ArgoCD Security

ArgoCD implements multiple security layers designed for production Kubernetes environments. Security features include role-based access control with custom roles, OIDC and SAML authentication integration, project-level application isolation, and support for external secrets management. ArgoCD follows security best practices for handling Git credentials, cluster access tokens, and webhook payloads.

ArgoCD supports integration with OIDC providers (Okta, Keycloak, Azure AD, Google Workspace, Dex), SAML 2.0, and LDAP for centralized authentication. RBAC policies can be defined at the global, project, and application level with granular permissions for sync, delete, update, and get operations. Local users with bcrypt-hashed passwords are supported for environments without external identity providers.

ArgoCD stores sensitive data including cluster credentials and Git repository SSH keys as Kubernetes secrets. For production deployments, ArgoCD should be configured with external secrets management solutions like HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault through plugins. Repository credentials can be scoped to specific projects, and cluster credentials are stored encrypted at rest in etcd when Kubernetes encryption is configured.

All ArgoCD API communication should use TLS with properly configured certificates. The argocd-server can be configured with mutual TLS for client certificate authentication. Webhook connections from Git providers should use HMAC verification with shared secrets. gRPC traffic between ArgoCD components can be secured with TLS. Network policies should restrict access to ArgoCD components to authorized clients only.

ArgoCD supports image signature verification through integration with Sigstore/Cosign and Notary. ApplicationSets can enforce policies for signed container images and verified Git commits. The ArgoCD project itself follows secure development practices with regular security audits and a coordinated vulnerability disclosure process. As a CNCF graduated project, it benefits from the foundation's security audit program.