GitOps the Hard Way, with Argo CD

Logging in With a Token

In addition to logging in with a username and password, it is also possible to log in using a token. This is useful if you want to call the CLI from third-party tools (like Jenkins or Ansible) or from scripts. By default, the admin does not have permission to generate a token.

If you type argocd account get | grep -i capabilities you will see the following output:

Capabilities:       login

The only capability the admin user has is login. This means the user can log in but cannot generate a token. To generate a token, you need the apiKey capability. We have to update the argocd-cm ConfigMap either to allow the admin to generate a token or to create a new user with the apiKey capability.

First, let's create a folder where we will store Argo CD configuration files:

mkdir -p $HOME/.argocd

Now, let's update the argocd-cm ConfigMap to allow the admin user to generate a token:

cat < $HOME/.argocd/argocd-cm.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
  name: argocd-cm
  namespace: argocd
data:
  accounts.admin: apiKey
EOF

Apply the ConfigMap:

kubectl -n argocd \
  apply -f $HOME/.argocd/argocd-cm.yaml

Now you need to generate a token. This can be done from the UI: