[Back to blog](https://zcp.zsoftly.ca/blog)
 [Tutorials](https://zcp.zsoftly.ca/blog/category/tutorials)

# ArgoCD CLI Login Fails on EKS Auto Mode? Here Is the Fix

Standard ArgoCD login commands fail on EKS Auto Mode because AWS manages ArgoCD differently. This guide shows you the correct authentication method using tokens and environment variables.

Staff at ZSoftly

January 1, 2026

· Updated June 19, 2026

3 min read

Share

![ArgoCD CLI authentication flow for EKS Auto Mode using tokens](https://zcp.zsoftly.ca/images/blog/2026/argocd-eks-auto-mode-login.webp)

You migrated to EKS Auto Mode. You enabled the ArgoCD capability. Now your CLI commands fail.

This is not a bug. AWS manages ArgoCD differently on EKS Auto Mode. Standard login methods do not work.

This guide shows you the correct authentication method.

---

## TL;DR

EKS Auto Mode ArgoCD requires:

1. Server URL from `aws eks describe-capability`
2. Token from the ArgoCD UI (via IAM Identity Center)
3. Environment variables: `ARGOCD_SERVER`, `ARGOCD_AUTH_TOKEN`, `ARGOCD_OPTS="--grpc-web"`

Skip `argocd login`. Skip `--core`. Skip port-forwarding. They will not work.

---

## Why Your Login Commands Fail

EKS Auto Mode runs ArgoCD on the control plane, not on worker nodes. This changes everything about authentication.

These commands will fail:

- `argocd login` (no local users or password login)
- `argocd --core` (no ConfigMaps exist in your cluster)
- Port-forwarding (no argocd-server pod to forward to)
- SSO CLI login with `--sso` (AWS networking blocks the gRPC flow)

AWS disables these paths intentionally. They want you to use IAM Identity Center with tokens.

---

## The Correct Authentication Method

Three steps. Takes five minutes.

### Step 1: Get Your ArgoCD Server URL

```bash
export REGION=ca-central-1
export CLUSTER_NAME=your-cluster-name
export CAPABILITY_NAME=your-cluster-name-argocd

export ARGOCD_SERVER=$(aws eks describe-capability \
  --region "$REGION" \
  --cluster-name "$CLUSTER_NAME" \
  --capability-name "$CAPABILITY_NAME" \
  --query 'capability.configuration.argoCd.serverUrl' \
  --output text | sed 's|^https://||')
```

### Step 2: Generate a Token from the UI

1. Open AWS Console
2. Go to EKS, then your Cluster, then Capabilities, then ArgoCD
3. Click Open UI
4. Sign in with AWS IAM Identity Center
5. Navigate to Settings, then Accounts, then your account
6. Click Generate New Token
7. Copy the token

### Step 3: Set Environment Variables

```bash
export ARGOCD_AUTH_TOKEN="your-token-here"
export ARGOCD_OPTS="--grpc-web"
```

### Verify It Works

```bash
argocd app list
```

You should see your applications listed.

---

## Quick Reference

| What Works | What Fails |
| --- | --- |
| Token + env vars + grpc-web | argocd login |
| UI login via IAM Identity Center | Password authentication |
| Account or project tokens | Core mode |
| ARGOCD\_SERVER env var | Port-forwarding |

---

## Common Mistakes

Mistake 1: Forgetting VPN (if private access is enabled)

If you configured private endpoint access, the ArgoCD endpoint resolves to private IPs (10.x.x.x). You need VPN access to reach it.

Test with:

```bash
dig your-argocd-endpoint.eks-capabilities.ca-central-1.amazonaws.com
```

If you see a 10.x.x.x address, you need VPN. If you see a public IP, you are good.

Mistake 2: Missing grpc-web flag

The managed endpoint requires gRPC-web. Add this to your environment:

```bash
export ARGOCD_OPTS="--grpc-web"
```

Mistake 3: Trying admin credentials

There is no admin user. AWS IAM Identity Center handles all authentication.

---

## Why This Design?

AWS made these choices for good reasons:

- Security: No passwords to leak. Tokens rotate without cluster changes.
- Simplicity: One authentication path. IAM Identity Center integration out of the box.
- Separation: ArgoCD runs on the control plane. Your cluster stays clean.

The tradeoff is that existing ArgoCD knowledge does not transfer directly. You need to learn the AWS way.

---

Running into other EKS Auto Mode issues? ZSoftly runs its own sovereign Canadian cloud (ZCP), and as an [AWS Partner](https://zcp.zsoftly.ca/professional-services/aws/) our [Professional Services](https://zcp.zsoftly.ca/professional-services) team provides AWS DevOps solutions and managed services for Canadian companies. [Talk to us](https://zcp.zsoftly.ca/contact)

---

## Sources

- [Working with ArgoCD on EKS](https://docs.aws.amazon.com/eks/latest/userguide/working-with-argocd.html) - AWS Documentation
- [ArgoCD EKS Capability Considerations](https://docs.aws.amazon.com/eks/latest/userguide/argocd-considerations.html) - AWS Documentation
- [Create ArgoCD CLI Authentication](https://docs.aws.amazon.com/eks/latest/userguide/argocd-create-cli.html) - AWS Documentation

## Related articles

Tutorials

June 19, 2026

### [Deploy Dokploy on ZCP: Launch a VM and Self-Host Your Apps](https://zcp.zsoftly.ca/blog/deploy-your-first-vm)

A step-by-step guide to launching a virtual machine and installing Dokploy on ZSoftly Cloud Platform, entirely from the portal. Self-host your apps and databases with Git deploys and automatic TLS.

Tutorials

May 16, 2026

### [Managed DNS on ZCP: how it works and how to set up a domain](https://zcp.zsoftly.ca/blog/dns-on-zcp)

A walkthrough of the managed DNS service on ZCP, the two-nameserver architecture behind it, and the portal steps to create and manage a zone.

Tutorials

May 16, 2026

### [VMware to Apache CloudStack: a step-by-step migration guide](https://zcp.zsoftly.ca/blog/vmware-to-cloudstack-migration-guide)

A practical, step-by-step guide to moving VMware vSphere workloads to Apache CloudStack + KVM. What ZSoftly handles end to end and what is happening underneath.