Mitigating Privilege Escalation in Multi-Tenant Argo CD
summary
Argocd’s multi-tenant privilege problem gets two concrete fixes: policy enforcement with Kyverno or OPA to block misconfigured projects, and a new app sync with impersonation feature that maps a service account per tenant to each destination. The impersonation feature is alpha, disabled by default, enabled via argocd-cm, requires per-tenant namespaces and RoleBindings, and lets Kubernetes RBAC drive sync permissions so syncs are decoupled, accidental deletions are harder, and multiple destinations with the same URL work; demo not shown.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:41Privilege escalation overview
- 2:04Attack types
- 4:34Argo CD multi-tenant security
- 6:19Argo CD architecture risks
- 7:26Projects and security roles
- 8:28Kyverno policy enforcement
- 9:34App sync with impersonation
- 10:37Impersonation prevention
- 11:19Impersonation benefits
- 11:42Resources
- 12:03Key takeaways and conclusion
related talks
24mManaging Argo CD Multi-Tenancy Effectively
21mMulti-Tenant ArgoCD with security and isolation
38mMulti-Tenancy For Argo Workflows And Argo CD At Adobe
22mTaming the Chaos: Fine-Grained RBAC in Argo CD for Incident Avoidance
24mEnhancing Compliance and Safety with Argo CD Ephemeral Access
25mNetwork Segmentation at Scale: GitOps-Driven Multi-Tenant Isol...
31mAttacking Argo CD with Argo CD (and then Defending)
25mPolicy-Based GitOps: How Policies Can Help Secure and Automate GitOps...