Disabling the Argo CD admin user after SSO setup
Retiring the built-in admin account once SSO or local users work: admin.enabled, keeping a break-glass path, resetting the admin password, and what happens to existing admin tokens.
Argo CD security hardening
Specific controls that reduce what an attacker can do through Argo CD: admin and RBAC defaults, signed commits, repo-server exposure, cluster privileges, webhooks, audit trails and patching.
Hardening Argo CD RBAC defaults and anonymous access
Closing the gaps in a default RBAC setup: why policy.default cannot be narrowed by deny rules, minimal default roles, anonymous access risks, local users sharing names with SSO groups, and validating policies.
Verifying signed Git commits in Argo CD
Blocking syncs of commits that were not signed by approved keys with Source Integrity Verification: per-project and per-source rules, GnuPG key management, and what breaks for local syncs and hydrated commits.
Isolating the Argo CD repo-server from untrusted repositories
Limiting damage from malicious Helm charts, Kustomize files or plugins: what the repo-server executes, network policies around it and Redis, manifest size limits, plugin credential exposure, and restricting source repositories per project.
Securing Argo CD Git webhooks
Protecting the public /api/webhook endpoint: shared secrets per provider, storing them in labeled Secrets, payload size limits without rate limiting, and treating webhook content as untrusted.
Argo CD audit logging and change history
Building an audit trail auditors accept from Argo CD: Kubernetes events with the responsible actor, retaining events with an exporter, Git history versus what was actually synced, sync history in the application, and notifications.
Argo CD security patches and supported versions
Keeping Argo CD inside the supported window: three supported minor versions, quarterly minor releases, reading GitHub security advisories, and a patch routine that does not break production syncs.
Protecting the argocd namespace from tenant applications
Stopping tenants from escalating to Argo CD admin: why projects that can deploy into the argocd namespace are effectively admin, sourceNamespaces rules, app of apps repository access, and cluster resource allow lists.
