ArgoCD authentication

[bauerjs1]

ArgoCD authentication

[morey-tech]

The way you reference is for generating a (short-lived) session token. It's probably preferred to create a dedicated local user in Argo CD and generate an API token for it (which will be long-lived) for uses in automation tool likes kubechecks.

For example:
Create a user named kubechecks in argocd-cm.

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
data:
  accounts.kubechecks: apiKey
  accounts.kubechecks.enabled: "true"

Then generate a token for it (log into the CLI with the admin user):

argocd account generate-token --account kubechecks

This may be a good example to include in the docs.

[bauerjs1]

Oh, so the point I was missing is that there exist session tokens and API tokens, each with their different purposes and lifetimes.

Thank you for the detailed explanation @morey-tech!

[bauerjs1]

I see! What is it that makes the difference? The dedicated user, or the token generation via CLI?

[morey-tech]

What is it that makes the difference? The dedicated user, or the token generation via CLI?

The API token instead of a session token is the main difference. Instead of creating a session token (using /api/v1/session) it creates a long-lived token (using /api/v1/account/{name}/token).

The use of a dedicated user is more of a best practice.