Install Argo CD

Preliminary

Kubernetes is installed; if not, check 🔗link
Helm binary is installed; if not, check 🔗link

1. install argoCD binary

Install the argocd CLI first so you can authenticate, sync applications, and verify deployment status from your terminal.

MIRROR="files.m.daocloud.io/"
VERSION=v3.1.8
[ $(uname -m) = x86_64 ] && curl -sSLo argocd "https://${MIRROR}github.com/argoproj/argo-cd/releases/download/${VERSION}/argocd-linux-amd64"
[ $(uname -m) = aarch64 ] && curl -sSLo argocd "https://${MIRROR}github.com/argoproj/argo-cd/releases/download/${VERSION}/argocd-linux-arm64"
chmod u+x argocd
mkdir -p ${HOME}/bin
mv -f argocd ${HOME}/bin

[Optional] add to PATH

cat >> ~/.bashrc  << EOF
export PATH=$PATH:/root/bin
EOF
source ~/.bashrc

2. install components

Choose one installation path below. Helm is recommended when you want versioned upgrades and repeatable configuration.

Install By

1. Prepare argocd.values.yaml

cat <<EOF > argocd.zj.values.yaml
crds:
  install: true
  keep: false
global:
  domain: argocd.dev.72602.online
  revisionHistoryLimit: 3
  image:
    repository: m.daocloud.io/quay.io/argoproj/argocd
    imagePullPolicy: IfNotPresent
redis:
  enabled: true
  image:
    repository: m.daocloud.io/docker.io/library/redis
  exporter:
    enabled: false
    image:
      repository: m.daocloud.io/bitnami/redis-exporter
  metrics:
    enabled: false
redis-ha:
  enabled: false
  image:
    repository: m.daocloud.io/docker.io/library/redis
  configmapTest:
    repository: m.daocloud.io/docker.io/koalaman/shellcheck
  haproxy:
    enabled: false
    image:
      repository: m.daocloud.io/docker.io/library/haproxy
  exporter:
    enabled: false
    image: m.daocloud.io/docker.io/oliver006/redis_exporter
dex:
  enabled: true
  image:
    repository: m.daocloud.io/ghcr.io/dexidp/dex
server:
  ingress:
    enabled: true
    ingressClassName: nginx
    annotations:
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
      cert-manager.io/cluster-issuer: self-signed-ca-issuer
      nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    hostname: argocd.dev.72602.online
    path: /
    pathType: Prefix
    tls: true
EOF

cat <<EOF > argocd.72602.values.yaml
crds:
  install: true
  keep: false
global:
  domain: argocd.72602.online
  revisionHistoryLimit: 3
  image:
    repository: m.daocloud.io/quay.io/argoproj/argocd
    imagePullPolicy: IfNotPresent
redis:
  enabled: true
  image:
    repository: m.daocloud.io/docker.io/library/redis
  exporter:
    enabled: false
    image:
      repository: m.daocloud.io/bitnami/redis-exporter
  metrics:
    enabled: false
redis-ha:
  enabled: false
  image:
    repository: m.daocloud.io/docker.io/library/redis
  configmapTest:
    repository: m.daocloud.io/docker.io/koalaman/shellcheck
  haproxy:
    enabled: false
    image:
      repository: m.daocloud.io/docker.io/library/haproxy
  exporter:
    enabled: false
    image: m.daocloud.io/docker.io/oliver006/redis_exporter
dex:
  enabled: true
  image:
    repository: m.daocloud.io/ghcr.io/dexidp/dex
server:
  ingress:
    enabled: true
    ingressClassName: nginx
    annotations:
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
      cert-manager.io/cluster-issuer: lets-encrypt
      nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    hostname: argocd.72602.online
    path: /
    pathType: Prefix
    tls: true
EOF

2. Install argoCD From Mirror

helm upgrade --install argo-cd argo-cd \
  --namespace argocd \
  --create-namespace \
  --version 9.5.4 \
  --repo https://aaronyang0628.github.io/helm-chart-mirror/charts \
  --values argocd.zj.values.yaml \
  --atomic

helm install argo-cd argo-cd \
  --namespace argocd \
  --create-namespace \
  --version 9.5.4 \
  --repo https://aaronyang0628.github.io/helm-chart-mirror/charts \
  --values argocd.72602.values.yaml \
  --atomic

[Optional]() 4. Install argoCD From Original

helm upgrade --install argo-cd argo-cd \
  --namespace argocd \
  --create-namespace \
  --version 9.5.4 \
  --repo https://argoproj.github.io/argo-helm \
  --values argocd.zj.values.yaml \
  --atomic

helm install argo-cd argo-cd \
  --namespace argocd \
  --create-namespace \
  --version 9.5.4 \
  --repo https://argoproj.github.io/argo-helm \
  --values argocd.72602.values.yaml \
  --atomic

By default, you can install ArgoCD from this link.

kubectl create namespace argocd \
&& kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

Or, you can use your own manifest file URL.

