Security and RBAC

---

Table of Contents

1. Authentication
2. RBAC (Role-Based Access Control)
3. SSO (Single Sign-On)
4. Security best practices
5. Hands-on exercises

---

1 - Authentication

Local accounts

# argocd-cm ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  # Activer les comptes locaux
  accounts.alice: apiKey, login
  accounts.bob: login

# argocd-secret pour les mots de passe
apiVersion: v1
kind: Secret
metadata:
  name: argocd-secret
  namespace: argocd
data:
  # bcrypt hash du mot de passe
  accounts.alice.password: <bcrypt-hash>

Generate a bcrypt hash

# Via argocd CLI
argocd account bcrypt --password mypassword

# Via htpasswd
htpasswd -nbBC 10 "" mypassword | tr -d ':\n'

Account types

Type	Description
login	Access to the UI
apiKey	Generation of API tokens

Manage accounts

# Lister les comptes
argocd account list

# Changer le mot de passe d'un compte
argocd account update-password --account alice

# Générer un token API
argocd account generate-token --account alice

🔝 Back to table of contents

---

2 - RBAC (Role-Based Access Control)

Concepts

RBAC configuration

# argocd-rbac-cm ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.default: role:readonly
  policy.csv: |
    # Rôles personnalisés
    p, role:admin, applications, *, */*, allow
    p, role:admin, clusters, *, *, allow
    p, role:admin, repositories, *, *, allow
    p, role:admin, projects, *, *, allow
    
    p, role:developer, applications, get, */*, allow
    p, role:developer, applications, sync, */*, allow
    p, role:developer, applications, action/*, */*, allow
    
    p, role:readonly, applications, get, */*, allow
    p, role:readonly, projects, get, *, allow
    
    # Assignation aux utilisateurs
    g, alice, role:admin
    g, bob, role:developer
    g, charlie, role:readonly

Rule format

p, <role>, <resource>, <action>, <object>, <allow/deny>
g, <user/group>, <role>

Resources and actions

Resource	Actions
applications	get, create, update, delete, sync, override, action/*
clusters	get, create, update, delete
repositories	get, create, update, delete
projects	get, create, update, delete
accounts	get, update
gpgkeys	get, create, delete
logs	get
exec	create

Policy examples

# Lecture seule sur toutes les apps
p, role:viewer, applications, get, */*, allow

# Admin du projet "backend"
p, role:backend-admin, applications, *, backend/*, allow
p, role:backend-admin, projects, get, backend, allow

# Sync uniquement sur production
p, role:prod-deployer, applications, sync, default/prod-*, allow

🔝 Back to table of contents

---

3 - SSO (Single Sign-On)

Dex (built-in)

# argocd-cm
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  url: https://argocd.example.com
  dex.config: |
    connectors:
      - type: github
        id: github
        name: GitHub
        config:
          clientID: $dex.github.clientID
          clientSecret: $dex.github.clientSecret
          orgs:
            - name: my-org

GitHub OAuth

dex.config: |
  connectors:
    - type: github
      id: github
      name: GitHub
      config:
        clientID: <github-app-client-id>
        clientSecret: <github-app-client-secret>
        orgs:
          - name: my-organization

OIDC (Keycloak, Okta, etc.)

# argocd-cm
data:
  oidc.config: |
    name: Okta
    issuer: https://mycompany.okta.com
    clientID: <client-id>
    clientSecret: $oidc.okta.clientSecret
    requestedScopes: ["openid", "profile", "email", "groups"]

RBAC with SSO groups

# Mapper les groupes SSO aux rôles
g, my-org:admin-team, role:admin
g, my-org:developers, role:developer
g, my-org:viewers, role:readonly

🔝 Back to table of contents

---

4 - Security best practices

Principle of least privilege

# Éviter
p, role:dev, applications, *, */*, allow

# Préférer
p, role:dev, applications, get, default/*, allow
p, role:dev, applications, sync, default/dev-*, allow

Disable the admin account

# argocd-cm
data:
  admin.enabled: "false"

Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argocd-server
  namespace: argocd
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: argocd-server
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
      ports:
        - port: 8080

Audit

# Configurer les logs d'audit
# Les actions sont loggées automatiquement
# Utiliser un outil de centralisation (ELK, Loki)

kubectl logs -n argocd deployment/argocd-server

TLS

# Ingress avec TLS
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd
  annotations:
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
spec:
  tls:
    - hosts:
        - argocd.example.com
      secretName: argocd-tls

Security checklist

• Disable admin after SSO configuration
• Use granular RBAC
• Enable TLS/HTTPS
• Network Policies for isolation
• Centralized audit logging
• Regular token rotation
• Encrypted secrets (Sealed Secrets, SOPS)

🔝 Back to table of contents

---

5 - Hands-on exercises

Exercise 1: Create a developer account

# 1. Ajouter le compte dans argocd-cm
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  accounts.developer: login

# 2. Définir les permissions dans argocd-rbac-cm
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.csv: |
    p, role:developer, applications, get, */*, allow
    p, role:developer, applications, sync, */*, allow
    g, developer, role:developer

# 3. Définir le mot de passe
argocd account update-password --account developer

Exercise 2: Restrict access per project

# Un utilisateur ne peut voir que le projet "frontend"
p, role:frontend-dev, applications, get, frontend/*, allow
p, role:frontend-dev, applications, sync, frontend/*, allow
p, role:frontend-dev, projects, get, frontend, allow
g, alice, role:frontend-dev

Quiz

Q1. What is the difference between p and g in RBAC rules?

Answer

• p (policy): Defines the permissions of a role
• g (group): Assigns a user/group to a role

Example:

p, role:admin, applications, *, */*, allow  # Définition
g, alice, role:admin                         # Assignation

Q2. How do you disable the default admin account?

Answer

In the argocd-cm ConfigMap:

data:
  admin.enabled: "false"

You must first configure SSO or create other admin accounts.

🔝 Back to table of contents

---

Key takeaways

• Local accounts: argocd-cm ConfigMap + Secret
• RBAC: argocd-rbac-cm ConfigMap with p and g rules
• SSO: built-in Dex or external OIDC
• Least privilege: Granular permissions
• Disable admin after SSO configuration

---

← Previous chapter | Next chapter: Exercises →