feat(argo): Adds SSO configuration for Argo Server. (#381)

charts/argo/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 appVersion: v2.8.0
 description: A Helm chart for Argo Workflows
 name: argo
-version: 0.9.7
+version: 0.9.8
 icon: https://raw.githubusercontent.com/argoproj/argo/master/docs/assets/argo.png
 home: https://github.com/argoproj/argo-helm
 maintainers:

charts/argo/templates/workflow-controller-config-map.yaml

@@ -67,6 +67,6 @@ data:
     {{- if .Values.controller.workflowDefaults }}
     workflowDefaults:
 {{ toYaml .Values.controller.workflowDefaults | indent 6 }}{{- end }}
-    {{- with .Values.controller.sso }}
-    sso:
-{{ toYaml . | indent 6 }}{{- end }}
+    {{- with .Values.server.sso }}
+    sso: {{- toYaml . | nindent 6 }}
+    {{- end }}

charts/argo/values.yaml

@@ -54,7 +54,6 @@ controller:
   #     name: argo-postgres-config
   #     key: password
   workflowDefaults: {}  # Only valid for 2.7+
-  sso: {}  # Only valid for 2.9+
   #  spec:
   #    ttlStrategy:
   #      secondsAfterCompletion: 84600
@@ -202,6 +201,23 @@ server:
   clusterWorkflowTemplates:
     # Give the server permissions to edit ClusterWorkflowTemplates.
     enableEditing: true
+  sso:
+    ## SSO configuration when SSO is specified as a server auth mode.
+    ## All the values are requied. SSO is activated by adding --auth-mode=sso
+    ## to the server command line.
+    #
+    ## The root URL of the OIDC identity provider.
+    # issuer: https://accounts.google.com
+    ## Name of a secret and a key in it to retrieve the app OIDC client ID from.
+    # clientId:
+    #   name: argo-server-sso
+    #   key: client-id
+    ## Name of a secret and a key in it to retrieve the app OIDC client secret from.
+    # clientSecret:
+    #   name: argo-server-sso
+    #   key: client-secret
+    ## The OIDC redirect URL. Should be in the form <argo-root-url>/oauth2/callback.
+    # redirectUrl: https://argo/oauth2/callback
 
 # Influences the creation of the ConfigMap for the workflow-controller itself.
 useDefaultArtifactRepo: false