Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

argocd

The CLI of Argo CD, the GitOps tool that keeps Kubernetes clusters in sync with what is in Git.

Level
DevSecOps service
Group
Git and CI/CD
Needs root
No
Package
argocd

What it does

Argo CD runs in the cluster and watches Git repositories. An Application says: "this path in this repo (plain YAML, Kustomize or Helm) goes to this cluster and namespace". When Git changes, Argo CD syncs the cluster; when someone changes the cluster by hand, it shows OutOfSync and can self-heal. Rollback = git revert.

The argocd CLI talks to the Argo CD API server. The same can be done with kubectl apply of Application YAML (the GitOps way) or in the web UI.

How to write it

argocd login SERVER
argocd app create|get|sync|diff|history|rollback NAME

Main parts

Commands

login SERVER
Log in to Argo CD.
app create NAME …
Create an Application.
app list / app get NAME
Show apps and their sync and health status.
app sync NAME
Sync now.
app diff NAME
Show the difference between Git and the cluster.
app history / app rollback NAME ID
Revisions / go back.
app set NAME --sync-policy automated
Change settings.
app delete NAME
Delete the app (and its resources by default).
repo add URL
Add a Git or Helm repository.
cluster add CONTEXT
Add another cluster.
proj create|list
Projects (limits on repos, clusters, namespaces).
account update-password
Change the password.
admin initial-password
Show the first admin password.

Options 8

Most used

app create flags

--repo URL
Git repository.
--path DIR
Folder in the repo.
--revision BRANCH|TAG
Git revision (default HEAD).
--dest-server URL / --dest-namespace NS
Target cluster and namespace.
--sync-policy automated
Sync by itself.
--self-heal / --auto-prune
Undo manual changes / delete removed objects.
--sync-option CreateNamespace=true
Create the namespace.
--helm-set k=v / --values FILE
Helm values.

Examples 10

$ run as a normal user# run as root (or with sudo)

  1. 1Install Argo CD in the cluster

    kubectl create namespace argocd
    kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.13.2/manifests/install.yaml
    kubectl -n argocd rollout status deploy/argocd-server
  2. 2Log in through a port-forward

    kubectl -n argocd port-forward svc/argocd-server 8443:443 &
    argocd admin initial-password -n argocd
    argocd login localhost:8443 --username admin --insecure
    argocd account update-password
  3. 3Create an app that syncs by itself

    argocd app create shop --repo https://github.com/s0sta/platform.git --path apps/shop/overlays/prod --dest-server https://kubernetes.default.svc --dest-namespace shop --sync-policy automated --self-heal --auto-prune --sync-option CreateNamespace=true
  4. 4The same as YAML in Git (GitOps)

    cat apps/shop.yaml
    apiVersion: argoproj.io/v1alpha1
    kind: Application
    metadata: { name: shop, namespace: argocd }
    spec:
      project: default
      source:
        repoURL: https://github.com/s0sta/platform.git
        path: apps/shop/overlays/prod
        targetRevision: main
      destination: { server: https://kubernetes.default.svc, namespace: shop }
      syncPolicy:
        automated: { prune: true, selfHeal: true }
        syncOptions: [CreateNamespace=true]
    kubectl apply -f apps/shop.yaml
  5. 5Check status and differences

    argocd app list
    argocd app get shop
    argocd app diff shop
  6. 6Sync by hand and wait

    argocd app sync shop
    argocd app wait shop --health --timeout 300
  7. 7Roll back

    argocd app history shop
    argocd app rollback shop 4

    With auto-sync on, Argo CD syncs Git again; the clean rollback is a git revert.

  8. 8Install a Helm chart as an app

    argocd app create ingress --repo https://kubernetes.github.io/ingress-nginx --helm-chart ingress-nginx --revision 4.11.3 --dest-server https://kubernetes.default.svc --dest-namespace ingress-nginx --sync-option CreateNamespace=true
  9. 9Add a private repository

    argocd repo add git@github.com:s0sta/platform.git --ssh-private-key-path ~/.ssh/argocd_deploy
  10. 10Limit a team with a project

    argocd proj create team-a --src https://github.com/s0sta/team-a.git --dest https://kubernetes.default.svc,team-a

Watch out

  • Delete the argocd-initial-admin-secret after you change the password; better, use SSO.
  • Give Argo CD read-only deploy keys for Git.
  • Never expose argocd-server to the internet without SSO and TLS.

Files

~/.config/argocd/config
CLI login data.

Tips to remember

  • The "app of apps" pattern: one Application that points to a folder with all other Applications.
  • Use Argo CD Image Updater or a CI commit to change image tags in Git.

Exit codes

0Success.
1Error.
20App is not synced or not healthy (with app wait).