From 10a99f1ae9c2b3e8bf829b84d54a7ded1b761e24 Mon Sep 17 00:00:00 2001 From: Tim Collins Date: Wed, 31 Mar 2021 06:49:26 +0100 Subject: [PATCH 1/3] docs: Add optional SSO expiry to example configmap and docs Signed-off-by: Tim Collins --- USERS.md | 1 + docs/argo-server-sso.md | 1 + docs/workflow-controller-configmap.yaml | 3 +++ 3 files changed, 5 insertions(+) diff --git a/USERS.md b/USERS.md index 9a30c4c47737..d1eb830b595d 100644 --- a/USERS.md +++ b/USERS.md @@ -105,6 +105,7 @@ Currently, the following organizations are **officially** using Argo Workflows: 1. [SAS](https://www.sas.com/) 1. [Schlumberger](https://slb.com/) 1. [SegmentStream](https://segmentstream.com) +1. [Sendible](https://sendible.com) 1. [Sidecar Technologies](https://hello.getsidecar.com/) 1. [Softonic](https://hello.softonic.com/) 1. [Sohu](https://www.sohu.com/) diff --git a/docs/argo-server-sso.md b/docs/argo-server-sso.md index 3c2e053c42b4..3a914962efbe 100644 --- a/docs/argo-server-sso.md +++ b/docs/argo-server-sso.md @@ -149,6 +149,7 @@ What this might look like in your chart configuration: - --auth-mode=sso sso: issuer: https://argo-cd.mydomain.com/api/dex + expiry: 240 clientId: name: argo-workflows-sso key: client-id diff --git a/docs/workflow-controller-configmap.yaml b/docs/workflow-controller-configmap.yaml index ef8e9f06e7f6..744f6cbb3193 100644 --- a/docs/workflow-controller-configmap.yaml +++ b/docs/workflow-controller-configmap.yaml @@ -267,6 +267,9 @@ data: sso: | # This is the root URL of the OIDC provider (required). issuer: https://issuer.root.url/ + # This defines how long your login is valid for (in hours). (optional) + # If omitted, defaults to 24h. Example below is 10 days. + expiry: 240 # This is name of the secret and the key in it that contain OIDC client # ID issued to the application by the provider (required). clientId: From 5b61bd4a98d55aed10317e6dbd46a9f359540504 Mon Sep 17 00:00:00 2001 From: Tim Collins Date: Thu, 1 Apr 2021 07:18:17 +0100 Subject: [PATCH 2/3] docs: Default expiry is 10h, and time is Duration Signed-off-by: Tim Collins --- docs/argo-server-sso.md | 15 ++++++++++++++- docs/workflow-controller-configmap.yaml | 4 ++-- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/docs/argo-server-sso.md b/docs/argo-server-sso.md index 3a914962efbe..9722ffe5e8dc 100644 --- a/docs/argo-server-sso.md +++ b/docs/argo-server-sso.md @@ -108,6 +108,18 @@ If no rule matches, we deny the user access. The precedence must be the lowest of all your service accounts. +## SSO Login Time + +> v2.12 and after + +By default, your SSO session will expire after 10 hours. You can change this by adding an expiry value to your [workflow-controller-configmap.yaml](workflow-controller-configmap.yaml) under the SSO heading. + + ```yaml + sso: + # Expiry defines how long your login is valid for in hours. (optional) + expiry: 240h + ``` + ## Sharing the Argo CD Dex Instance using Oauth2 It is possible to have the Argo Workflows Server use the Argo CD Dex instance for SSO, for instance if you use Okta with SAML which cannot integrate with Argo Workflows directly. In order to make this happen, you will need the following: @@ -149,7 +161,8 @@ What this might look like in your chart configuration: - --auth-mode=sso sso: issuer: https://argo-cd.mydomain.com/api/dex - expiry: 240 + # Expiry defines how long your login is valid for in hours. (optional, default: 10h) + expiry: 240h clientId: name: argo-workflows-sso key: client-id diff --git a/docs/workflow-controller-configmap.yaml b/docs/workflow-controller-configmap.yaml index 744f6cbb3193..5becd72f0dc6 100644 --- a/docs/workflow-controller-configmap.yaml +++ b/docs/workflow-controller-configmap.yaml @@ -268,8 +268,8 @@ data: # This is the root URL of the OIDC provider (required). issuer: https://issuer.root.url/ # This defines how long your login is valid for (in hours). (optional) - # If omitted, defaults to 24h. Example below is 10 days. - expiry: 240 + # If omitted, defaults to 10h. Example below is 10 days. + expiry: 240h # This is name of the secret and the key in it that contain OIDC client # ID issued to the application by the provider (required). clientId: From 1f1d83e05848e3c1813ed405c033ff82d98ae812 Mon Sep 17 00:00:00 2001 From: Tim Collins Date: Wed, 7 Apr 2021 08:40:40 +0100 Subject: [PATCH 3/3] docs: Add optional SSO expiry to example configmap and docs Signed-off-by: Tim Collins --- docs/argo-server-sso.md | 8 ++++---- docs/workflow-controller-configmap.yaml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/argo-server-sso.md b/docs/argo-server-sso.md index 9722ffe5e8dc..e11eee6b3353 100644 --- a/docs/argo-server-sso.md +++ b/docs/argo-server-sso.md @@ -112,12 +112,12 @@ If no rule matches, we deny the user access. > v2.12 and after -By default, your SSO session will expire after 10 hours. You can change this by adding an expiry value to your [workflow-controller-configmap.yaml](workflow-controller-configmap.yaml) under the SSO heading. +By default, your SSO session will expire after 10 hours. You can change this by adding a sessionExpiry value to your [workflow-controller-configmap.yaml](workflow-controller-configmap.yaml) under the SSO heading. ```yaml sso: # Expiry defines how long your login is valid for in hours. (optional) - expiry: 240h + sessionExpiry: 240h ``` ## Sharing the Argo CD Dex Instance using Oauth2 @@ -161,8 +161,8 @@ What this might look like in your chart configuration: - --auth-mode=sso sso: issuer: https://argo-cd.mydomain.com/api/dex - # Expiry defines how long your login is valid for in hours. (optional, default: 10h) - expiry: 240h + # sessionExpiry defines how long your login is valid for in hours. (optional, default: 10h) + sessionExpiry: 240h clientId: name: argo-workflows-sso key: client-id diff --git a/docs/workflow-controller-configmap.yaml b/docs/workflow-controller-configmap.yaml index 5becd72f0dc6..a9c281b486c2 100644 --- a/docs/workflow-controller-configmap.yaml +++ b/docs/workflow-controller-configmap.yaml @@ -269,7 +269,7 @@ data: issuer: https://issuer.root.url/ # This defines how long your login is valid for (in hours). (optional) # If omitted, defaults to 10h. Example below is 10 days. - expiry: 240h + sessionExpiry: 240h # This is name of the secret and the key in it that contain OIDC client # ID issued to the application by the provider (required). clientId: