How to fix permission denied: applications, create, default/myapp in Kubernetes

KubernetesINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 106 views

ArgoCD project permission denied errors occur when users or service accounts lack RBAC permissions to create or manage applications. This is typically resolved by configuring project roles, policies, and token-based access for CI/CD pipelines.

Quick fix

Fixes permission denied: applications, create, default/myapp

argocd account get-info
argocd proj list
argocd proj role list <project-name>
  1. Verify current authentication and RBAC status
  2. Use the default project for quick fix
  3. Create a custom AppProject with proper configuration
  4. Create a project role for CI/CD operations
kubernetes — error
argocd account get-info
argocd proj list
argocd proj role list <project-name>
permission denied: applications, create, default/myapp

What this error means

When creating an ArgoCD application within a project, the request fails with a permission denied error. This indicates that the authenticated user or service account does not have the necessary RBAC (Role-Based Access Control) permissions to create applications in that specific project. ArgoCD enforces fine-grained RBAC at the project level, requiring explicit policy configuration for each user, group, or service account.

Typical symptoms

  • Error message shows "PermissionDenied desc = permission denied: applications, create"
  • Unable to create applications via CLI or web UI with user account
  • CI/CD pipeline fails at application creation step with permission errors
  • Project-scoped tokens unable to perform create operations
  • Non-default projects always return permission denied
  • Admin users can create applications but regular users cannot
  • Application sync, update, or delete operations fail with permission denied
  • GitHub Actions or Tekton pipelines cannot create ArgoCD applications

Common causes

  1. User account has no RBAC policy configured for the target project
  2. Using a custom project without explicitly configured permissions
  3. Service account token lacks necessary project role policies
  4. RBAC policy specifies object "default/myapp" instead of wildcard "*/*"
  5. User group membership not properly mapped in RBAC configuration
  6. Missing project role creation and permission binding steps
  7. Default project RBAC is not inherited by new projects
  8. Token permissions do not include create action for applications

How to fix "permission denied: applications, create, default/myapp"

1Verify current authentication and RBAC status

Check which user/service account is authenticated and what project roles exist:

bash
argocd account get-info
argocd proj list
argocd proj role list <project-name>
2Use the default project for quick fix

The simplest solution is to use the "default" project which has proper RBAC configured during ArgoCD installation. Update your application to use the default project:

yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
3Create a custom AppProject with proper configuration

If you need a custom project, create it with cluster and source permissions:

bash
argocd proj create my-project \
  -d https://kubernetes.default.svc,default \
  --src "*"
4Create a project role for CI/CD operations

Define a project role that can perform create, sync, update, and delete:

bash
argocd proj role create my-project deploy-role
5Grant necessary permissions to the role

Add policy permissions for each required action:

bash
argocd proj role add-policy my-project deploy-role \
  --action "create,sync,update,delete" \
  --permission "allow" \
  --object "*/*"
6Create a token for the project role

Generate a token that can be used in CI/CD pipelines:

bash
argocd proj role create-token my-project deploy-role

Store this token securely and use it to authenticate in your CI/CD system.

7Configure RBAC policy in argocd-rbac-cm ConfigMap

For group-based access, edit the argocd-rbac-cm ConfigMap:

bash
kubectl edit configmap argocd-rbac-cm -n argocd

Add policies like:

bash
ui_policy.default: g, my-group, role:admin
8Validate permissions using the rbac can command

Test if a specific user/role has permission to perform an action:

bash
argocd admin settings rbac can create applications my-project

Advanced notes

For production, use group-based RBAC mapped through your SSO provider (OIDC, SAML) rather than individual tokens. Project tokens are ideal for CI/CD pipelines but rotate them regularly. The wildcard pattern "*/*" applies to all namespaces and application names - restrict this further in security-sensitive environments. Always use the principle of least privilege when assigning roles.

Frequently asked questions

What does "permission denied: applications, create, default/myapp" mean?
When creating an ArgoCD application within a project, the request fails with a permission denied error. This indicates that the authenticated user or service account does not have the necessary RBAC (Role-Based Access Control) permissions to create applications in that specific project. ArgoCD enforces fine-grained RBAC at the project level, requiring explicit policy configuration for each user, group, or service account.
How do I fix "permission denied: applications, create, default/myapp"?
ArgoCD project permission denied errors occur when users or service accounts lack RBAC permissions to create or manage applications. This is typically resolved by configuring project roles, policies, and token-based access for CI/CD pipelines.
What causes "permission denied: applications, create, default/myapp"?
User account has no RBAC policy configured for the target project Using a custom project without explicitly configured permissions Service account token lacks necessary project role policies
Is the "permission denied: applications, create, default/myapp" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading