How to fix permission denied: applications, create, default/myapp in Kubernetes

Check which user/service account is authenticated and what project roles exist:

argocd account get-info
argocd proj list
argocd proj role list <project-name>

The simplest solution is to use the "default" project which has proper RBAC configured during ArgoCD installation. Update your application to use the default project:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default

If you need a custom project, create it with cluster and source permissions:

argocd proj create my-project \
  -d https://kubernetes.default.svc,default \
  --src "*"

Define a project role that can perform create, sync, update, and delete:

argocd proj role create my-project deploy-role

Add policy permissions for each required action:

argocd proj role add-policy my-project deploy-role \
  --action "create,sync,update,delete" \
  --permission "allow" \
  --object "*/*"

Generate a token that can be used in CI/CD pipelines:

argocd proj role create-token my-project deploy-role

Store this token securely and use it to authenticate in your CI/CD system.

For group-based access, edit the argocd-rbac-cm ConfigMap:

kubectl edit configmap argocd-rbac-cm -n argocd

Add policies like:

ui_policy.default: g, my-group, role:admin

Test if a specific user/role has permission to perform an action:

argocd admin settings rbac can create applications my-project