diff --git a/tks-cluster/create-aws-conf-secret.yaml b/tks-cluster/create-aws-conf-secret.yaml
old mode 100755
new mode 100644
diff --git a/tks-cluster/create-usercluster-wftpl.yaml b/tks-cluster/create-usercluster-wftpl.yaml
index 2125ee24..bd952589 100644
--- a/tks-cluster/create-usercluster-wftpl.yaml
+++ b/tks-cluster/create-usercluster-wftpl.yaml
@@ -17,9 +17,6 @@ spec:
       value: "template-std"
     - name: git_account
       value: "tks-management"
-    # TODO: if gittoken is necessary, the following options might be tried.
-    # 1. Pass gittoken name (or use predefined name) and createApp reconstructs this repo URL.
-    # 2. Make argocd pod always use the common gittoken.
     - name: manifest_repo_url
       value: ""
     - name: revision
diff --git a/tks-cluster/manage-internal-communication.yaml b/tks-cluster/manage-internal-communication.yaml
old mode 100755
new mode 100644
diff --git a/tks-cluster/validate-usercluster-wftpl.yaml b/tks-cluster/validate-usercluster-wftpl.yaml
new file mode 100644
index 00000000..f2b68f35
--- /dev/null
+++ b/tks-cluster/validate-usercluster-wftpl.yaml
@@ -0,0 +1,39 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: tks-validate-usercluster
+  namespace: argo
+spec:
+  entrypoint: run-sonobuoy
+  arguments:
+    parameters:
+    - name: cluster_id
+      value: "011b88fa-4d53-439f-9336-67845f994051"
+    - name: sonobuoy_mode
+      value: "quick"
+  templates:
+  - name: run-sonobuoy
+    container:
+      name: sonobuoy
+      image: 'sktcloud/sonobuoy-worker'
+      command:
+        - /bin/bash
+        - '-exc'
+        - |
+          KUBECONFIG_=$(kubectl get secret -n {{workflow.parameters.cluster_id}} {{workflow.parameters.cluster_id}}-kubeconfig -o jsonpath="{.data.value}" | base64 -d)
+          cat <<< "$KUBECONFIG_" > /etc/kubeconfig_temp
+          export KUBECONFIG='/etc/kubeconfig_temp'
+
+          sonobuoy run --mode {{workflow.parameters.sonobuoy_mode}} --e2e-parallel 30 --wait
+          sonobuoy retrieve && mkdir ./results
+          tar xzf ./*.tar.gz -C ./results
+          cat ./results/plugins/e2e/results/global/e2e.log
+
+          status=$(sonobuoy status)
+
+          if grep -q "failed" <<< "$status"; then
+            echo "Sonobuoy e2e test failed!"
+            exit 1
+          fi
+
+          sonobuoy delete --all --wait