Ability to disable https://kubernetes.default.svc

[jessesuen]

Summary

Many users run Argo CD in a mode where that Argo CD instance doesn't ever need or want to deploy Applications to the same cluster Argo CD is running in (e.g. Intuit does this). For these users, the https://kubernetes.default.svc should be disabled and removed as an option.

Motivation

The ability to disable https://kubernetes.default.svc is both a security improvement as well as usability improvement since end-users do not see cluster which they cannot use.

Proposal

Argo CD should have an option to disable https://kubernetes.default.svc as a managed cluster so that it becomes impossible to deploy to.

[dirien]

Wow thats an interesting request. Happy to help.

[jessesuen]

Changes probably needed here:

argo-cd/util/db/cluster.go

Lines 55 to 79 in fe3cc72

	func (db *db) ListClusters(ctx context.Context) (*appv1.ClusterList, error) {
	clusterSecrets, err := db.listSecretsByType(common.LabelValueSecretTypeCluster)
	if err != nil {
	return nil, err
	}
	clusterList := appv1.ClusterList{
	Items: make([]appv1.Cluster, 0),
	}
	hasInClusterCredentials := false
	for _, clusterSecret := range clusterSecrets {
	cluster, err := secretToCluster(clusterSecret)
	if err != nil {
	log.Errorf("could not unmarshal cluster secret %s", clusterSecret.Name)
	continue
	}
	clusterList.Items = append(clusterList.Items, *cluster)
	if cluster.Server == appv1.KubernetesInternalAPIServerAddr {
	hasInClusterCredentials = true
	}
	}
	if !hasInClusterCredentials {
	clusterList.Items = append(clusterList.Items, *db.getLocalCluster())
	}
	return &clusterList, nil
	}

[pixelsoccupied]

Hi there, to reiterate -- if the user provides https://kubernetes.default.svc with .spec.destination.server or with cli --dest-server https://kubernetes.default.svc we would need to check need if there's a (new?) flag present before we proceed. If there's no flag just go on with the usual flow else log an error?

Could you talk a bit more about this flag/option to disable https://kubernetes.default.svc? Would the the user provide it during installation only? Or would there be a UI/CR/CLI/post-installation way as well? What would the flag be called?

[terrytangyuan]

@pixelsoccupied This will be a new key, e.g. "inClusterServerAddressAllowed", in ArgoCD ConfigMap so you can update it on the fly as well.

[terrytangyuan]

I created a draft PR in #7620. Feel free to leave your feedback there.

[agaudreault]

This does not seem to prevent Application from being created using this cluster. The only thing it is doing iis hiding the cluster from the list of available clusters. #21207

As it is documented, it would seem that this feature should prevent new applications from being created and should not sync existing applications with the in-cluster destination.