Option to disable swagger-ui endpoint

[svghadi]

Summary

Provide a option to disable the authenticated /swagger-ui endpoint which serves the api documentation.

Motivation

Api docs are served on <argocd-url>/swagger-ui endpoint without authentication. Even though these docs are the same across different Argo CD instances and don't pose a security risk when exposed, some of the users are interested is disabling it.

Proposal

Make the endpoint configurable via a argocd-cm configmap key (eg: disableSwaggerUI: true) or a cli argument to argocd-server (eg: --disable-swagger-ui)

[crenshaw-dev]

Any reason not to just disable it at the ingress?

[svghadi]

Not specifically, I didn’t consider that approach. I was looking for a simpler solution.

[crenshaw-dev]

Fair. I'm in favor of fewer options in Argo CD if possible, but if we need it we need it. 🙂

[svghadi]

Copying comment(#16791 (comment)) from related discussion for code reference

pasha-codefresh
Unfortunately no, but should be pretty easy to support it

argo-cd/server/server.go

Line 1076 in a0a5a18

swagger.ServeSwaggerUI(mux, assets.SwaggerJSON, "/swagger-ui", a.RootPath)

[andrii-korotkov-verkada]

@svghadi, do you still need the option?

[svghadi]

It would be good to have this option. Even though the API docs are the same across different Argo CD instances and don't pose a security risk, some users might be interested in disabling the API documentation UI.

[crenshaw-dev]

If there's no pressing need, and if network rules can generally solve the problem, I'd rather avoid adding Argo CD code for this relative edge case.

[svghadi]

Understood. That sounds reasonable. I'll reopen the issue if there’s a pressing need from users in the future."