argo-workflows/access-token/

[giscus[bot]]

argo-workflows/access-token/

https://argoproj.github.io/argo-workflows/access-token/

[AvasDream]

If you are here and wondering why the token generation Command is not working anymore. Most likely you upgraded your K8s Cluster to version 1.24 and K8s won’t generate Secrets any longer automatically for ServiceAccounts. You now have to manually generate these secrets with kubectl create token argo -n argo.

References:

https://itnext.io/big-change-in-k8s-1-24-about-serviceaccounts-and-their-secrets-4b909a4af4e0
https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets

[joebowbeer]

This section was updated for k8s 1.24 on October 18, 2022.

Creating a Secret of type service-account-token will create a token that never expires.

[liuyix]

Section Token Creation is a little misleading. In previous section, you create a serviceaccount in argo namespace but in this section the demo is creating token in default namespace.
More accurate one is

kubectl -n argo apply -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: jenkins.service-account-token
  annotations:
    kubernetes.io/service-account.name: jenkins
type: kubernetes.io/service-account-token
EOF

[joebowbeer]

you create a serviceaccount in argo namespace

More accurately, the previous section referenced the argo:jenkins service account (argo namespace), but in an even earlier section the jenkins service account was created in the default namespace.

And then in the next section, the jenkins.service-account-token is fetched once again from the default namespace.

Later, the jenkins token is used to get workflows from the argo namespace, even though its role and rolebinding only grant access to workflows in the default namespace.

Later still, in the docker token usage instructions, a sandbox namespace is mentioned, but it's not clear how this relates to the jenkins example above it.

Later, in token revocation, a $SECRET is referenced but never defined, and no namespace is specific.

Followed by this statement:

A new one will be created.

More accurately: A new one can be created?

[joebowbeer]

#11852

[zensolution]

I am curious. Will the token expire after certain time?

[joebowbeer]

Tokens from manually created secrets do not expire.

https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#manual-secret-management-for-serviceaccounts

[joshlambino]

Hi i'm getting this error after creating token and using it to sign in with Argo Workflow server.
{"code":7,"message":"workflows.argoproj.io is forbidden: User "system:serviceaccount:default:xxxxxxxx" cannot list resource "workflows" in API group "argoproj.io" in the namespace "xxxxxxxx""}: workflows.argoproj.io is forbidden: User "system:serviceaccount:default:xxxxxxxx" cannot list resource "workflows" in API group "argoproj.io" in the namespace "xxxxxxxx"

[Fraer]

I followed all step but got the following:

{"code":16,"message":"token not valid for running mode"}

How should i specify the mode?

[Fraer]

Then added --auth-mode client in argo startup options, followed the instructions again and got same issue as @joshlambino.

[Fraer]

Ok found the issue, rolebinding was set in default namespace instead of the correct one.

[FosuLiang]

I meet the same problem. Could you describe your solution more specifically :).