Skip to content

Argo Server Auth Mode

You can configure how the Argo Server authenticates to Kubernetes:

  • server: In hosted mode, use the Server's Service Account. In local mode, use your local kube config.
  • client: Use the Kubernetes bearer token of clients. The Server validates the token with a SelfSubjectReview before serving a request, so this mode requires Kubernetes 1.28 or later. Successful reviews are cached for ARGO_SERVER_TOKEN_REVIEW_CACHE_TTL (default 1m) to limit API server load.
  • sso: Use single sign-on. This will use the same SA as server for RBAC, unless you have enabled SSO RBAC

For v3.0 and after, the default is client. Prior to v3.0, it was server.

To configure the Server's auth modes, use one or multiple --auth-mode flags. For example:

argo server --auth-mode=sso --auth-mode=client

Have a question?

Search on GitHub Discussions and Slack.