Argo CD capability

Optional. Skip if you already use the EKS Capability for Argo CD on this cluster.

Overview

Managed Argo CD runs in the AWS control plane. You still sync Applications to the cluster the same way as self-hosted Argo CD.

Requires:

eksctl 0.230.0+
IAM role trusted by capabilities.eks.amazonaws.com
An instance (SSO) with at least one user

See Create an Argo CD capability using eksctl.

Identity Center (IDC) = SSO

means IAM Identity Center — the same workforce SSO directory behind aws sso login and the AWS access portal.

For the EKS Capability for Argo CD, Identity Center is the only supported sign-in method. Local Argo CD users (admin / password in the Argo CD UI) are not supported.

What	How Identity Center is used
AWS CLI / console (`AWS_PROFILE=sandbox`)	`aws sso login` — browser SSO into an IAM role
Managed Argo CD UI	Same Identity Center users/groups — SSO only

This page resolves your Identity Center instance ARN, region, and user ID, then maps that user to Argo CD role ADMIN. Without that mapping you cannot open the Argo CD UI after the capability is active.

IDC_* variables below are only for that SSO wiring — they are not a second identity system.

Set variables

Reuse the exports from Prerequisites. Stay in demo/, then resolve account and Identity Center values:

cd "$LAB_DIR"

export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
export ARGOCD_CAPABILITY_NAME=lab-argocd
export ARGOCD_ROLE_NAME=ArgoCDCapabilityRole
export ARGOCD_ROLE_ARN="arn:aws:iam::${ACCOUNT_ID}:role/${ARGOCD_ROLE_NAME}"

# Same Region as the cluster for this lab
export IDC_REGION="$AWS_REGION"
export IDC_INSTANCE_ARN=$(aws sso-admin list-instances --region "$IDC_REGION" \
  --query 'Instances[0].InstanceArn' --output text)
export IDC_STORE_ID=$(aws sso-admin list-instances --region "$IDC_REGION" \
  --query 'Instances[0].IdentityStoreId' --output text)

# Replace with your Identity Center username (same identity you use for aws sso login)
export IDC_USERNAME=your-username
export IDC_USER_ID=$(aws identitystore list-users \
  --identity-store-id "$IDC_STORE_ID" \
  --region "$IDC_REGION" \
  --query "Users[?UserName==\`${IDC_USERNAME}\`].UserId" \
  --output text)

echo "ACCOUNT_ID=$ACCOUNT_ID"
echo "IDC_INSTANCE_ARN=$IDC_INSTANCE_ARN"
echo "IDC_USER_ID=$IDC_USER_ID"

Confirm IDC_INSTANCE_ARN and IDC_USER_ID are real values (not None / empty) before continuing.

Step 1 — Create the IAM trust policy and role

mkdir -p config/iam

cat > config/iam/argocd-trust-policy.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "capabilities.eks.amazonaws.com"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession"
      ]
    }
  ]
}
EOF

aws iam create-role \
  --role-name "$ARGOCD_ROLE_NAME" \
  --assume-role-policy-document file://config/iam/argocd-trust-policy.json

For this lab, no additional IAM policies are attached. EKS creates cluster access entries for the role when the capability is created. Add Secrets Manager / CodeConnections permissions later only if you store private repo credentials that way.

Step 2 — Create the capability config

cat > config/argocd-capability.yaml <<EOF
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: ${CLUSTER_NAME}
  region: ${AWS_REGION}

capabilities:
  - name: ${ARGOCD_CAPABILITY_NAME}
    type: ARGOCD
    roleArn: ${ARGOCD_ROLE_ARN}
    deletePropagationPolicy: RETAIN
    configuration:
      argocd:
        awsIdc:
          idcInstanceArn: ${IDC_INSTANCE_ARN}
          idcRegion: ${IDC_REGION}
        rbacRoleMappings:
          - role: ADMIN
            identities:
              - id: ${IDC_USER_ID}
                type: SSO_USER
EOF

cat config/argocd-capability.yaml

Step 3 — Create the capability

eksctl create capability -f config/argocd-capability.yaml
eksctl get capability \
  --cluster "$CLUSTER_NAME" \
  --name "$ARGOCD_CAPABILITY_NAME" \
  --region "$AWS_REGION"

Expect several minutes while CloudFormation finishes. Wait until status is ACTIVE, then confirm Argo CD CRDs:

kubectl api-resources | grep argoproj.io

You should see Application and ApplicationSet.

Open the managed Argo CD UI from the EKS console: cluster kueue-lab → Capabilities → lab-argocd → open the Argo CD endpoint.

You should see SSO as the only sign-in option (no local username/password):

Choose LOG IN VIA SSO.
Complete Identity Center / AWS access portal sign-in for the user you mapped (IDC_USERNAME → ADMIN).
Confirm you land in the Argo CD UI. An empty Applications page is success (nothing synced yet):

Managed Argo CD Applications empty state after SSO

If SSO fails or you have no access after login, re-check IDC_USER_ID and the rbacRoleMappings block in config/argocd-capability.yaml, then update the capability (recreate the mapping) so your Identity Center user is ADMIN.

Step 5 — Next: register the cluster and deploy

Managed Argo CD does not deploy to kubernetes.default.svc by default. On the next page you register this cluster by EKS ARN and grant the capability role sync permissions, then install Kueue.

Next: Kueue via GitOps.