can API be disabled to outside while UI is enabled?

[tooptoop4]

i imagine UI needs to call API so this would only be possible if they could run on different ports? then Ingress only opened on the UI port

this is related to #11391

[agilgur5]

i imagine UI needs to call API

Correct, so there's no way to truly distinguish a browser client from any other API client; any attempt to distinguish would be spoofable.

then Ingress only opened on the UI port

Then the UI would be unable to access the API. Remember the UI is running in your browser, so your browser must be able to access the API.

Not really an Argo specific question

[agilgur5]

I don't know what you mean by that. The "server side UI code" is the API. Again, the UI is just another client of the API, one that happens to run in a browser.
If you mean rendering on the server, other putting much more load on the server, being non-trivial in Go, and being a massive refactor and architectural shift, that also does not truly change access patterns, as those renderable endpoints must be reachable by a browser.
Again, this isn't Argo specific.

[tooptoop4]

browser > hit 443 ingress alb of UI (this port maps to pod port of 8080) > the underlying argo-server pod of this UI has received this request on internal 8080 port that pod exposes > the argo-server pod internally talks to API port 80 of argo-server pod via local port or k8s service (not ingress) > argo-server pod 8080 is then able to provide html response. port 80 is never mapped to an ingress

[agilgur5]

argo-server pod 8080 is then able to provide html response

This is effectively the same as server side rendering, so it has the same issues as I wrote above. An HTML response is basically just an obfuscation of the API response.

The proper way to handle this is via auth and firewalling (NetworkPolicy, VPN, etc). The API should only be accessible to authenticated users from within a VPN.

Your suggestion is also very similar to how server-side virtual desktops (VDIs) and similar type tools like remote browser isolation (RBI) work. Pretty out-of-scope.

[tooptoop4]

grafana uses some host allow list https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-request-security/

[agilgur5]

That's for server-side egress in Grafana, not ingress. You can also achieve the same via NetworkPolicies