前言当 ArgoCD 管理多个团队的应用时权限隔离是必须的——A 团队不能看到或操作 B 团队的应用开发者不能修改生产配置。本篇从零配置 ArgoCD 的 RBAC 和 SSO实现企业级多租户。一、ArgoCD 认证体系认证Authentication: 你是谁 - 本地用户admin 和手动创建的用户 - SSOGitHub/GitLab/Google/LDAP/OIDC 授权Authorization: 你能做什么 - RBAC 策略 - AppProject 限制认证方式对比方式适用场景配置复杂度本地用户小团队低SSO - GitHub团队用 GitHub中SSO - GitLab团队用 GitLab中SSO - OIDC企业有 IdPOkta/Keycloak中高SSO - LDAP传统企业高二、配置 SSO以 GitHub 为例注册 OAuth AppGitHub → Settings → Developer settings → OAuth Apps → New OAuth App Application name: ArgoCD Homepage URL: https://argocd.mycompany.com Authorization callback URL: https://argocd.mycompany.com/api/dex/callback → 记录 Client ID 和 Client Secret配置 Dex# argocd-cm ConfigMap apiVersion: v1 kind: ConfigMap metadata: name: argocd-cm namespace: argocd data: url: https://argocd.mycompany.com # Dex 配置 dex.config: | connectors: - type: github id: github name: GitHub config: clientID: $GITHUB_CLIENT_ID clientSecret: $GITHUB_CLIENT_SECRET orgs: - name: myorg # 组织名 teams: - devops-team # 团队名 - team-alpha - team-beta # 加载所有团队不只是上面列出的 loadAllGroups: false # 团队名映射 teamNameField: slug在 Secret 中存储 OAuth 凭据# 更新 argocd-secret kubectl create secret generic argocd-secret \ -n argocd \ --from-literalgithub.clientID$GITHUB_CLIENT_ID \ --from-literalgithub.clientSecret$GITHUB_CLIENT_SECRET \ --dry-runclient -o yaml | kubectl apply -f - # 重启 Dex Server kubectl rollout restart deployment argocd-dex-server -n argocd登录后看到的身份SSO 登录后用户身份为: org:myorg:team:devops-team → 对应 GitHub 组织 myorg 下的 devops-team org:myorg:team:team-alpha → 对应 team-alpha 团队三、RBAC 策略配置策略语法p, role/user/group, resource, action, project/application, allow/deny 示例: p, role:admin, applications, *, */*, allow → admin 可以操作所有应用 p, role:viewer, applications, get, */*, allow → viewer 只能查看 p, org:myorg:team:team-alpha, applications, *, team-alpha/*, allow → team-alpha 可以操作自己的应用资源和操作资源可选操作说明applicationsget, create, update, delete, sync, *,应用管理clustersget, create, update, delete集群管理certificatesget, create, update, delete证书管理repositoriesget, create, update, delete仓库管理accountsget, update账户管理projectsget, create, update, delete项目管理gpgkeysget, create, deleteGPG 密钥RBAC ConfigMapapiVersion: v1 kind: ConfigMap metadata: name: argocd-rbac-cm namespace: argocd data: # 默认策略未匹配到任何规则的用户 policy.default: role:readonly # 详细策略 policy.csv: | # 角色定义 # 全局管理员 p, role:admin, applications, *, */*, allow p, role:admin, clusters, *, *, allow p, role:admin, repositories, *, *, allow p, role:admin, projects, *, *, allow p, role:admin, accounts, *, *, allow # 只读用户 p, role:readonly, applications, get, */*, allow p, role:readonly, clusters, get, *, allow p, role:readonly, repositories, get, *, allow p, role:readonly, projects, get, *, allow # team-alpha 团队 p, role:team-alpha, applications, *, team-alpha/*, allow p, role:team-alpha, projects, get, team-alpha, allow p, role:team-alpha, applications, sync, team-alpha/*-prod, deny # team-alpha 可以管理自己的应用但不能同步生产 # team-beta 团队 p, role:team-beta, applications, *, team-beta/*, allow p, role:team-beta, projects, get, team-beta, allow # 角色绑定 # GitHub 团队 → ArgoCD 角色 g, org:myorg:team:devops-team, role:admin g, org:myorg:team:team-alpha, role:team-alpha g, org:myorg:team:team-beta, role:team-beta # 本地用户 → 角色 g, alice, role:admin g, bob, role:readonly培训要点RBAC 策略中deny优先于allow。