Skip to main content

Create a read-only Argo CD token

Astrolabe reads Argo CD with an API token. The token belongs to an account that may read applications, and nothing else.

The admin account cannot give you this token

By default, Argo CD's admin account only has the login capability. Asking for a token for it fails with: account 'admin' does not have apiKey capability. Create a dedicated account instead.

👤 Create a dedicated account​

Ask your Argo CD administrator to add an account, here astrolabe, in the argocd-cm and argocd-rbac-cm ConfigMaps of the argocd namespace:

# argocd-cm
data:
  accounts.astrolabe: apiKey
---
# argocd-rbac-cm
data:
  policy.csv: |
    p, astrolabe, applications, get, */*, allow

🔑 Generate the token​

Either in the Argo CD interface: Settings › Accounts › astrolabe › Generate New.

Or with the CLI:

argocd account generate-token --account astrolabe

Copy the token as is: a long string starting with eyJ, without Bearer in front.

Why read-only?

Every Astrolabe user reads Argo CD through this token. Astrolabe never writes to Argo CD: don't give it an administrator token.

✅ That's it!

Next: Add the Argo CD integration.