argocd account - Argo CD

The argocd account command manages user account settings, including passwords, tokens, and permissions.

Quick Examples

# List all accounts
argocd account list

# Update current user's password
argocd account update-password

# Check permissions
argocd account can-i sync applications '*'

# Get user information
argocd account get-user-info

Subcommands

list

List all user accounts.

# List all accounts
argocd account list

# List as JSON
argocd account list -o json

# List as YAML
argocd account list -o yaml

Output:

NAME       ENABLED  CAPABILITIES
admin      true     login, apiKey
ci-user    true     apiKey
read-only  true     login

get

Get account details.

# Get specific account
argocd account get admin

# Get current account
argocd account get-user-info

# Get as JSON
argocd account get admin -o json

Output:

Name:         admin
Enabled:      true
Capabilities: login, apiKey
Tokens:       3

get-user-info

Get information about the currently logged-in user.

# Get current user info
argocd account get-user-info

# Get as JSON
argocd account get-user-info -o json

Output:

Logged In as: admin
Iss:          argocd
Sub:          admin
Groups:       admin-group
Capabilities: login, apiKey

This shows:

Current username
JWT issuer
JWT subject
SSO groups (if applicable)
Available capabilities

update-password

Update account password.

Interactive
Non-Interactive
Update Other User

Update password with prompts:

argocd account update-password

You’ll be prompted:

*** Enter current password:
*** Enter new password:
*** Confirm new password:
Password updated

Update password from command line:

argocd account update-password \
  --current-password oldpass123 \
  --new-password newpass456

Admin can update another user’s password:

argocd account update-password \
  --account ci-user \
  --new-password newpass789

Key Flags:

--account

string

Account name (admins only, updates another user)

--current-password

string

Current password (required unless admin)

--new-password

string

New password

Strong passwords are recommended. Use at least 12 characters with a mix of uppercase, lowercase, numbers, and symbols.

generate-token

Generate authentication token for an account.

# Generate token for current account
argocd account generate-token

# Generate token for specific account
argocd account generate-token --account ci-user

# Generate with expiration
argocd account generate-token --expires-in 90d

# Generate with ID for identification
argocd account generate-token --id github-actions

# Generate for project role
argocd account generate-token \
  --account proj:my-project:ci-cd \
  --expires-in 180d \
  --id jenkins

Key Flags:

--account

string

Account name or project role (format: proj:PROJECT:ROLE)

--expires-in

duration

Token expiration (e.g., 24h, 30d, 1y). Defaults to no expiration

--id

string

Token identifier for easy identification

Output:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJhcmdvY2QiLCJzdWIiOiJhZG1pbjpsb2dpbiIsIm5iZiI6MTYzOTU4NjQwMCwiaWF0IjoxNjM5NTg2NDAwLCJqdGkiOiJnaXRodWItYWN0aW9ucyJ9.abc123def456

Save the token securely. It cannot be retrieved later, only regenerated.

Using Generated Tokens

# Save token to environment variable
TOKEN=$(argocd account generate-token --account ci-user)
export ARGOCD_AUTH_TOKEN=$TOKEN

# Use with CLI
argocd app list --auth-token $TOKEN --server cd.example.com

# Use with API
curl -H "Authorization: Bearer $TOKEN" \
  https://cd.example.com/api/v1/applications

list-tokens

List authentication tokens for an account (requires account name).

# List tokens for specific account
argocd account get admin

# Note: Use project role commands for detailed token listing
argocd proj role list-tokens my-project ci-cd

delete-token

Delete an authentication token.

# Delete token by ID
argocd account delete-token 1234567890

# Delete for specific account
argocd account delete-token --account ci-user 9876543210

# For project roles
argocd proj role delete-token my-project ci-cd 1234567890

Key Flags:

--account

string

Account name or project role

can-i

Check if the current user has permission to perform an action.