即使前面的规则 allow 了后面的 deny 仍然可以阻止。利用这一点可以给某个角色开了权限但禁掉特定操作。四、AppProject 权限隔离创建团队 Project# team-alpha 的 Project apiVersion: argoproj.io/v1alpha1 kind: AppProject metadata: name: team-alpha namespace: argocd spec: description: Team Alpha applications # 允许的 Git 仓库 sourceRepos: - https://github.com/myorg/team-alpha-* - https://github.com/myorg/shared-deploy # 允许的目标 destinations: # 只能部署到 team-alpha- 开头的命名空间 - server: https://kubernetes.default.svc namespace: team-alpha-* # 可以部署到共享的 dev 命名空间 - server: https://kubernetes.default.svc namespace: shared-dev # 允许的集群 sourceNamespaces: - team-alpha-dev - team-alpha-test # 允许的资源类型 namespaceResourceWhitelist: - group: * kind: * # 禁止的资源类型 namespaceResourceBlacklist: - group: kind: ResourceQuota # 不允许创建 ResourceQuota - group: kind: LimitRange # 集群资源白名单如 Namespace clusterResourceWhitelist: - group: kind: Namespace # 同步窗口 syncWindows: - kind: allow schedule: 0 9 * * 1-5 duration: 12h applications: - * manualSync: true - kind: deny schedule: 0 0 * * 0,6 # 周末禁止同步 duration: 48h applications: - *-prod manualSync: false # 角色定义配合 RBAC roles: - name: developer description: Team Alpha developers policies: - p, proj:team-alpha:developer, applications, get, team-alpha/*, allow - p, proj:team-alpha:developer, applications, sync, team-alpha/*-dev, allow - p, proj:team-alpha:developer, applications, sync, team-alpha/*-prod, deny groups: - org:myorg:team:team-alpha - name: lead description: Team Alpha leads policies: - p, proj:team-alpha:lead, applications, *, team-alpha/*, allow groups: - org:myorg:team:team-alpha-leadsApplication 关联 ProjectapiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: myapp-prod namespace: argocd spec: project: team-alpha # 关联到 team-alpha 项目 source: repoURL: https://github.com/myorg/team-alpha-myapp-deploy.git path: overlays/prod destination: server: https://kubernetes.default.svc namespace: team-alpha-myapp-prod五、多租户最佳实践1. 每个团队一个 ProjectAppProject: team-alpha → 限制到 team-alpha-* 命名空间 team-beta → 限制到 team-beta-* 命名空间 platform → 可以操作 kube-system 等基础设施命名空间2. SSO Group → Project Role 映射GitHub Teams: myorg:devops-team → ArgoCD role:admin myorg:team-alpha → AppProject team-alpha role:developer myorg:team-beta → AppProject team-beta role:developer3. 生产环境额外保护# 生产应用不允许自动同步必须手动审批 spec: project: team-alpha syncPolicy: # 不配置 automated → 手动同步 syncOptions: - CreateNamespacetrue # 配合同步窗口限制时间4. 审计日志# 查看 ArgoCD 操作日志 kubectl logs -n argocd -l app.kubernetes.io/nameargocd-server | grep GRPC # 查看 Application 变更事件 kubectl get events -n argocd --field-selector reasonApplicationSync # 定期导出审计日志 argocd admin settings rbac can --policy-file rbac-policy.csv \ role:team-alpha applications sync team-alpha/myapp-prod # 输出: yes / no六、本篇要点回顾认证用 SSOGitHub/GitLab/OIDC不推荐本地用户管理大量用户RBAC 策略语法p, subject, resource, action, object, allow/denydeny 优先于 allow可用于开了权限但禁特定操作AppProject 限制仓库、命名空间、资源类型、同步窗口SSO Group → Project Role 映射实现团队隔离生产环境手动同步 同步窗口 禁止自动同步下一篇预告《健康检查与资源钩子自定义健康状态》——从权限进入运维学习如何让 ArgoCD 更智能地判断应用健康状态。