[archived] "Argo Server Auth Mode" docs discussion

[giscus[bot]]

en/latest/argo-server-auth-mode/

https://argo-workflows.readthedocs.io/en/latest/argo-server-auth-mode/

[Adam-D-Lewis]

this will use the same service account as per "server" for RBAC. We expect to change this in the future so that the OAuth claims are mapped to service accounts.

I believe that's out of date since https://argoproj.github.io/argo-workflows/argo-server-sso/#sso-rbac seems to describe how to map OIDC groups to service accounts.

[agilgur5]

Indeed, I updated this in #13137. PRs always welcome!

[edalonso]

I'm trying to configure kong as ingress with:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    konghq.com/protocols: "https"
    konghq.com/https-redirect-status-code: "308"
    konghq.com/strip-path: "true"
  name: argo-server-ingress
  namespace: cicd
spec:
  ingressClassName: kong
  rules:
  - host: www.example.com
    http:
      paths:
      - backend:
          service:
            name: argo-server
            port:
              number: 2746
        path: /argo
        pathType: ImplementationSpecific

In argo server I configure:

        env:
          - name: BASE_HREF
            value: /argo/

and not work.
Do you know which is the problem?

[edalonso]

At the end I disabled https in argo-server and works ok

      - args:
        - server
        - --namespaced
        - "--auth-mode=server"
        - "--secure=false"

[jamesdboone]

For user-friendliness, might be nice not to have to add 'Bearer ' before the client token when pasting into login page...

[DaraDadachanji]

Oh wow thank you. This had me stumped

[gtato]

I don't understand how the RBAC works in Argo Server. I am using the client mode, I created a dummy service account and a token in an completeley unrelated namespace, and used it to authenticate with the Argo server. That not only worked, but I can do everything with it: run/delete workflows... And this service account does not have any roles or any permission.

[agilgur5]

Without any details on your configuration, based on the behavior, I'm going to assume you had both --auth-mode=client and --auth-mode=server enabled.

--auth-mode=server is almost equivalent to no auth, as it uses the Server's own SA. You generally don't want to enable that mode in a production set-up.

If you only have --auth-mode=client, it will work as you expected.

Source: I have configured both variants myself in the past.