file https://raw.githubusercontent.com/argoproj/argo/master/manifests/base/crds/workflow-crd.yaml
You should now have a working Argo installation using Minio to store artifacts. Both Argo and Minio provide web-based GUIs. Confirm that Minio is working by running:
kubectl --namespace kube-system port-forward svc/argo-minio 9000:9000
You should now be able to reach the Minio UI by accessing http://localhost:9000/minio. If you're curious the Access Key and Secret Key are generated by the Helm chart and stored in a Kubernetes secret:
kubectl --namespace=kube-system get secret argo-minio -o yaml
For now though, let's terminate the Minio kubectl port-forward
and create one for the Argo UI:
kubectl --namespace kube-system port-forward svc/argo-server 2746:2746
Visiting http://localhost:2746
should take you to the Argo Workflows dashboard.
Install NGINX Ingress Controller
We will use NGINX as our ingress controller. To install it with Helm run the following commands:
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm install --namespace kube-system ingress-nginx ingress-nginx/ingress-nginx
Install Pomerium
Like with Argo we will install Pomerium using the Helm chart. First create a values.yaml
file (replacing the email.is
and IDP provider
/clientID
/clientSecret
with your own):
config:
routes:
- from: https://argo.localhost.pomerium.io
to: http://argo-server.kube-system.svc.cluster.local:2746
policy:
- allow:
or:
- email:
is: user@example.com
authenticate:
idp:
provider: google
clientID: REPLACE_ME
clientSecret: REPLACE_ME
ingress:
annotations:
nginx.ingress.kubernetes.io/backend-protocol: https
Run the following commands (replacing the IDP provider
/clientID
/clientSecret
with your own):
helm repo add pomerium https://helm.pomerium.io
helm repo update
helm install \
--set config.sharedSecret="$(head -c32 /dev/urandom | base64)" \
--set config.cookieSecret="$(head -c32 /dev/urandom | base64)" \
--values values.yaml \
pomerium pomerium/pomerium
You should now be able to reach argo by using kubectl port-forward
with the NGINX ingress controller (binding :443 may require using sudo with kubectl):
kubectl --namespace kube-system port-forward svc/ingress-nginx-controller 443:443
And visit: https://argo.localhost.pomerium.io.