~/ nmadiraju.com Amazon EKS · Argo CD capability access
arrow_back Back to nmadiraju
Architecture Explorer · Delivery and operations

Reaching a Managed Argo CD on Amazon EKS

With the EKS Capability for Argo CD, AWS runs Argo CD for you. Click any part of the access path to see what it does and what breaks without it, then follow one engineer from her laptop to a synced app.

Managed Argo CD access in 60 seconds

  • The capability. Turn on the EKS Capability for Argo CD for one hub cluster, and AWS runs Argo CD for you behind one web address.
  • Gate 1, network. Public by default. A VPC endpoint, a private doorway into AWS, makes it private: reach it over Direct Connect or VPN.
  • Gate 2, identity. People sign in only through IAM Identity Center, AWS's single sign-on. Then their group needs an Argo CD role to see anything.
  • Gate 3, Access Entries. An Access Entry, EKS's list of who may use a cluster, lets Argo CD's role in: edit one namespace, read all.

1Explore the access path

Access to the EKS Capability for Argo CD: one address, then the network, identity and Access Entry gates Left, an engineer at home and in the office. Next, the internet, Direct Connect and a network VPC with an eks-capabilities VPC endpoint. In the middle, the AWS-managed capability: its server URL and Argo CD, with IAM Identity Center below. Right, the platform account with the capability role and hub cluster platform-hub (namespace argocd and its Access Entry), and two more accounts with clusters prod-a and prod-b, each with an Access Entry for the capability role. Maya · at home laptop, internet Maya · office corporate network Internet public DNS, public IPs any network Direct Connect or Site-to-Site VPN via Transit Gateway NETWORK VPC VPC endpoint eks-capabilities SG: 443 from office networks AWS-MANAGED Server URL one AWS-hosted address UI · API · CLI · webhooks Argo CD (managed) API, repo server, controllers AWS runs and upgrades it no Pods on your nodes IAM Identity Center federates Okta, Entra ID the only sign-in path no load balancer, no Ingress no certificate to build PLATFORM ACCOUNT 111122223333 · us-east-1 no role per cluster no peering to other accounts Capability role ArgoCDCapabilityRole one role, every cluster EKS platform-hub namespace argocd Applications · AppProjects the Argo CD data you hold Access Entry · hub Argo CD's own policies only no rights to deploy apps ACCT 222233334444 · us-east-1 Access Entry for ArgoCDCapabilityRole EKS prod-a · K8s API private API endpoint ACCT 333344445555 · us-west-2 Access Entry for ArgoCDCapabilityRole EKS prod-b · K8s API another Region

    2What broke? Check yourself

    Check yourself