Send GitHub Webhooks to On-Prem Argo CD Securely

​

What you’ll build

• A CloudEndpoint is the public URL you give to GitHub. Its Traffic Policy accepts only the /api/webhook path, verifies the GitHub signature, and rejects everything else.
• An AgentEndpoint with the internal URL https://argocd.internal points to the argocd-server Service. Only the Cloud Endpoint can send traffic to it.

​

What you’ll need

• An ngrok account and an API key.
• The ngrok CLI installed on your workstation.
• The ngrok Kubernetes Operator installed in the cluster. The cluster needs outbound access on port 443.
• Argo CD installed in the cluster. This guide uses the default argocd namespace and argocd-server Service.
• Admin access to the GitHub repository or organization that sends the webhooks.
• kubectl access to the argocd namespace.

​

1. Serve Argo CD over HTTP inside the cluster

kubectl -n argocd patch configmap argocd-cmd-params-cm \
  --type merge -p '{"data":{"server.insecure":"true"}}'
kubectl -n argocd rollout restart deployment argocd-server

​

2. Give Argo CD a private address

apiVersion: ngrok.k8s.ngrok.com/v1alpha1
kind: AgentEndpoint
metadata:
  name: argocd
  namespace: argocd
spec:
  url: https://argocd.internal
  upstream:
    url: http://argocd-server.argocd:80

kubectl apply -f argocd-agentendpoint.yaml

​

3. Store the signing secret in a vault

ngrok config add-api-key <YOUR_API_KEY>

ngrok api vaults create --name "webhook-secrets" --description "Webhook validation secrets"
ngrok api secrets create --name "github-secret" --value "<YOUR_GITHUB_WEBHOOK_SECRET>" --vault-id "<VAULT_ID>"

​

4. Create the CloudEndpoint and policy

apiVersion: ngrok.k8s.ngrok.com/v1alpha1
kind: CloudEndpoint
metadata:
  name: argocd-webhooks
  namespace: argocd
spec:
  url: https://<YOUR_NGROK_DOMAIN>
  trafficPolicy:
    policy:
      on_http_request:
        - name: AllowOnlyWebhookPath
          expressions:
            - "req.url.path != '/api/webhook'"
          actions:
            - type: deny
              config:
                status_code: 404

        - name: VerifyAndForward
          actions:
            - type: verify-webhook
              config:
                provider: github
                secret: "${secrets.get('webhook-secrets', 'github-secret')}"
            - type: forward-internal
              config:
                url: https://argocd.internal

kubectl apply -f argocd-cloudendpoint.yaml

• The first rule returns a 404 for every path except /api/webhook, so even a correctly signed request can only reach the webhook path.
• The verify-webhook action checks the GitHub signature. A request with a bad or missing signature gets a 403.
• The forward-internal action sends verified requests to argocd.internal. The path stays the same, so Argo CD receives the request at /api/webhook.

​

5. Configure the GitHub webhook

​

6. Test it

1. In GitHub, open the webhook, click the Recent Deliveries tab, and find the ping event. Click Redeliver.
2. In the ngrok dashboard, open the Traffic Inspector. The request to /api/webhook shows a 200 response from Argo CD.
3. Push a commit to a repository that an Argo CD Application tracks. Then check the argocd-server logs for the event:
   kubectl -n argocd logs deploy/argocd-server | grep -i "push event"
   
   The Application refreshes within seconds. If it has auto-sync turned on, it also syncs.
4. Confirm that ngrok rejects a forged request:
   curl -i -X POST https://<YOUR_NGROK_DOMAIN>/api/webhook \
     -H "Content-Type: application/json" \
     -H "X-GitHub-Event: push" \
     -d '{}'
   
   You get a 403 Forbidden, and Argo CD doesn’t see the request.
5. Confirm that other paths are blocked: curl -i https://<YOUR_NGROK_DOMAIN>/ returns a 404.