Chapter 3. Masking sensitive annotations in the Argo CD web UI

Procedure

1. Log in to the OpenShift Container Platform web console.
2. In the Administrator perspective of the web console, click Operators Installed Operators.
3. From the Project list, create or select the project where you want to install the user-defined Argo CD instance.
4. From the installed Operators list, select Red Hat OpenShift GitOps, and then click the Argo CD tab.

5. To mask additional annotation keys beyond the default, complete the following steps:

   1. Under the .spec.extraConfig section, set the resource.sensitive.mask.annotations key to a comma-separated list that includes any additional keys you want to mask.

      Note

      OpenShift Container Platform automatically masks openshift.io/token-secret.value by default. If you set resource.sensitive.mask.annotations explicitly in spec.extraConfig, your value replaces the default. To keep the default protection and add more keys, include openshift.io/token-secret.value in your list.

      apiVersion: argoproj.io/v1beta1
      kind: ArgoCD
      metadata:
        name: example
      spec:
        extraConfig:
          resource.sensitive.mask.annotations: openshift.io/token-secret.value, api-key, token

      where:

      spec.extraConfig.resource.sensitive.mask.annotations

      Specifies a comma-separated list of annotation keys to mask in the Argo CD web UI, such as openshift.io/token-secret.value, api-key, and token. OpenShift Container Platform automatically masks openshift.io/token-secret.value by default, so you do not need to specify it unless you add it alongside other keys.

      Important

      Ensure that the annotation keys listed in resource.sensitive.mask.annotations are accurate and relevant to your use case. Wildcards are not supported. Specify each annotation key explicitly.

6. Click Save.

7. To verify that the value in the Argo CD resource has been updated successfully, complete the following steps:

   1. In the Administrator perspective of the web console, click Operators Installed Operators.
   2. In the Project option, select the Argo CD namespace.
   3. From the installed Operators list, select Red Hat OpenShift GitOps, and then click the Argo CD tab.

   4. Verify that the Status field of the ArgoCD instance shows as Phase: Available.

      Argo CD hides the values of the specified annotation keys in the Argo CD UI.