4. prepare `argocd-server-external.yaml`

Install By

kubectl -n argocd apply -f - <<EOF
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: argo-cd
    app.kubernetes.io/name: argocd-server-external
    app.kubernetes.io/part-of: argocd
  name: argocd-server-external
spec:
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: 8080
    nodePort: 30443
  selector:
    app.kubernetes.io/instance: argo-cd
    app.kubernetes.io/name: argocd-server
  type: NodePort
EOF

kubectl -n argocd apply -f - <<EOF
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: argo-cd
    app.kubernetes.io/name: argocd-server-external
    app.kubernetes.io/part-of: argocd
  name: argocd-server-external
spec:
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: 8080
    nodePort: 30443
  selector:
    app.kubernetes.io/instance: argo-cd
    app.kubernetes.io/name: argocd-server
  type: NodePort
EOF

kubectl -n argocd apply -f - <<EOF
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: argo-cd
    app.kubernetes.io/name: argocd-server-external
    app.kubernetes.io/part-of: argocd
    app.kubernetes.io/version: v3.3.8
  name: argocd-server-external
spec:
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: 8080
    nodePort: 30443
  selector:
    app.kubernetes.io/instance: argo-cd
    app.kubernetes.io/name: argocd-server
  type: NodePort
EOF

6. [Optional] prepare `argocd-server-ingress.yaml`

You also need an ingress controller (for example ingress-nginx or traefik). If not installed, check 🔗link.

Install By

Before creating the ingress, install cert-manager and create the self-signed-ca-issuer issuer. If not ready, check 🔗link.

kubectl -n argocd apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: self-signed-ca-issuer
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
  name: argo-cd-argocd-server
  namespace: argocd
spec:
  ingressClassName: nginx
  rules:
  - host: argocd.dev.72602.online
    http:
      paths:
      - backend:
          service:
            name: argo-cd-argocd-server
            port:
              number: 443
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - argocd.dev.72602.online
    secretName: argocd.dev.72602.online-tls
EOF

Before you create ingress, you need to create cert-manager and cert-issuer lets-encrypt, if not, please check 🔗link

kubectl -n argocd apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: lets-encrypt
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
  name: argo-cd-argocd-server
  namespace: argocd
spec:
  ingressClassName: nginx
  rules:
  - host: argocd.72602.online
    http:
      paths:
      - backend:
          service:
            name: argo-cd-argocd-server
            port:
              number: 443
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - argocd.72602.online
    secretName: argocd.72602.online-tls
EOF

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: self-signed-ca-issuer
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
  name: argo-cd-argocd-server
  namespace: argocd
spec:
  ingressClassName: nginx
  rules:
  - host: argocd.dev.72602.online
    http:
      paths:
      - backend:
          service:
            name: argo-cd-argocd-server
            port:
              number: 443
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - argocd.dev.72602.online
    secretName: argocd.dev.72602.online-tls

8. get argocd initialized password

kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

ARGOCD_PASS=$(kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d)
MASTER_IP=$(kubectl get nodes --selector=node-role.kubernetes.io/control-plane -o jsonpath='{$.items[0].status.addresses[?(@.type=="InternalIP")].address}')
argocd login --insecure --username admin $MASTER_IP:30443 --password $ARGOCD_PASS

if you deploy argocd in minikube, you might need to forward this port

ssh -i ~/.minikube/machines/minikube/id_rsa docker@$(minikube ip) -L '*:30443:0.0.0.0:30443' -N -f

open https://$(minikube ip):30443

if you use ingress, you might need to configure your browser to allow insecure connection

kubectl -n basic-components get secret root-secret -o jsonpath='{.data.tls\.crt}' | base64 -d > cert-manager-self-signed-ca-secret.crt

import cert-manager-self-signed-ca-secret.crt into your browser

open https://argocd.dev.72602.online

Manage User Info

user readonly is using for homepage website to grab some data from kubernetes.

create local user readonly (no password, apiKey only)

kubectl -n argocd patch configmap argocd-cm --type merge -p '{"data":{"accounts.readonly":"apiKey","accounts.readonly.enabled":"true"}}'

kubectl -n argocd patch configmap argocd-rbac-cm --type merge -p '{"data":{"policy.csv":"p, role:readonly, applications, get, */*, allow\np, role:readonly, projects, get, *, allow\np, role:readonly, repositories, get, *, allow\np, role:readonly, clusters, get, *, allow\ng, readonly, role:readonly","policy.default":""}}'

kubectl -n argocd rollout restart deploy argo-cd-argocd-server

retrieve user readonly token

argocd account list
argocd account generate-token --account readonly

Manage GitHub Repo

generate github deploy key

ssh-keygen -t rsa -b 4096 -C "github-deploy-key" -f id_rsa_github -N ""

create kubernetes secret

kubectl create secret generic github-ssh-key \
  --from-file=id_rsa=./id_rsa_github \
  --from-file=id_rsa.pub=./id_rsa_github.pub \
  --from-file=known_hosts=<(ssh-keyscan github.com)

FAQ

Q1: The browser doesn’t trust this self-signed certificate

Basically, you need to import the certificate into your browser.

kubectl -n basic-components get secret root-secret -o jsonpath='{.data.tls\.crt}' | base64 -d > cert-manager-self-signed-ca-secret.crt

And then import it into your browser.

Install Argo CD

Preliminary

1. install argoCD binary

2. install components

4. prepare argocd-server-external.yaml

6. [Optional] prepare argocd-server-ingress.yaml

8. get argocd initialized password

9. login argocd

Manage User Info

Manage GitHub Repo

FAQ

4. prepare `argocd-server-external.yaml`

6. [Optional] prepare `argocd-server-ingress.yaml`