ArgoCD CLI login with apikey/token?

[lolhax1337]

Hi!

Is it possible to login to argo cli using apikey/token? Docs are unclear for me :(

What I want is login to cli like:
argocd login <server_name> --username <user> --password <password>

but using apikey/token. I can generate token for my user, but I don't know how to login using it

[crenshaw-dev]

I'm not certain that you can log in using the token. But I believe you can use the token with the argocd CLI by setting ARGOCD_AUTH_TOKEN.

[vorandrew]

Why when I'm setting --auth-token it still asks me for user/password?

argocd login xxxxx --grpc-web --insecure --username cibot --auth-token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJhcmdvY2QiLCJzdWIiOiJjaWJvdDphcGlLZXkiLCJuYmYiOjE2ODEwNzA2MTgsImlhdCI6MTY4MTA3MDYxOCwianRpIjoiN2FmYjg4NWMtNzQxMy00ZmU4LTg4MDEtNjhjNDFlMmM0MzQ0In0.2jWeUG5w3Y2HdqWPnBiispZH2OwzaAmFMZC2b7KGESs

[tchellomello]

Creating the config ~/.config/argocd/config manually works as well.

contexts:
- name: argocd
  server: argocd.example.com
  user: metrics
current-context: argocd
servers:
- grpc-web-root-path: ""
  insecure: true
  server: argocd.example.com
users:
- auth-token: eyJhxxxxxxx
  name: metrics

Or via curl https://$ARGOCD_SERVER/api/v1/applications -H "Authorization: Bearer $ARGOCD_AUTH_TOKEN" -L -k | jq | less

[ira-gordin-sap]

hi @vorandrew did you succeeded then? how?

[dimisjim]

curl shown above is a good way to see whether the token works or not, but I also didn't manage to use it to login via argocd cli per se

[evilensky]

curl shown above is a good way to see whether the token works or not, but I also didn't manage to use it to login via argocd cli per se

I'm running into this exact issue :(

[lmcdasm]

Hello>

Using the CURL fails, since you get "no session information" returned with the example from @tchellomello

[michal-rybinski]

One does not simply login with a token.... one simply uses it, like so:
argocd app list --server argocd.blabla.com --insecure --auth-token {AUTH_TOKEN}

[lmcdasm]

This doesnt work, since you get a error retrieving configMap

[michal-rybinski]

If it wasn't working, I would not have posted it. The fact that it does not work for you, does not mean it did not for me.
upgrade your curl to > 1.3

[lmcdasm]

@michal-rybinski - I think in the end, that your solution doesnt provide the whole answer, since you havent set a context as is required, and you are assuming things in your environment.

The question is pretty clear about the "need" - which includes referencing the existing OC context, the need to have /.config/argocd/config in place, so again - your solution, by itself in relation to the OP doesnt provide a full answer.. hence "doesnt work"

thank for sharing.. and "CURL" has nothing to do with it, as the invalid token segment is hiding the fact that argocd cant write to /.config/argocd/config (once that was fixed then curl worked fine).

thanks for helping though!

[michal-rybinski]

While I agree that maybe i could have written my comments in a more approachable manner, I'd like to point out that when a person is asking a question about argocd cli tool not working with tokens, one must make an assumptions that:

1. argocd works within K8s cluster so the person asking has access to it and has it configured correctly - otherwise not only login with token but also one with username would not work, and it does not matter what way the auth/authz is provided, it is not the subject of the question
2. the person asking the question has at least basic knowledge around argocd and kuberenets so let's not assume they are idiots and try to explain to them how to switch/set up Kubernetes contexts as the question it about completely different thing

The literal question I answered was

"Is it possible to login to argo cli using apikey/token?
What I want is login to cli like:
argocd login <server_name> --username --password
but using apikey/token. I can generate token for my user, but I don't know how to login using it"

To which I said that this is not the correct way to use tokens and gave an example command of how they should be used.

The fact that you have a different set-up on your end does not invalidate my answer.
Looks like you took it personally and decided that if it does not work for you, it cannot work for someone else, and following that you gave a long and complicated answer with lots of details around your environment and specific way you set it up to prove your point that you were right, where in fact your answer had nothing to do with the original question and just muddied the waters for anyone reading this thread and looking for answer to exactly same problem.

My goal was not to provide an encompassing solution for everyone and every set-up possible, but to specifically point out that the OP does not use the token as intended, and that's why it does not work for them.

p.s.
my answer about curl version was a result of 1 minute of googling - https://stackoverflow.com/questions/70750042/getting-no-session-information-while-deleting-app-from-argocd-using-api

[eldinphp]

One does not simply login with a token.... one simply uses it, like so: argocd app list --server argocd.blabla.com --insecure --auth-token {AUTH_TOKEN}

This helped me, thanks

other command I have used, that might come in handy:

argocd account get-user-info --server <server> --insecure --grpc-web --auth-token <token>

[lmcdasm]

Hello All.

i had a similar issue, and i found that while there are "pieces" of the answer, it was not a full one.

PROBLEM STATEMENT: I am trying to login to ARGOCD using the argocd cli tool, however the ARGOCD is only setup to use authentication via OCP (no IDP setup). I would like to be able to use the KUBECONFIG that i have (oc login) and execute the argocd commands. For colour, im running this from within a OCI container that has both argocd and oc installed. I have kubeconfig for the kube:admin Service account but there is no user or role defined within ARGOCD>

MY FIX:

• first, make sure that path to /.config/argocd is writable (otherwise you will get a couple errors, most notably, you get a "Token has invalid segments" - which doesnt make much sense, but this is what happened to me.
• second, make sure that KUBECONFIG ENV VAR is set appropriately (export KUBECONFIG=
• third - you can (A) use the command "./argocd login ARGOCD_FQDN --core" (this will create /.config/argocd/config) or you can copy it into your directory yourself.
• fourth - make sure (if you havent already) set the oc (or kubectl) context to the target namespace for your gitops (argo) deployment (kubectl config set-context --current --namespace=openshift-gitops )
• fifth - get a token with "oc whoami -t"
• sixth - now you have all the pieces you can run the argo command. in my case, i was using insecure, auth-token and you have to provide the --server and --repo-server names.

My command looks like this then:

./argocd app list --server openshift-gitops-server-openshift-gitops.apps.MY_FQDN --insecure --auth_token TOKEN_FROM_ABOVE --repo-server-name openshift-gitops-repo-server

(you can do sync or whatever other command you want)

Here is an example of the /.config/argocd/config file so you can see what you need behind this to work (and you can skip the argocd login step)

I sure hope that helps people from an end 2 end point of view.

[zzacha]

I just bumped into this as well and as it turns out the simplest approach in my case ( openshift with oauth proxy) would be to pass --sso option.
argocd login openshift-gitops-server-openshift-gitops.apps.<FQDN> --sso --grpc-web --insecure
This will open up a browser and run the authorization_code flow login. happy days