ArgoCD Architecture

 

Authentication and Authorization

This document describes how authentication (authn) and authorization (authz) are implemented in Argo CD. There is a clear distinction in the code base of when and how these two security concepts are enforced.

Logical layers

The diagram bellow suggests 4 different logical layers (represented by 4 boxes: HTTP, gRPC, AuthN and AuthZ) inside Argo CD API server that collaborate to provide authentication and authorization.

  • HTTP: The HTTP layer groups the logical elements that collaborate to handle HTTP requests. Every incoming request reaches the same HTTP server at the same port (8080). This server will analyze the request headers and dispatch to the proper internal server: gRPC or standard HTTP.

  • gRPC: The gRPC layer groups the logical elements responsible for the gRPC implementation.

  • AuthN: The AuthN represents the layer responsible for authentication.

  • AuthZ: The AuthZ represents the layer responsible for authorization.

Argo CD Architecture

Logical elements

The logical elements (identified by numbers) can represent an object, a function or a component in the code base. Note that this particular distinction is not represented in the diagram.

Incoming requests can reach Argo CD API server from the web UI as well as from the argocd CLI. The responsibility of the represented elements are described below with their respective numbers:

  1. Cmux: Uses the cmux library to provide a connection multiplexer capability making it possible to use the same port to handle standard HTTP as well as gRPC requests. It is responsible for inspecting incoming requests and dispatch to appropriate internal servers. If the request version is http1.x it will delegate to the http mux. If the request version is http2 and has the header content-type: application/grpc, it will delegate to the gRPC Server.

  2. HTTP mux: A standard HTTP multiplexer that will handle non gRPC requests. It is responsible for serving a unified REST API to the web UI exposing all gRPC and non-gRPC services.

  3. gRPC-gateway: Uses the grpc-gateway library to translate internal gRPC services and expose them as a REST API. The great majority of API services in Argo CD are implemented in gRPC. The grpc-gateway makes it possible to access gRPC services from the web UI.

  4. Server: The internal gRPC Server responsible for handling gRPC requests.

  5. AuthN: Is responsible for invoking the authentication logic. It is registered as a gRPC interceptor which will automatically trigger for every gRPC request.

  6. Session Manager: Is the object responsible for managing Argo CD API server session. It provides the functionality to verify the validity of the authentication token provided in the request. Depending on how Argo CD is configured it may or may not delegate to an external AuthN provider to verify the token.

  7. AuthN Provider: Describes the component that can be plugged in Argo CD API server to provide the authentication functionality such as the login and the token verification process.

  8. Service Method: represents the method implementing the business logic (core functionality) requested. An example of business logic is: List Applications. Service methods are also responsible for invoking the RBAC enforcement function to validate if the authenticated user has permission to execute this method.

  9. RBAC: Is a collection of functions to provide the capability to verify if the user has permission to execute a specific action in Argo CD. It does so by validating the incoming request action against predefined RBAC rules that can be configured in Argo CD API server as well as in Argo CD Project CRD.

  10. Casbin: Uses the Casbin library to enforce RBAC rules.

  11. AuthN Middleware: Is an HTTP Middleware configured to invoke the logic to verify the token for HTTP services that are not implemented as gRPC and requires authentication.

  12. HTTP Handler: represents the http handlers responsible for invoking the business logic (core functionality) requested. An example of business logic is: List Applications. Http handlers are also responsible for invoking the RBAC enforcement function to validate if the authenticated user has permission to execute this business logic.

Comments

Post a Comment

Popular posts from this blog

Terraform

Image
  Terraform is an infrastructure as code tool that lets you build, change, and version cloud and on-prem resources safely and efficiently. HashiCorp Terraform is an infrastructure as code tool that lets you define both cloud and on-prem resources in human-readable configuration files that you can version, reuse, and share. You can then use a consistent workflow to provision and manage all of your infrastructure throughout its lifecycle. Terraform can manage low-level components like compute, storage, and networking resources, as well as high-level components like DNS entries and SaaS features. How does Terraform work? Terraform creates and manages resources on cloud platforms and other services through their application programming interfaces (APIs). Providers enable Terraform to work with virtually any platform or service with an accessible API. HashiCorp and the Terraform community have already written  thousands of providers  to manage many different types of resources and services.
Read more

Scrum Master Interview help - Bootcamp

Understanding the MoSCoW prioritization | How to implement it into your project Projects, irrespective of their size or complexity, often juggle numerous tasks and requirements. In such a scenario,  MoSCoW prioritization  becomes essential to ensure the successful completion of the project.  Besides, it is also a very effective way to manage project priorities. With a straightforward and adaptable approach, the MoSCoW method helps manage stakeholder expectations and improve project outcomes. What is the MoSCoW prioritization technique?  The MoSCoW method is a prioritization matrix widely used in project management and software development. The term MoSCoW is an acronym that stands for  Must have ,  Should have ,  Could have , and  Won’t have , each denoting a level of priority. Here is the breakdown of the MoSCoW method:  Must have:  These are critical requirements that the project cannot be completed without them. If these are not fulfilled, the project is con
Read more

Kubernetes

  Using containers to host applications and other processes has gone mainstream. As more and more workload is moved into containers, management systems are needed to handle the demands of containerized applications at scale. One of the most popular options for managing  container-based workload is Kubernetes . Kubernetes combines container management automation with an extensible API to create a cloud-native application management powerhouse. At its core, Kubernetes manages the placement of pods, which can consist of one or more containers, on a Kubernetes cluster node. Additionally, if one of these pods crashes, Kubernetes can create a new instance of it. If a cluster node is removed, Kubernetes can move any affected workload to a different node in the cluster. On top of that, Kubernetes pods can be scaled to provide more or less throughput to meet scale demands and these scale operations can be triggered manually or automatically using Kuberentes horizontal pod auto-scaling. Finally,
Read more