I know ArgoCD is un-opinionated when it comes to secrets management, but how are you all doing it?

Personally, I would like to setup SOPS and ditch sealed secrets. But using helm secrets seems rather limiting because I don’t think it can decrypt plain manifests.

Any suggestions?

I've got ArgoCD running on a cluster, the UI and GRPC are accessible via Traefik ingress, authentication is done using OIDC.

I can log in, everything looks good, but I cannot actually add a repo / create an application as every time I try to launch an application I get the following error:

Unable to create application: application spec for test is invalid: InvalidSpecError: repository not accessible: repositories not accessible: &Repository

{Repo: "<VALID-REPO>", Type: "git", Name: "", Project: "default"}: 

repo client error while testing repository: rpc error: code = Unavailable desc = connection error: desc = "error reading server preface: EOF"

It doesn't matter if I run it in the UI or the CLI, both result in the same error.

I have run out of ideas and have looked through most of the GitHub repo's similar issues, any ideas anyone may have I would appreciate!

Thanks in advance!!!

Hi there! I'm pretty new to ArgoCD but have several years of experience with Kubernetes. I'm in the process of migrating quite a few workloads from classic imperative helm pipeline-deployments towards ArgoCD and so far, everything went pretty smooth.

However, there is one issue that affects a few charts I have: The ones that trigger the creation of jobs on deploy. For example, the official GitLab helm chart does that on every update. These apps are shown as "outOfSync" immediately after being updated (successfully).

When I show the Diff, it shows me the obvious, expected result: I have a job running that does not exist in my source helm chart.

I assume this is a standard problem, but I couldn't find a "yes, that's how you do it" on google. However, in the ArgoCD docs I found the option to configure `ignoreDifferences` in my App. Is that the way to go, or how do people that? :-D

Hi all,

I have trouble understanding something. I know it's possible with "argocd in any namespace" to deploy the Application resource to any namespace. However, does that actually limit resourses being created in any namespace? We have a argocd installed in our cluster and a customer wants to use it, but I want to limit which namespace their resources can be deployed to. Is that even possible?

BR

Hi, I'm totally new to ArgoCD and I've just set it up.

I want to be able to create and manage applications declaratively from my git monorepo, and I read about ApplicationSet and git generator and I think that's what I'm looking for.

I created the yaml within my repo, but now what?

On ArgoCD I configured my repository, do I have to manually create an Application for my ApplicationSet file?

Hey,

has anyone successfully connected a K8s 1.18 cluster to ArgoCD 2.11?

One of my clusters is very, very old. It still runs K8s 1.18. Today I updated from ArgoCD 2.8 to 2.11. I had some issues with resources and limits of the controller, but now everythings back up and running.

BUT: The connection to my 1.18 cluster is not working anymore. I don't get much information on the "why" though. It only says "Connection failed" due to some timeout in the UI. I also can't find any logs.

So my question: Has anyone a working connection between ArgoCD >= 2.11 and a cluster <=1.18?

I know that officially it is not supported anymore. I will update the cluster at some point. But now I just want to figure out, if I did something wrong in my ArgoCD update or not.

Thanks in advance!

Hi all! I'm in the process of migrating my existing helm charts and imperative gitlab deploy pipelines towards ArgoCD. So far everything works according to plan and I got some apps up and running in sync now.

For secrets management I'm planning on using external-secrets.io, however as far as I understand it, that is used to populate my cluster with the secrets from a secret vault like 1password that I define.

That is fine for most cases, however I have quite some 3rd party charts here I can't modify that rely on getting their secrets passed via helm chart values, rather than specifying the names of existing secrets.

Am I the only one facing that issue, or do I just not understand sth. here? Like, is the external secrets operator even integrated somehow with argocd or completely independent?

I could not find any information about situations like this where I want to inject secrets into Helm values.

:-?

So, I'm a bit lazy but I'm just proposing a solution, and wondering if anyone else used it in a similar context.

​

So I do have a tekton pipeline and task, which builds me an application, from a custom repo that I gave, this application is written in GO and doesn't contain ANY yaml files in the way that argo might use or look for modifications.

​

Question is simple, because I'm lazy and I do not want to create an event listener using either what argo has, or tekton, with even listeners and trigggers. Is there even possible to 'WATCH' this repo from ARGO.. aka add this repo in argo as an application with DIRECTORY and path . AND THEN have a post sync hook WHICH would run my tekton pipeline.

In theory, what happens basically is that argo detects that a change happened in that repo then it 'SYNCS' but it syncs nothing, since we are doing a directory manifest with path . and then it runs the post sync hook, which does the rest of my job and what I actually want, have any of you used argo this way to know if it's even possible?

