Skip to content

Integrating SailPoint with Argo CD

The SailPoint Argo CD connector is a read-only connector. Its purpose is to discover all machine credentials within Argo CD, such as local user accounts and project tokens, and pull them into SailPoint so they become visible to your security and governance teams. Once these machine identities are aggregated into SailPoint, you can assign ownership, conduct access reviews, run certification campaigns, and apply lifecycle management policies bringing the same level of governance to your CI/CD machine credentials that you already have for human identities. For more information, refer to Supported Features.

This guide describes how to connect SailPoint to Argo CD Cloud or another Argo CD deployment that exposes the standard Argo CD REST APIs.

If you have Argo CD machine identities that you want to bring into SailPoint, start by creating a direct connect source using either Express Setup or Standard Setup. Once the source is configured, use Dataset Management to configure owner correlation and dataset aggregation, discover machine identity resources such as local users and project tokens, and govern them in SailPoint.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The SailPoint Argo CD connector is a read-only connector. It supports the following features:

Feature Description
Test Connection Validates the Argo CD API endpoint and bearer token.
Dataset Aggregation Aggregates machine identities (local users and project tokens) from Argo CD.

Non-Human Identity Discovery

  • Aggregate Argo CD local users
  • Aggregate Argo CD project tokens

Refer to Dataset Management for more information.

Refer to Discovering Potential Non-Human Accounts for more information.

Supported Managed Systems

The SailPoint Argo CD connector supports the following managed system:

  • Argo CD version 3.3.3

Important

Verify compatibility of Argo CD with your environment. Your Argo CD build must expose the REST endpoints this connector uses.

Prerequisites

  • A running Argo CD deployment with HTTPS access to the Argo CD API endpoint.
  • An API token for an Argo CD account that can read the objects required for connectivity and aggregation.
  • Required permissions your organization requires for read-oriented discovery. For more information, refer to Required Permissions.

Creating an API Token in Argo CD

SailPoint authenticates to Argo CD using an API token (bearer token) associated with an Argo CD account that can call the APIs required for connectivity and aggregation.

  1. Sign in to your Argo CD user interface, or use your organization's approved token-issuance process.

  2. Select your user account or profile.

    Note

    UI labels vary by version. To find user account, search for account settings or personal tokens within your Argo CD user interface.

  3. Create a new API token. Choose an expiration consistent with your security policy.

  4. Copy the token immediately and store it in your approved secrets tool. You will need to paste it into the SailPoint source as Argo CD API Token.

Note

UI labels and token generation flow can vary by Argo CD version and deployment. For UI-specific steps and screenshots, refer to your Argo CD vendor documentation or internal runbooks.

Required Permissions

The Argo CD account associated with your API token must be able to call the Argo CD REST APIs required for test connection and machine identity aggregation.

Grant only the permissions your organization needed for read-oriented discovery. Exact RBAC settings are defined in your Argo CD policy configuration file (policy.csv) and role bindings.

Note

Regenerate and update the Argo CD API Token in SailPoint after you change permissions or token expiration policy in Argo CD.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.