Skip to content

Argo CD integration

Connect DXDT to your Argo CD API server for read-only GitOps visibility: application sync status (Synced/OutOfSync), health (Healthy/Degraded), target revisions, projects, and registered clusters. This pairs with the Kubernetes plugin to show what was deployed via GitOps and whether it converged. DXDT never syncs, refreshes, or deletes.
Setup time ~8 minutes
Difficulty Moderate

Access required: The Argo CD API/server URL and a read-only Argo CD API token, generated for a local account or project with view-only RBAC.

Prerequisites

  • Access to the Argo CD argocd CLI (logged in) or admin UI to create an account and generate a token.
  • The Argo CD server URL, e.g. https://argocd.acme.com.
  • Ability to edit the argocd-cm / argocd-rbac-cm ConfigMaps if you are creating a dedicated read-only local account.

Setup

Add a dedicated local account for DXDT with an API-token capability, and grant it read-only RBAC. In argocd-cm add accounts.dxdt-readonly: apiKey, then in argocd-rbac-cm bind that account to a policy that only allows get on applications/projects/clusters (e.g. p, role:dxdt-readonly, applications, get, */*, allow).

Note

Alternatively, generate a Project token scoped to a single project if you only need visibility into one project's apps.

2. Generate the API token

Run argocd account generate-token --account dxdt-readonly. Copy the printed token — it is shown only once. This becomes the auth_token value.

  • For a project-scoped token instead: argocd proj role create-token <project> <role>.
  • Store the token in a secret manager; treat it like a password.

3. Identify the server URL and TLS mode

Use the Argo CD API/server URL as server_url (e.g. https://argocd.acme.com). If your Argo CD serves a self-signed certificate, set insecure to true to skip TLS verification; otherwise leave it blank so certificates are validated.

4. Enter the configuration in DXDT

In the DXDT marketplace, open the Argo CD plugin. Enter server_url, paste the auth_token, and set insecure only if required by a self-signed cert. Save to install.

Configuration fields

Field Where to find it
Server URL (server_url) Argo CD API/server URL, e.g. https://argocd.acme.com. Required.
API Token (auth_token) Read-only Argo CD account or project token from argocd account generate-token. Required.
Skip TLS verify (optional) (insecure) Optional — set to true only for self-signed Argo CD installs to skip TLS verification. Leave blank (defaults to verifying certificates) otherwise.

Verify the connection

On save, DXDT calls ping, which validates the token and returns the logged-in account. Success means the token and URL are correct; you can then ask DXDT to list apps to confirm read visibility.

Security

DXDT performs only read operations against Argo CD (no sync, refresh, or delete). Always use a dedicated account or project token bound to a view-only RBAC policy granting get and never sync/override/delete. Use insecure=true only for genuinely self-signed internal installs.

Troubleshooting

401 Unauthorized on ping

The auth_token is invalid, expired, or was generated for an account without apiKey capability. Confirm the account has apiKey in argocd-cm, regenerate with argocd account generate-token, and paste the fresh token.

TLS certificate verification failed

Argo CD presents a self-signed or private-CA certificate. Set insecure to true for self-signed installs, or ensure the endpoint serves a publicly trusted certificate.

Ping works but apps list is empty

The account's RBAC policy does not grant get on applications, or the project token is scoped too narrowly. Broaden the read-only policy in argocd-rbac-cm to allow get on applications, */* (still read-only).

Vendor documentation: https://argo-cd.readthedocs.io/en/stable/user-guide/commands/argocd_account_generate-token/