Argo CD

Declarative GitOps continuous delivery for Kubernetes. Argo CD watches your Git repositories and automatically syncs your cluster to match, with a rich web UI, RBAC, and Helm/Kustomize support.

Installing Argo CD via Helm

# Add the Argo CD Helm repository
helm repo add argo https://argoproj.github.io/argo-helm
helm repo update

# Create namespace and install
kubectl create namespace argocd
helm install argocd argo/argo-cd \
  --namespace argocd \
  --set server.service.type=LoadBalancer \
  --set configs.params."server\.insecure"=true  # for local dev only

# Get the initial admin password
kubectl get secret argocd-initial-admin-secret -n argocd \
  -o jsonpath="{.data.password}" | base64 -d

# Access the UI (if using port-forward)
kubectl port-forward svc/argocd-server -n argocd 8080:443
# Open: https://localhost:8080 (admin / password from above)

# Install the argocd CLI
brew install argocd   # macOS
argocd login localhost:8080 --username admin --password YOUR_PASSWORD --insecure

Deploying Your First Application

Create an Application manifest that tells Argo CD which Git repo to watch and which cluster/namespace to sync to:

# application.yaml — point Argo CD at your Git repo
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default

  # Where to get the manifests
  source:
    repoURL: https://github.com/my-org/my-app-config
    targetRevision: HEAD
    path: k8s/production

  # Where to deploy
  destination:
    server: https://kubernetes.default.svc
    namespace: my-app

  # Sync policy
  syncPolicy:
    automated:
      prune: true      # delete resources removed from Git
      selfHeal: true   # revert manual changes
    syncOptions:
      - CreateNamespace=true

kubectl apply -f application.yaml -n argocd

Helm Chart Deployment

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: nginx-ingress
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://kubernetes.github.io/ingress-nginx
    chart: ingress-nginx
    targetRevision: 4.10.0
    helm:
      releaseName: ingress-nginx
      values: |
        controller:
          replicaCount: 2
          service:
            type: LoadBalancer
          metrics:
            enabled: true
          podAnnotations:
            prometheus.io/scrape: "true"
  destination:
    server: https://kubernetes.default.svc
    namespace: ingress-nginx
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

Kustomize Overlays

# Git repo structure for Kustomize overlays:
# k8s/
#   base/
#     deployment.yaml
#     service.yaml
#     kustomization.yaml
#   overlays/
#     dev/
#       kustomization.yaml    # patches: replicas=1, image=dev-tag
#     production/
#       kustomization.yaml    # patches: replicas=3, image=stable-tag

# Argo CD Application for production overlay:
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app-production
  namespace: argocd
spec:
  source:
    repoURL: https://github.com/my-org/my-app-config
    targetRevision: HEAD
    path: k8s/overlays/production   # Argo CD auto-detects kustomization.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: my-app-production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

Argo CD vs Flux

RBAC and SSO Setup

# argocd-rbac-cm ConfigMap (in argocd namespace)
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.default: role:readonly
  policy.csv: |
    # Admins: full access
    p, role:admin, applications, *, */*, allow
    p, role:admin, clusters, *, *, allow
    p, role:admin, repositories, *, *, allow

    # Developers: sync apps but no delete
    p, role:developer, applications, get, */*, allow
    p, role:developer, applications, sync, */*, allow
    p, role:developer, applications, create, */*, allow
    p, role:developer, applications, update, */*, allow

    # Map GitHub team to role
    g, my-org:ops-team, role:admin
    g, my-org:dev-team, role:developer