# Check application sync permission
argocd account can-i sync applications '*'

# Check specific application
argocd account can-i sync applications 'my-project/my-app'

# Check cluster permissions
argocd account can-i create clusters '*'

# Check repository permissions
argocd account can-i update repositories '*'

# Check project permissions
argocd account can-i get projects '*'

Syntax:

argocd account can-i <action> <resource> [object]

Common Actions:

get - View resources
create - Create new resources
update - Modify existing resources
delete - Remove resources
sync - Synchronize applications
override - Override parameters
action - Execute resource actions

Common Resources:

applications - Argo CD applications
applicationsets - ApplicationSets
clusters - Cluster credentials
repositories - Repository connections
projects - Projects
accounts - User accounts
certificates - TLS certificates
gpgkeys - GPG keys

Output:

yes

no

bcrypt

Generate bcrypt hash for a password.

# Generate bcrypt hash
argocd account bcrypt --password mySecurePassword123

# Or with prompt
argocd account bcrypt

Output:

$2a$10$rRyBsGSHK6.uc8fntPwVIuLVHgsAhAX7TcdrqW/XhLkqGnJ8J6UBS

This hash can be used in the argocd-cm ConfigMap for local user definitions.

Account Management

Local Users vs SSO

Argo CD supports two types of users:

Local Users: Defined in argocd-cm ConfigMap
SSO Users: Authenticated via OIDC/SAML

Managing Local Users

Local users are defined in the argocd-cm ConfigMap:

argocd-cm.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  # Add local users
  accounts.alice: apiKey, login
  accounts.bob: apiKey
  accounts.ci-user: apiKey

Capabilities:

login - Can log in via UI/CLI
apiKey - Can generate API tokens

Then set passwords in argocd-secret:

# Generate password hash
PASSWORD_HASH=$(argocd account bcrypt --password alicePassword123)

# Update secret
kubectl patch secret argocd-secret -n argocd \
  -p '{"stringData": {
    "accounts.alice.password": "'$PASSWORD_HASH'"
  }}'

Common Workflows

First-Time Setup

# 1. Get initial admin password
argocd admin initial-password

# 2. Login
argocd login cd.example.com --username admin

# 3. Update admin password
argocd account update-password

# 4. Verify update
argocd account get-user-info

Create Service Account for CI/CD

# 1. Create local user in argocd-cm
kubectl patch configmap argocd-cm -n argocd --type merge \
  -p '{"data":{"accounts.ci-deployer":"apiKey"}}'

# 2. Generate password hash
PASSWORD_HASH=$(argocd account bcrypt --password secure-ci-password)

# 3. Set password in secret
kubectl patch secret argocd-secret -n argocd \
  -p '{"stringData":{"accounts.ci-deployer.password":"'$PASSWORD_HASH'"}}'

# 4. Restart Argo CD server to apply changes
kubectl rollout restart deployment argocd-server -n argocd

# 5. Wait for rollout
kubectl rollout status deployment argocd-server -n argocd

# 6. Login as new user
argocd login cd.example.com --username ci-deployer

# 7. Generate token
TOKEN=$(argocd account generate-token --account ci-deployer --expires-in 365d --id github-actions)

echo "CI/CD Token: $TOKEN"
echo "Save this token securely!"

Configure RBAC for User

After creating a user, configure permissions in argocd-rbac-cm:

argocd-rbac-cm.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.csv: |
    # Grant ci-deployer sync permissions
    p, ci-deployer, applications, sync, */*, allow
    p, ci-deployer, applications, get, */*, allow
    
    # Grant alice admin permissions on specific project
    p, alice, applications, *, my-project/*, allow
    
    # Grant bob read-only access
    p, bob, applications, get, */*, allow
    p, bob, clusters, get, *, allow

Rotate CI/CD Token

# 1. List existing tokens
argocd account get ci-deployer

# 2. Generate new token
NEW_TOKEN=$(argocd account generate-token \
  --account ci-deployer \
  --expires-in 365d \
  --id github-actions-2024)

