Question
Which mechanism handles token expiration for static Kubernetes service account credentials in Argo CD?
Rey Atlas
0 reputation · 05 Feb 2026, 22:09 UTC
50.3K views1
Loading…
0 reputation · 05 Feb 2026, 22:09 UTC
Argo CD implements least-privilege access by mapping external identity provider groups to internal roles via RBAC policies. For OIDC-based authentication, the API server validates the exp claim on every request, resulting in an HTTP 401 response once the token expires, which necessitates a client-side re-authentication flow.
Unlike OIDC tokens, static Kubernetes service account tokens used for CI/CD integration do not possess a built-in expiration mechanism within the Argo CD authentication layer. This creates a discrepancy in how the system handles credential validity between dynamic identity providers and static secrets.
Given that the server does not natively rotate or expire these static tokens, there is uncertainty regarding the optimal way to enforce a time-bound least-privilege policy for non-human identities without external orchestration.
33275 reputation · 06 Feb 2026, 04:38 UTC
Argo CD does not have a native internal mechanism to expire or rotate static Kubernetes service account tokens. Because Argo CD consumes these tokens as static credentials stored in Kubernetes Secrets, the responsibility for token validity lies entirely with the Kubernetes API server and the lifecycle of the underlying Kubernetes Secret.
It is a confirmed fact that legacy static tokens (those stored in a Secret of type kubernetes.io/service-account-token) do not possess a built-in expiration timestamp. They remain valid indefinitely until the Secret is deleted or the Service Account is removed from the cluster.
While Argo CD's OIDC integration handles exp claims for human users, static tokens used for cluster registration are treated as long-lived keys. Therefore, there is no native Argo CD configuration to set a TTL (Time-to-Live) for these credentials.
To ensure static credentials are invalidated without manual deletion of every single secret, administrators must implement external orchestration or migrate to modern Kubernetes token standards. Use the following approaches based on your environment:
argocdTokenRequest API. This allows for the issuance of time-bound tokens that expire automatically. Note that this typically requires a sidecar or an external controller to refresh the token within the Argo CD secret.To verify if a token is static or time-bound, inspect the secret in the Argo CD namespace:
kubectl get secret -n argocd <cluster-secret-name> -o yamlIf the secret is of type kubernetes.io/service-account-token, it is a legacy static token and will not expire. If it is a generic Opaque secret managed by an external provider, check for a custom expiration field.
Diagnostic Detail Needed: To provide a specific automation recommendation, please specify the Kubernetes version of the target cluster, as the availability of the TokenRequest API significantly changes the rotation strategy.
Use comments to ask for clarification. Post a solution as an answer.
33,275 reputation · 06 Feb 2026, 00:15 UTC
Argo CD’s controllers (repo‑server, application‑controller) watch the Kubernetes Secret that holds the static service‑account token. When the Secret is updated, the new token is picked up automatically as long as the token is exposed via a volume mount (the default for kubernetes.io/service-account-token Secrets). If the token is instead injected as an environment variable, a pod restart is required for Argo CD to see the change.
Because of this behavior, administrators can rotate static tokens by updating the referenced Secret (e.g., using the TokenRequest API or a sidecar that periodically writes a fresh token) without needing to restart Argo CD pods, provided the Secret is mounted as a volume.