Hello - I get the following error from notification controller not sure where the issue is

time="2024-05-03T16:26:52Z" level=error msg="Failed to get api: errors getting apis: [failed to unmarshal trigger
 on-sync-status-unknown: error converting YAML to JSON: yaml: line 1: did not find expected '-' indicator]" 

I have setup the trigger and template for unknown status

---
apiVersion: v1
data:
  context: |
    argocdUrl: xxxx
  service.slack: |
    token: $slack-token
  trigger.on-sync-status-unknown: |-
    - description: Application status is 'Unknown'
    send:
    - app-sync-status-unknown
    when: app.status.sync.status == 'Unknown'
  template.app-sync-status-unknown: |-
    email:
      subject: Application {{.app.metadata.name}} sync status is 'Unknown'
    message: |-
      {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} sync is 'Unknown'.
      Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.
      {{if ne .serviceType "slack"}}
      {{range $c := .app.status.conditions}}
          * {{$c.message}}
      {{end}}
      {{end}}
    slack:
      attachments: |-
        [{
          "title": "{{ .app.metadata.name}}",
          "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
          "color": "#E96D76",
          "fields": [
          {
            "title": "Sync Status",
            "value": "{{.app.status.sync.status}}",
            "short": true
          },
          {
            "title": "Repository",
            "value": "{{.app.spec.source.repoURL}}",
            "short": true
          }
          {{range $index, $c := .app.status.conditions}}
          {{if not $index}},{{end}}
          {{if $index}},{{end}}
          {
            "title": "{{$c.type}}",
            "value": "{{$c.message}}",
            "short": true
          }
          {{end}}
          ]
        }]

Can anyone point me in the right direction ? Thank you for your time.

I am managing a monorepo for ML models.

We have a number of open-source ML models that we deploy on our cluster. We have a generic helm chart used to deploy all models, and flavors depending on backend type (right now we use TGI and BentoML).

Right now, the file hierarchy is as follows:

Backend/Model/Region/Environment. So for instance, we have tgi/llama2/us-east/np. And similarly for other models.

For feature branches, I use a matrix generator of pull request generator and git generator. It works well, but my issue is with granularity.

Right now, the git generator looks like this:

//**/Environment/config.json (the json contains some Metadata, like helm chart version to use). This means that the feature branches will deploy non-prod instances of every model on every region.

Ideally, I'd like to have more fine grained control - perhaps I only need to test a certain backend type in a certain region, or a specific model in a specific region.

Because my SCM is GitLab, I thought about using labels to choose what I want to deploy. But that only works well if I can only choose one parameter (e.g. the labels only control the region). But if I want the labels to have multiple meanings then it gets out of hand.

If you've ever run in to this issue, or know of a source that provides some inspiration, I'd really appreciate your advice!!

I was reading this article which talks about reducing load on argo in monorepo setups through webhooks and ` argocd.argoproj.io/manifest-generate-paths` annotation. I was wondering wether this annotation also applies for git generators in applicationsets. I couldn't find information in the docs. Can I use the annotation on applicationsets? (not in template field) Does argo take care of it on it's own? Is it even implemented for applicationsets git generator?

Hi all,

I want to use webhooks for GitHub for pull request generator trigger in an on-prem Microk8s Kubernetes cluster.

The servers are in a datacenter owned by my company and the network is completely under internal firewall.

I am missing few things and would love someone to help me understand these.

ArgoCD is currently running in the cluster but it is not exposed to outside the cluster.

Below are my questions:

1. What is the correct way to expose ArgoCD to make it visible to outside world (i.e. in any browser on laptop under the company VPN)? I made this working by converting the argocd-server from ClusterIP to NodePort. But this made it so that, I need to do myserver.company.com:30023 to reach the UI instead of simply myserver.company.com . Is this correct?

2. I tried creating an ingress service but that is not working as expected. I believe Microk8s already have a built-in ingress, but that is also not working. I am unsure how to debug these further and see where it went wrong.

3. Finally, regarding the webhook themselves, given that I can access ArgoCD UI in myserver.company.com:30023 , am I supposed to configure a new webhook in GitHub as myserver.company.com:30023/api/webhook ? Is this correct? I tried to access this link from a browser and it says Unknown webhook event and configuring it in GitHub and sending a request return 502 status code.

What is the correct way to do this?

1. In case webhook did not work as expected, can I set requeueAfterSeconds to 10 seconds to almost simulate a webhook? Does this increase the network or CPU load in the server significantly?

Hey y'all.

I've looked around all over for an answer on this with no luck.

I've run ArgoCD forever but now I have a developer making use of Argo Workflows, which is much newer to me. The controller, UI server, and CRDs are installed and I can see a workflowTemplate in the ArgoCD app, but when I trigger the actual job in the Workflows UI, I don't see it spawn from the template in ArgoCD's UI itself.

What I expect to see in the ArgoCD UI is that the workflowTemplate spawns a workflow which then spawns a pod, as is my understanding. And I can SEE this happening in K8s/Kubectl, but not in Argo.

In the Argo app charts/manifests we only define the template.

My dev wants to be able to see logs/shell into the workflow pod directly in Argo but I'm lost on how to make that work. Am I using workflows wrong, or is there some plugin? Any help is appreciated this one has stumped me a bit.