# 3. Update CI/CD system with new token
echo "New token: $NEW_TOKEN"

# 4. Delete old token after confirming new one works
argocd account delete-token --account ci-deployer <old-token-id>

Audit User Permissions

#!/bin/bash
# audit-permissions.sh

USERS=("admin" "alice" "bob" "ci-deployer")
ACTIONS=("get" "sync" "delete" "update" "create")
RESOURCES=("applications" "clusters" "repositories" "projects")

for user in "${USERS[@]}"; do
  echo "=== Permissions for $user ==="
  for resource in "${RESOURCES[@]}"; do
    echo "  $resource:"
    for action in "${ACTIONS[@]}"; do
      result=$(argocd account can-i $action $resource '*' 2>&1)
      if [[ $result == "yes" ]]; then
        echo "    ✓ $action"
      fi
    done
  done
  echo ""
done

Temporary Access Token

# Generate short-lived token for external contractor
TEMP_TOKEN=$(argocd account generate-token \
  --account contractor \
  --expires-in 7d \
  --id contractor-temp-access)

echo "Temporary token (expires in 7 days): $TEMP_TOKEN"

# Send token securely to contractor
# Token will automatically expire after 7 days

Security Best Practices

Strong Passwords: Use at least 12 characters with complexity
Token Expiration: Always set expiration for tokens (e.g., 90d)
Token IDs: Use descriptive IDs to track token usage
Regular Rotation: Rotate tokens every 90 days
Principle of Least Privilege: Grant minimum required permissions
Audit Logs: Monitor account usage via Argo CD audit logs
SSO Preferred: Use SSO instead of local users for human access
Service Accounts: Use dedicated accounts for automation
Remove Unused Accounts: Delete or disable accounts no longer needed
Secure Token Storage: Store tokens in secrets managers (Vault, etc.)

Troubleshooting

Password Issues

# Reset admin password (requires Kubernetes access)
kubectl delete secret argocd-initial-admin-secret -n argocd
kubectl rollout restart deployment argocd-server -n argocd

# Get new initial password
argocd admin initial-password

# Update to custom password
argocd account update-password

Token Not Working

# Verify token is valid
argocd account get-user-info --auth-token $TOKEN

# Check token permissions
argocd account can-i get applications '*' --auth-token $TOKEN

# Regenerate token if expired
NEW_TOKEN=$(argocd account generate-token --account ci-user)

Permission Denied

# Check current permissions
argocd account can-i sync applications '*'

# Verify RBAC configuration
kubectl get configmap argocd-rbac-cm -n argocd -o yaml

# Check if account exists
argocd account list

# Get user info
argocd account get-user-info

Account Not Found

# Verify account exists in ConfigMap
kubectl get configmap argocd-cm -n argocd -o yaml | grep accounts

# Restart server after adding account
kubectl rollout restart deployment argocd-server -n argocd

Environment Variables

ARGOCD_AUTH_TOKEN

string

Authentication token to use instead of login

ARGOCD_USERNAME

string

Default username for authentication

ARGOCD_PASSWORD

string

Default password for authentication (not recommended)

Next Steps

CLI Overview

Learn about authentication and configuration

Admin Commands

Administrative operations

Overview

Commands

​Quick Examples

​Subcommands

​list

​get

​get-user-info

​update-password

​generate-token

​Using Generated Tokens

​list-tokens

​delete-token

​can-i

​bcrypt

​Account Management

​Local Users vs SSO

​Managing Local Users

​Common Workflows

​First-Time Setup

​Create Service Account for CI/CD

​Configure RBAC for User

​Rotate CI/CD Token

​Audit User Permissions

​Temporary Access Token

​Security Best Practices

​Troubleshooting

​Password Issues

​Token Not Working

​Permission Denied

​Account Not Found

​Environment Variables

​Next Steps

CLI Overview

Admin Commands

Quick Examples

Subcommands

list

get

get-user-info

update-password

generate-token

Using Generated Tokens

list-tokens

delete-token

can-i

bcrypt

Account Management

Local Users vs SSO

Managing Local Users

Common Workflows

First-Time Setup

Create Service Account for CI/CD

Configure RBAC for User

Rotate CI/CD Token

Audit User Permissions

Temporary Access Token

Security Best Practices

Troubleshooting

Password Issues

Token Not Working

Permission Denied

Account Not Found

Environment Variables

Next Steps