[argo-workflows] Argo UI silently defaults to authentication since chart 0.4.0

[reinvantveer]

Describe the bug

Since argo-workflows chart v0.4.0, the user interface to Argo server requires authentication by default (probably since introduction of a 3.0.7+ version of appVersion. I think I traced this to commit 04cbf21, before then, I was able to access the web UI without any kind of authentication.

Since our gateway handles the authentication part, I have no need for additional authentication layers. But I haven't been able to find the documentation on how to disable something that was disabled by default before.

The behaviour can be disabled by adding

server:
  extraArgs:
    - --auth-mode=server

to the configured values. If this is no longer the desired default, this should ideally be documented.

To Reproduce

1. Install argo-workflows helm chart v0.3.0
2. Visit http://{your_domain/and/any/subpaths}/argo. You have immediate access to the UI
3. Deploy argo-workflows helm chart v0.4.0
4. Visit http://{your_domain/and/any/subpaths}/argo again, you get a login screen (see below)

Expected behavior

I'd like access to the web UI without authentication please

Screenshots

Additional context

Added the pod manifest as deployed locally on my machine
argo-server.zip

[reinvantveer]

I'm more than willing to submit a fix for this, but the question is rather what the default behavior of the Argo server application should be

[yriveiro]

SSO login implies some external dependencies and non-trivial configurations. If the UI is not exposed in a public network deploy and access Argo should be straightforward.

I expend 2h trying to disable the login once I don't wanna deploy a Keycloak service or configure SSO from my cloud provider to explore Argo.

IMO the default should be no login and for extra security configure SSO or RBAC if available.

[reinvantveer]

@mkilchhofer This asks for directions from the argo-helm maintainers I believe. Can you please advise?

[mkilchhofer]

Hmm I don't use workflows, therefore I cannot assist here.
But from what I see in their CHANGELOG.md, this is a normal behavior

v3.1.0-rc1 (2021-05-12)

• (..)
• 01d310235 chore(server)!: Required authentication by default. Resolves #5206 (#5211)

Source: https://github.com/argoproj/argo-workflows/blob/master/CHANGELOG.md

xref:

• TOB-ARGO-TM12: Enable Argo Server authentication by default argo-workflows#5206
• chore(server)!: Required authentication by default. Resolves #5206 argo-workflows#5211

[yriveiro]

Ok,auth is required as the default, my question is, we authenticate against what? Dex?

[mkilchhofer]

Did you read the operator manual? :)
https://argoproj.github.io/argo-workflows/argo-server-auth-mode/

There are 3 modes.
If you want to use the "sso" mode: Yes, dex is supported: https://argoproj.github.io/argo-workflows/argo-server-sso-argocd/

[yriveiro]

I see ..., by design, Argo UI doesn't work without an external dependency.

For people that don't know the tech will be a barrier to play with Argo Workflows out of the box but if Argo's team did the change should be a reasoning behind it.

PS: thanks for pointing the docs.

[reinvantveer]

I see ..., by design, Argo UI doesn't work without an external dependency.

Well, fortunately it does with --auth-mode=server, but it I think it calls for just a little more documentation on the helm side.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[reinvantveer]

Had some trouble finding the time for this, but here it is

[reinvantveer]

For future visitors of this issue: in the linked PR this entry was added to the workflows chart README: https://github.com/argoproj/argo-helm/tree/master/charts/argo-workflows#workflow-server-authentication