All 29 RBAC questions
More in RBAC
How do you prevent a team from deploying to namespaces they don't own? What permissions are needed to manage ApplicationSets? How do AppProjects and RBAC work together for multi-tenancy? How do you grant fine-grained permissions like sync but not delete? How do you troubleshoot 'permission denied' errors in ArgoCD? How does the scopes setting affect group mapping? How do project roles and tokens enable least-privilege automation? How do you audit and troubleshoot effective permissions for a user? How do you implement break-glass emergency access safely? How do you separate duties between who can create apps and who can sync them?
Advertisement
Back to results for “Applications”
ArgoCD › RBAC

How do you manage RBAC for API/automation accounts (project roles and tokens)?

Advanced

Answer

Beyond user SSO, ArgoCD supports local accounts and AppProject roles with scoped JWT tokens for automation. A project role defines allowed actions on that project's apps, and you issue a token bound to it for CI to sync apps—least privilege for pipelines without granting a human-level or admin account.
# AppProject role for CI
roles:
  - name: ci-deployer
    policies:
      - p, proj:team-a:ci-deployer, applications, sync, team-a/*, allow
Real-world example The CI pipeline uses a project-scoped token that can only sync team-a apps, never touching other projects.

Common follow-ups: What is an AppProject role? | Why use scoped tokens for CI?

Applications Multi-cluster RBAC
All 29 RBAC questions