Skip to main content
Connect Argo CD to let CloudThinker agents list your applications, explain why one is out of sync or degraded, read its Kubernetes events and pod logs, and sync it through your approvals. The connection signs in with one Argo CD API token and works with self-hosted Argo CD and the Akuity Platform.

​
Prerequisites

  • An Argo CD server reachable from CloudThinker over HTTPS. A localhost or cluster-internal address won’t work.
  • Admin access to Argo CD, so you can create a local account and generate a token for it.
  • The Argo CD CLI on your machine to generate the token.
  • Self-hosted only: kubectl access to the argocd namespace, to edit the argocd-cm and argocd-rbac-cm ConfigMaps.
If your server is on a private network, see Reaching private services.

​
Setup

Create a dedicated cloudthinker account instead of using admin. Its token then carries only the RBAC permissions you grant it, and you can revoke it without touching anyone else.
1

Create a local account with API key access

Add a cloudthinker account that can only use API keys, not the web login:
2

Generate a token

Sign in as an admin, then generate a token for the new account:
Copy the token. Add --insecure to both commands only if the server uses a self-signed certificate. Without --expires-in, the token never expires, so set a lifetime and generate a new one before it lapses.Success state: the second command prints a long token string.
3

Grant the account read access

Run kubectl -n argocd edit configmap argocd-rbac-cm and add these lines to the existing policy.csv:
Edit the ConfigMap rather than applying a new one. kubectl apply with a fresh argocd-rbac-cm replaces your whole policy and can lock other users out. To let agents change things, add the lines in Required permissions.
4

Add the connection in CloudThinker

Open More → Workspace settings → Connections, stay on the Builtin Connections tab, and select ArgoCD. Fill in:
  • ARGOCD_BASE_URL: your server address, such as https://argocd.example.com
  • ARGOCD_API_TOKEN: the token you copied
  • NODE_TLS_REJECT_UNAUTHORIZED (TLS verification): Verify TLS (default), or Skip TLS verification for a self-signed certificate
  • READ_ONLY: change it to Read-only. The form defaults to Full access.
Click Connect.Success state: the dialog closes and the connection shows Connected. That status doesn’t prove the token or RBAC works, so run the verify prompt below.

​
Connection details

READ_ONLY defaults to Full access. Switch it to Read-only unless you want agents to propose syncs and changes. RBAC still blocks anything the account isn’t granted.

​
Required permissions

The read lines from setup cover every read: applications, get covers application status, resource trees, managed resources, and events, and logs, get lets agents read pod logs. Add a line for each change you want agents to propose:

​
Agent capabilities

Every change goes through Approvals, and a rejected request isn’t retried. To let agents sync, set READ_ONLY to Full access and add the applications, sync permission. Leave either one out and agents can only read.

​
Verify the connection

Expect a table of application names with a sync status such as Synced or OutOfSync and a health status such as Healthy or Degraded, plus counts at the end.

​
Example prompts

Name the application. Agents use real names from the application list and won’t guess one. The sync prompt needs Full access and the applications, sync permission.

​
Troubleshooting

CloudThinker can’t reach ARGOCD_BASE_URL, or the server’s certificate was rejected. Check that the address is public HTTPS, not localhost or a cluster-internal name. For a self-signed certificate, set NODE_TLS_REJECT_UNAUTHORIZED to Skip TLS verification.
The token is missing, expired, or was generated for a different account. Run argocd account generate-token --account cloudthinker --expires-in 90d again, edit the connection, and paste the new token.
The account’s RBAC role doesn’t allow that action. Check the policy.csv lines in Required permissions: logs need logs, get and syncs need applications, sync.
The role grants no access to those projects. The */* pattern in the policy covers every project; if you narrowed it, add the projects agents should see.
READ_ONLY is set to Read-only. Edit the connection and switch to Full access if you want agents to propose those changes.
The account doesn’t have the apiKey capability. Run argocd account get --account cloudthinker to check, then repeat the first setup step.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Dedicated account: give CloudThinker its own cloudthinker account with API key access only, never the admin token.
  • Keep TLS verification on in production: skip it only for a local or dev server with a self-signed certificate.

Kubernetes connection

Let agents read the clusters Argo CD deploys to.

Approvals

Control which syncs and changes wait for a person.