Secure ArgoCD Multi-Cluster Management Across Clouds Without Static Tokens
summary
Demonstrates replacing static cluster creds by having ArgoCD call an OpenUnison token exchange to mint one‑minute tokens, using a small exec plugin in ArgoCD’s container (client‑go exec plugin) and either kube‑oidc‑proxy or Kubernetes 1.31 structured auth so downstream clusters will trust the JWTs. ApplicationSets generate Secrets that contain only config (no long‑lived tokens), the demo runs across four clusters (control plane, EKS + vcluster, on‑prem 1.31) and successfully syncs apps without static tokens.
AI-written summary · about
chapters (11)
- 0:00Secure multi-cluster ArgoCD intro
- 1:24Cross-cloud identity challenges
- 3:11Tokens for security
- 5:41Cluster auth anti-patterns
- 8:12ArgoCD identity limits
- 9:58OpenUnison as token service
- 11:22Kube ID proxy updates
- 12:25ArgoCD client plugins
- 14:09Demo setup overview
- 17:43Live secure sync demo
- 18:45Q&A
related talks
01h 38mScaling Multi-cluster Management with Argo CD and Application Sets
32mHow I Tricked ArgoCD Into Sharding on a Single Cluster
26mManaging GitOps Deployments in Multi-cluster Production Environments
31mConnecting Dots: Unified Hybrid Multi-Cluster Auth Experience With SPIFFE and Cluster Inventory API
25mAdministering Multi Cluster Service Meshes Securely
23mScale GitOps With the Argo CD Agent and Open Cluster Management
33mPortable, Universal Single Sign-On for Your Clusters
26mUnlocking the Power of Multi-Tenancy in ArgoCD: A Journey with Expedia..