Argo CD Ephemeral Access in Action: Lessons Learned While Runnin...
summary
Intuit runs Argo CD at scale—50+ Argo CD instances, 345+ Kubernetes clusters and ~24,000 PRs/day—and implements an Argo CD ephemeral access extension that enforces change requests on 100% of production UI actions. The system uses role templates and access bindings CRDs to map JWT group claims to fine‑grained roles, a configurable conditional extension keyed by labels, and a Go plugin interface that returns pending/granted/denied to drive timed grants and automatic revocation; the demo shows role-limited restart, spec edit, and controlled deletes working end-to-end.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:16Operating at scale
- 2:34Problem identification
- 5:02The ephemeral access extension
- 6:42Technical enhancements
- 16:16Live demonstration
- 20:56Results and conclusion
related talks
24mEnhancing Compliance and Safety with Argo CD Ephemeral Access
27mExploring Argo
18mUnveil the Secret Ingredients for Argo CD in the Enterprise-Scale
26mUnlocking the Power of Multi-Tenancy in ArgoCD: A Journey with Expedia..
22mTaming the Chaos: Fine-Grained RBAC in Argo CD for Incident Avoidance
35mHow To Build Production Grade DevOps Platform Using Argoproj
32mIntroduction to ArgoCD
38mMulti-Tenancy For Argo Workflows And Argo CD At Adobe