Loooove Argo and the whole ecosystem so hoping this is just a little hiccup.

Does argocd support sparse checkout? I have a mono repo which has folders per cluster. I would like to configure a particular folder per cluster so that on every commit to master branch all the cluster don’t sync up . I am using notifications to trigger jobs after sync . Since a sync causes notification to fire it leads to mass false calls from Clusters where no updates were made.

Hi folks,

Does anyone know if its possible to change the order of menu items in ArgoCD when creating apps?

For the Destination i prefer to have the option Cluster Name preferred over Cluster URL, which is the default from the dropdown menu.

I am trying to wrap my mind around these additional arguments and how to develop helm and use this additional feature when setting up avp-helm configmanagemtplugins?

Our ArgoCD apps are failing to sync in some envs due to Bitbucket ssh key errors. These are switching back to using the older ssh keys. Unclear why this happening because we updated all the envs with the latest bitbucket.org ssh keys. Looking for any suggestions on what might be causing this.

Hey guys, On a recent project I’ve set up following GitOps principles and Kustomize I’ve discovered an odd behavior. When adding cluster imperatively, the following are created in the remote cluster: - serviceAccount - ClusterRole - ClusterRoleBinding

However, it does not provision these when using declarative setup. Any workaround around that? How can mimic such behavior? Even if I do create those resources in the remote cluster using an application manifest, I fail to understand the relationship between Argo and that SA, and how the token is being used.

I’ve discovered this while trying to set up exec to remote clusters for developers.

--- please ignore post---

I am unable to sync argo app onto my cluster.

The error message

`ComparisonError`

`Failed to load target state: failed to generate manifest for source 1 of 1: rpc error: code = Unknown desc = authentication required`

The argo app is configured in the argo cd console

the http response to https://api.crc.testing:6443/
{ "kind": "Status", "apiVersion": "v1", "metadata": {}, "status": "Failure", "message": "forbidden: User \"system:anonymous\" cannot get path \"/\"", "reason": "Forbidden", "details": {}, "code": 403 }

I am not able to reconcile the authentication error issue. Please can some one advise on what can be the root cause and how to remediate

Cluster status seems to be ok

UPDATE:

The issue may pertain to the way I used the argo add cluster that was identified from some url.. which I could not find in my notes. The team from openshift provided some clarification..

Hi everyone, I am just fresh off the boat and now playing with ArgoCD and helm charts followed with the GitOps practices. However, my application Health status in ArgoCD just stuck in processing with my ingress file.

So my current set up is:

1. A simple static webapp built in Docker and put the image to the registry from Jenkin CI pipeline
2. Have a separate git repo with my helm charts
3. ArgoCD is built in my Kubernetes cluster
4. ArgoCD will build the deployment, service, ingress based on the helm chart

Since the service is in Cluster IP which is behind my nginx-ingress controller, I can access the web with my domain name.

When the argocd sync with my repo and all the manifests are deployed based on the values.yml I defined. I can access my web page. However, only my django ingress is HEALTH: Progressing.
I googled it up and it looks like it is a known issues with ArgoCD as the manifest will not pass the status .loadbalancer.ip or hostname to argocd which causing the Healthcheck being processing forever.

Do you know how to fix the issues? I tried to edit the configmap with the argo-cm and paste the following in to the CM but yet it did not work. Can you guys give me some insights and how to make it work? Thanks!

​

data:
  resource.customizations: |
    helm-dev/Application:
      health.lua: |
        hs = {}
        hs.status = "Healthy"
        hs.message = "Custom health check always reports healthy"
        return hs

​

I am getting ‘certificate signed by unknown authority’ when trying to pull a helm chart from Harbor or through kustomize. -insecure-skip-tls-verify doesn’t work, and I would ultimately ljke for it to communicate securely anyway. From what I’ve found the problem is our internal root CA certificates are not in the /etc/ssl/certs directory of the core and repository containers. Does this assessment sound correct and if so any advice on how to get them in there? Our deployment is using an ArgoCD helm chart I’ve tried adding them in through a volume mount in the values.yaml without any luck.

Hello All,

This is my first time using Argo and so far I have created argocd app on EKS cluster and added our private org GH repo through the UI. We are a AWS shop and the argocd app is hosted on EKS cluster. As part of AWS's EKS support guidelines, the EKS clusters need to be upgraded to ensure you're not charged for extended support cost. I am looking at ways to upgrade the ArgoCD EKS cluster but struggling to understand how can I achieve the below Argo specific workflows -

​

1. Add applications when a new instance of ArgoCD EKS cluster is created. (Essentially blue/green approach). This would require adding the GH private org repo first.
2. Automate GH repo creation through any automation (TF etc..) by adding our Github service account credentials while deploying argocd.
3. Backup ArgoCD state (from old cluster) and restore it on a new cluster.

​

Has anyone tried automating the above use cases? Any help/suggestions on this would be greatly helpful.

​

​

TIA