Skip to content

Argo Server Auth Mode

You can configure how the Argo Server authenticates to Kubernetes:

  • server: In hosted mode, use the Server's Service Account. In local mode, use your local kube config.
  • client: Use the Kubernetes bearer token of clients. The Server validates the token with a SelfSubjectReview before serving a request, so this mode requires Kubernetes 1.28 or later. Successful reviews are cached for ARGO_SERVER_TOKEN_REVIEW_CACHE_TTL (default 1m) to limit API server load.
  • sso: Use single sign-on. This will use the same SA as server for RBAC, unless you have enabled SSO RBAC

The default is client.

To configure the Server's auth modes, use one or multiple --auth-mode flags. For example:

argo server --auth-mode=sso --auth-mode=client

Have a question?

Search on GitHub Discussions and Slack.