forked from argoproj/argo-workflows
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
27 changed files
with
265 additions
and
63 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -16,3 +16,5 @@ debug.test | |
/workflow-controller | ||
/.scannerwork/ | ||
/test-results/ | ||
/argo-server.crt | ||
/argo-server.key |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
# Security | ||
|
||
## Argo Server Security | ||
|
||
Argo Server implements security in three layers. | ||
|
||
Firstly, you should enable [transport layer security](tls.md) to ensure your data cannot be read in transit. | ||
|
||
Secondly, you should enable an [authentication mode](argo-server.md#auth-mode) to ensure that you do not run workflows from unknown users. | ||
|
||
Finally, you should configure the `argo-server` role and role binding with the correct permissions. | ||
|
||
### Read-Only | ||
|
||
You can achieve this by configuring the `argo-server` role ([example](../manifests/namespace-install/argo-server-rbac/argo-server-role.yaml) with only read access (i.e. only `get`/`list`/`watch` verbs). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,68 @@ | ||
# Transport Layer Security | ||
|
||
![alpha](assets/alpha.svg) | ||
|
||
> v2.9 and after | ||
If you're running Argo Server you have three options with increasing transport security (note - you should also be running [authentication](argo-server.md#auth-mode)): | ||
|
||
## Plain Text | ||
|
||
*Recommended for: dev* | ||
|
||
This is the default setting: everything is sent in plain text. | ||
|
||
To secure the UI you may front it with a HTTPS proxy. | ||
|
||
## Encrypted | ||
|
||
*Recommended for: development and test environments* | ||
|
||
You can encrypt connections without any real effort. | ||
|
||
Start Argo Server with the `--secure` flag, e.g.: | ||
|
||
``` | ||
argo server --secure | ||
``` | ||
|
||
It will start with a self-signed certificate that expires after 365 days. | ||
|
||
Run the CLI with `--secure` (or `ARGO_SECURE=true`) and `--insecure-skip-verify` (or `ARGO_INSECURE_SKIP_VERIFY=true`). | ||
|
||
``` | ||
argo --secure --insecure-skip-verify list | ||
``` | ||
|
||
``` | ||
export ARGO_SECURE=true | ||
export ARGO_INSECURE_SKIP_VERIFY=true | ||
argo --secure --insecure-skip-verify list | ||
``` | ||
|
||
Tip: Don't forget to update your readiness probe to use HTTPS, [example](../test/e2e/manifests/mixins/argo-server-deployment.yaml). | ||
|
||
### Encrypted and Verified | ||
|
||
*Recommended for: production environments* | ||
|
||
Run your HTTPS proxy in front of the Argo Server. You'll need to set-up your certificates and this out of scope of this documentation. | ||
|
||
Start Argo Server with the `--secure` flag, e.g.: | ||
|
||
``` | ||
argo server --secure | ||
``` | ||
|
||
As before, it will start with a self-signed certificate that expires after 365 days. | ||
|
||
Run the CLI with `--secure` (or `ARGO_SECURE=true`) only. | ||
|
||
``` | ||
argo --secure list | ||
``` | ||
|
||
``` | ||
export ARGO_SECURE=true | ||
argo --secure --insecure-skip-verify list | ||
``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.