kargo configuration for okta sso

[L0rdWyd3r]

Hi everyone,

I am new here and starting my adventure with Kargo.
I am generally at the stage of implementing Kargo and SSO with OKTA on my EKS cluster.

My configuration (SSO OKTA) for Kargo is almost identical to the one I did for ArgoCD and works very well, but for ArgoCD not for Kargo.

Unfortunately I am not able to configure the same for Kargo.

I have pasted below the anonymised contents of the values.yaml file, maybe one of you will be able to point out to me what I have misconfigured in this file.

global:
  env: []
  envFrom: []
  nodeSelector: {}

  labels: {}
  annotations: {}
  podLabels: {}
  podAnnotations: {}

  tolerations: []
  affinity: {}
  securityContext: {}

image:
  repository: ghcr.io/akuity/kargo
  tag: ""
  pullPolicy: IfNotPresent
  pullSecrets: []

rbac:
  installClusterRoles: true
  installClusterRoleBindings: true

crds:
  install: true
  keep: true

kubeconfigSecrets: {}

api:
  enabled: true
  replicas: 1
  host: kargo.mydomain.net
  logLevel: DEBUG

  labels: {}
  annotations: {}
  podLabels: {}
  podAnnotations: {}

  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  securityContext: {}
  env: []
  envFrom: []

  probes:
    enabled: true

  tls:
    enabled: true
    selfSignedCert: true

  enablePermissiveCORSPolicy: true

  ingress:
    enabled: true
    annotations:
      alb.ingress.kubernetes.io/scheme: internet-facing
      alb.ingress.kubernetes.io/target-type: ip
      alb.ingress.kubernetes.io/backend-protocol: HTTPS
      alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":80}, {"HTTPS":443}]'
      alb.ingress.kubernetes.io/ssl-redirect: "443"
      alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:eu-west-1:111111111111:certificate/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
    ingressClassName: alb
    tls:
      enabled: true
      selfSignedCert: false
    pathType: Prefix

  service:
    type: ClusterIP
    annotations: {}

  secret:
    name: "kargo-admin"

  adminAccount:
    enabled: true
    passwordHash: ""
    tokenSigningKey: ""
    tokenTTL: 24h

  oidc:
    enabled: true
    issuerURL:
    clientID:
    cliClientID:

    admins:
      subs: []
      emails: []
      groups: []

    viewers:
      subs: []
      emails: []
      groups: []

    globalServiceAccounts:
      namespaces: []

    dex:
      enabled: true

      image:
        repository: ghcr.io/dexidp/dex
        tag: v2.37.0
        pullPolicy: IfNotPresent
        pullSecrets: []

      env: []
      envFrom: []

      volumes: []

      volumeMounts:

      probes:
        enabled: true

      tls:
        selfSignedCert: true
      skipApprovalScreen: false
      connectors:
        - type: saml
          id: okta
          name: Okta
          config:
            ssoURL: https://mydomain.okta.com/app/mydomain_kargoapp_1/exkLps17kyiG587l3EJ3/sso/saml
            caData: "base64 encoded cert"
            usernameAttr: name
            emailAttr: email
            groupsAttr: groups
            allowedGroups:
              - Admins-Kargo
            redirectURI: https://kargo.mydomain.net/dex/callback

      resources: {}
      nodeSelector: {}
      tolerations: []
      affinity: {}
      annotations: {}
      securityContext: {}

  argocd:
    urls:

  rollouts:
    integrationEnabled: true

controller:
  enabled: true

  labels: {}
  annotations: {}
  podLabels: {}
  podAnnotations: {}

  serviceAccount:
    iamRole: ""

  globalCredentials:
    namespaces: []

  gitClient:
    name: "Kargo Render"
    email: "[email protected]"

    signingKeySecret:
      name: ""
      type: ""

  securityContext: {}

  argocd:
    integrationEnabled: true
    namespace: argocd
    watchArgocdNamespaceOnly: false

  rollouts:
    integrationEnabled: true
    controllerInstanceID: ""

  logLevel: INFO

  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  env: []
  envFrom: []

managementController:
  enabled: true

  logLevel: INFO

  labels: {}
  annotations: {}
  podLabels: {}
  podAnnotations: {}

  securityContext: {}

  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  env: []
  envFrom: []

webhooks:
  register: true

webhooksServer:
  enabled: true
  replicas: 1
  logLevel: INFO

  labels: {}
  annotations: {}
  podLabels: {}
  podAnnotations: {}

  tls:
    selfSignedCert: true
  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  securityContext: {}
  env: []
  envFrom: []

garbageCollector:
  enabled: true
  schedule: "0 * * * *"
  workers: 3
  maxRetainedPromotions: 20
  maxRetainedFreight: 20
  logLevel: INFO

  labels: {}
  annotations: {}
  podLabels: {}
  podAnnotations: {}

  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  securityContext: {}
  env: []
  envFrom: []

Thank you very much in advance for any help.

[krancour]

@L0rdWyd3r what specific issues/errors are you running into?

[L0rdWyd3r]

@krancour - Generally I get 405 Method Not Allowed, and I have no idea why

Below is what I see in the Brave developer console.

Any idea what I have messed up in this configuration possibly where to look for the error ?
Thanks

[krancour]

@L0rdWyd3r this strikes me possibly as mis-configuration on the Okta end, but I'm not entirely certain of that.

It's odd that the browser is posting to /api/dex/callback. That actually doesn't look like a legitimate Kargo path.

Two things I think you could also attempt in an effort to troubleshoot:

1. Are the results any different with a browser other than Brave? With Brave's strong focus on security, I would wish to just rule out that the browser itself isn't being more strict about something than most others.

2. I believe Okta supports OIDC w/ PKCE directly, meaning you could try this without Dex as the middle-man and that may remove a variable from the troubleshooting equation.