ArgoCD User Management¶

ArgoCD uses local accounts in this air-gap env (no SSO/OIDC). Users are declared in the Helm values file; passwords are set via CLI after deploy — never stored in Git.

Architecture¶

configs.cm        → declares accounts (argocd-cm ConfigMap)
configs.rbac      → assigns groups + permissions (argocd-rbac-cm ConfigMap)
argocd-secret     → stores bcrypt-hashed passwords (set via CLI, never in Git)

Groups are defined in policy.csv. Users are assigned to groups with g, lines.

Current users and groups¶

Username	Email	Group	Role
`rodolf`	rodolf.sabalburo@ai71.ai	`argocd-admins`	Full admin
`tarun`	tarun.mittal@ai71.ai	`argocd-admins`	Full admin
`adrianna`	adrianna.wojtunik@ai71.ai	`argocd-admins`	Full admin

Group	Permissions
`argocd-admins`	`role:admin` — full access to all apps, repos, clusters
`argocd-readonly`	`role:readonly` — view only

How to add a new user¶

Step 1 — Declare the account in Git¶

Edit mod-ask-devops/applications/cluster-addons/argocd/values-mod-auh1-dev-ask.yaml:

configs:
  cm:
    accounts.<username>: login
    accounts.<username>.enabled: "true"

  rbac:
    policy.csv: |
      # add a group binding for the new user
      g, <username>, argocd-admins     # or argocd-readonly

Commit and push → ArgoCD syncs the argocd app → account is created.

Step 2 — Set the password via CLI¶

Passwords are never in Git

Passwords are stored as bcrypt hashes in argocd-secret (a Kubernetes Secret). They are set via the ArgoCD CLI and survive Helm upgrades.

# Port-forward if not on the cluster network
# kubectl port-forward svc/argocd-server -n argocd 8080:443

# Login as admin first
argocd login argocd.cl1.sq4.aegis.internal \
  --username admin \
  --password <admin-password> \
  --insecure

# Set the new user's password
argocd account update-password \
  --account <username> \
  --new-password '<password>' \
  --current-password <admin-password> \
  --insecure

Step 3 — Verify¶

argocd account list --insecure

Expected output includes the new user with Enabled: true.

Initial password setup (first time — all 3 admin users)¶

Run from bastion after ArgoCD syncs the new values:

ARGOCD_SERVER=argocd.cl1.sq4.aegis.internal
ADMIN_PASS=<current-admin-password>

argocd login $ARGOCD_SERVER --username admin --password $ADMIN_PASS --insecure

for user in rodolf tarun adrianna; do
  argocd account update-password \
    --account $user \
    --new-password 'ModGPT@2026!' \
    --current-password $ADMIN_PASS \
    --insecure
  echo "✓ $user password set"
done

Verify all accounts are active:

argocd account list --insecure

Expected:

NAME      ENABLED  CAPABILITIES
admin     true     login
adrianna  true     login
rodolf    true     login
tarun     true     login

How to change a user's group¶

Edit policy.csv in the values file — change the g, binding line:

# Move tarun from admins to readonly
g, tarun, argocd-readonly   # was: g, tarun, argocd-admins

Commit + push → ArgoCD syncs → permission takes effect immediately (no pod restart needed).

How to disable a user¶

Set enabled: "false" in the values file:

configs:
  cm:
    accounts.tarun.enabled: "false"

This blocks login immediately after sync without deleting the account.

Troubleshooting¶

Symptom	Cause	Fix
`Invalid username or password` after password set	Wrong admin password used in `--current-password`	Use `kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' \\| base64 -d`
Account not in `argocd account list`	Values not synced yet	`argocd app sync argocd --grpc-web`
Permission denied after login	User not assigned to a group	Check `policy.csv` for `g, <username>, <group>` line
Password change fails: `account not found`	Account not declared in `configs.cm`	Add `accounts.<username>: login` to values + sync