Fixing Argo CD Admin Password Bug: A Step-by-Step Guide

Dec 4, 2025 by Alex Johnson 56 views

Introduction

In this article, we'll address a critical bug concerning the admin password for Argo CD. The initially generated password, stored in the infrastructure Vault under the argocdServerAdmin key within the argocd application, is currently non-functional. While login via Keycloak remains operational, rectifying this issue is crucial for maintaining a secure and fully functional system. This comprehensive guide will walk you through the problem, the steps to reproduce it, and the solution to ensure your Argo CD admin password functions correctly. Understanding the root cause and implementing the fix will enhance the overall security and usability of your Argo CD deployment.

Understanding the Argo CD Password Issue

The core of the problem lies in how the password is generated and handled. Currently, a plaintext password is created and supplied to the Argo CD Helm chart via the configs.secret.argocdServerAdminPassword key. However, Argo CD expects this password to be encrypted using bcrypt, as explicitly stated in the chart's values and the official Argo CD documentation. This discrepancy between the expected encrypted format and the actual plaintext format leads to authentication failures.

To resolve this, we need to generate a password, encrypt it using the htpasswd command as recommended by Argo CD, and then store both the encrypted and plaintext versions in the infrastructure Vault. The encrypted version will be used by the Helm chart, while the plaintext version can be kept for recovery or other administrative purposes. This dual storage ensures both the security and accessibility of the admin password.

Diagnosing the Problem: Steps to Reproduce

To verify the issue, follow these steps:

Access the Argo CD page in your web browser.
Attempt to log in as admin using the password stored in the infrastructure Vault.
Observe the login failure, which will display the error message "Invalid username or password."

This simple procedure confirms the existence of the bug and highlights the immediate need for a solution. By replicating these steps, you can ensure that the fix is effective and that the admin password functions as expected.

The Solution: Generating and Storing the Encrypted Password

The solution involves generating a secure password, encrypting it using bcrypt, and storing both the encrypted and plaintext versions in the Vault. Here’s a detailed breakdown of the process:

Password Generation: Use a strong password generation tool or method to create a secure password. A strong password should be a minimum of 12 characters and include a mix of uppercase and lowercase letters, numbers, and symbols.
Bcrypt Encryption: Employ the htpasswd command-line tool to encrypt the password using bcrypt. This tool is specifically recommended by Argo CD for password encryption. The command structure is as follows:
```
htpasswd -n -B admin | cut -d ":" -f 2
```
This command will output the bcrypt-hashed password, which is the format Argo CD expects.
Vault Storage: Store both the plaintext password and the bcrypt-hashed password in the infrastructure Vault. The plaintext version should be stored securely and used only when necessary. The bcrypt-hashed password will be used in the Argo CD Helm chart configuration.
Helm Chart Configuration: Update the Argo CD Helm chart configuration to use the bcrypt-hashed password. This involves modifying the configs.secret.argocdServerAdminPassword key in the values.yaml file to reflect the encrypted password.

By following these steps, you ensure that Argo CD receives the password in the expected format, resolving the authentication issue and enabling admin login.

Implementing the Fix: A Detailed Guide

To implement the fix effectively, follow these detailed steps. This process ensures that the password is correctly generated, encrypted, and stored, and that the Argo CD configuration is updated accordingly.

Step 1: Generate a Strong Password

Start by generating a strong, random password. You can use a password manager, a command-line tool, or any method you prefer, but ensure the password meets the following criteria:

At least 12 characters long
Includes a mix of uppercase and lowercase letters
Contains numbers and symbols

Here’s an example using openssl to generate a random password:

openssl rand -base64 16

This command generates a 16-byte random string encoded in base64, providing a strong foundation for your password.

Step 2: Encrypt the Password Using `htpasswd`

Next, encrypt the generated password using the htpasswd command-line tool with the bcrypt algorithm. This ensures that the password is in the format Argo CD expects.

Run the following command, replacing YOUR_PASSWORD with the actual password you generated:

echo -n "YOUR_PASSWORD" | htpasswd -n -B admin | cut -d ":" -f 2

This command does the following:

echo -n "YOUR_PASSWORD": Prints the password without a newline.
htpasswd -n -B admin: Generates the bcrypt hash for the admin user.
cut -d ":" -f 2: Extracts the hashed password from the output.

The output of this command is the bcrypt-hashed password, which you will need in the next steps.

Step 3: Store the Passwords Securely in Vault

Now, store both the plaintext password and the bcrypt-hashed password in the infrastructure Vault. This ensures the passwords are kept securely and can be accessed when needed.

Use the Vault CLI or API to store the passwords. For example, if you have a Vault path like secret/argocd, you can store the passwords as follows:

vault kv put secret/argocd argocdAdminPassword="YOUR_PLAINTEXT_PASSWORD" argocdBcryptPassword="YOUR_BCRYPT_HASHED_PASSWORD"

Replace YOUR_PLAINTEXT_PASSWORD with the actual plaintext password and YOUR_BCRYPT_HASHED_PASSWORD with the output from the htpasswd command.

Storing both passwords allows you to update Argo CD with the hashed password while retaining the plaintext version for recovery or other administrative purposes.

Step 4: Update the Argo CD Helm Chart

The final step is to update the Argo CD Helm chart to use the bcrypt-hashed password. This involves modifying the values.yaml file used to deploy Argo CD.

Locate the values.yaml file for your Argo CD deployment. This file typically resides in your infrastructure-as-code repository or Helm chart directory.
Open the values.yaml file in a text editor.
Find the configs.secret.argocdServerAdminPassword key. This key is where the admin password is configured.
Replace the existing value with the bcrypt-hashed password you stored in Vault.

The relevant section of your values.yaml file should look similar to this:
```
configs:
  secret:
    argocdServerAdminPassword: "$2b$10aBCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
```
Replace the example hash with your actual bcrypt-hashed password.
Apply the changes by upgrading your Argo CD Helm release. Use the helm upgrade command, ensuring you point to the updated values.yaml file:
```
helm upgrade argocd argoproj/argo-cd -n argocd -f values.yaml
```
Replace argocd with your release name and argocd with the namespace where Argo CD is deployed.

Step 5: Verify the Fix

After applying the changes, verify that the fix is working by attempting to log in to Argo CD as the admin user with the plaintext password.

Access the Argo CD UI in your web browser.
Enter admin as the username.
Enter the plaintext password you stored in Vault as the password.
Click the login button.

If the login is successful, the fix has been implemented correctly. You should now be able to access the Argo CD admin interface.

Conclusion

By following these steps, you can effectively resolve the Argo CD admin password bug, ensuring that your Argo CD deployment is secure and fully functional. This process involves generating a strong password, encrypting it using bcrypt, securely storing both the plaintext and encrypted versions in Vault, and updating the Argo CD Helm chart configuration. Regular maintenance and adherence to best practices like these are crucial for maintaining a robust and secure infrastructure.

For further information on Argo CD security and best practices, refer to the official Argo CD documentation.

Definition of Done

[x] The fix is completed
[x] Tests related to this fix have been added
[x] Communication with other teams involved in this fix has been done