Skip to main content


Support level: Community

What is ArgoCD

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.



The following placeholders will be used:

  • is the FQDN of the ArgoCD install.
  • is the FQDN of the authentik install.

Only settings that have been modified from default have been listed.

authentik Configuration

Step 1 - Provider creation

In authentik, create an OAuth2/OpenID Provider (under Applications/Providers) with these settings:

  • Name: ArgoCD
  • Client Type: Confidential
  • Signing Key: Select any available key
  • Redirect URIs:

After creating the provider, take note of the Client ID and Client Secret, you'll need to give them to ArgoCD in the ArgoCD Configuration field.

Step 2 - Application creation

Create a new Application (under Applications/Applications) with these settings:

Step 3 - ArgoCD Admin Group creation

Create a new Group (under Directory/Groups) that'll be used as the admin group for ArgoCD (if you already have an "admin" group, you can skip this part!)

  • Name: ArgoCD Admins
  • Members: Add your user and/or any user that should be an ArgoCD admin

ArgoCD Configuration


We're not going to use the oidc config, but instead the "dex", oidc doesn't allow ArgoCD CLI usage while DEX does.

Step 1 - Add the OIDC Secret to ArgoCD

In the argocd-secret Secret, add the following value to the data field:

dex.authentik.clientSecret: <base 64 encoded value of the Client Secret from the Provider above>

Step 2 - Configure ArgoCD to use authentik as OIDC backend

In the argocd-cm ConfigMap, add the following to the data field :

dex.config: |
- config:
issuer:<application slug defined in step 2>/
clientID: <client ID from the Provider above>
clientSecret: $dex.authentik.clientSecret
insecureEnableGroups: true
- openid
- profile
- email
name: authentik
type: oidc
id: authentik

Step 3 - Map the ArgoCD Admins group to ArgoCD's admin role

In the argocd-rbac-cm ConfigMap, add the following to the data field (or create it if it's not already there) :

policy.csv: |
g, ArgoCD Admins, role:admin

If you already had an "admin" group and thus didn't create the ArgoCD Admins one, just replace ArgoCD Admins with your existing group name.

Apply all the modified manifests, and you should be able to login to ArgoCD both through the UI and the CLI.