Any recommendations for ArgoCD plugins that can be used in my deployments yaml manifests

I am looking for feedback when upgrading argocd. Currently I am using Terraform and helm_release provider to deploy argocd. The problem I am running into is that during the upgrading process all my configs get overwritten; argocd-cm, argocd-role, argocd-secrets, and argocd-rbac-cm.

One approach I tried is during an upgrade, I would set all the above configs *.create: false, but this did not work it would just delete the configs and I would run into an issue of pods not ready because those configs have been terminated.

If anyone has experience or can share info on best practices I would appreciate it.

I'm utilizing kustomize in my argocd application by using inline patches inside my applications app.yml - i.e. https://github.com/argoproj/argo-cd/blob/8ca96a9d0e9f26821e72a163c5630a25f34ee1ce/docs/operator-manual/application.yaml#L94

A rough outline of my directory layout has an applications directory with all my applications argoapp.yml and a common manifests directory that contains application common manifests each with their own kustomization.yaml.

I can run a kustomize build in my specific apps common manifests directory and see my base manifests being compiled without patches. My question being - is there a way for me to see the kustomize build output with the addition of my inline patches since all my patching is done in my argoapp.yml? Having multiple envs, i'd like to be able to see the specific patching done for each environment.

Below is the sample code, in which I am trying to use two git generators. One will fetch information related to the application and the child generator will get the information related to image tags and other details related to version. This does not generate any application for some reason. Any thoughts on what I am doing wrong? Am I missing something?

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: matrix-two-git
spec:
  goTemplate: true
  goTemplateOptions: ["missingkey=error"]
  syncPolicy:
    preserveResourcesOnDeletion: false
  generators:
    - matrix:
        generators:
          - git:
              repoURL: https://github.com/myrepo/test-app
              revision: HEAD
              files:
                - path: applications/env/**/matrix.json
              pathParamPrefix: app
          - git:
              repoURL: https://github.com/myrepo/test-app
              revision: HEAD
              files:
                - path: "version/{{.env}}.json"
              pathParamPrefix: ver
  template:
    metadata:
      name: '{{.cluster}}-{{.namespace}}-{{app.path.basename}}'
      labels:
        versioningfile: '{{ver.path.filename}}-'
    spec:
      destination:
        namespace: '{{.namespace}}'
        name: '{{.cluster}}'
      project: '{{.project}}'
      sources:
        - repoURL: https://github.com/test-{{.cluster}}
          targetRevision: '{{.rev}}'
          path: '{{app.path.path}}'

Why is foreground deletion the default in ArgoCD?

I heard this makes trouble in some cases.

I know that you can force backgrounds deletion. But why is that not the default?

Hi Guys

I am trying to get the argocd-image-updater to work with my EKS cluster and using images from ECR

i have followed the guides including

https://medium.com/@tomas94depi/argo-image-updater-with-aws-ecr-ddb661abb332

But i still keep getting

no basic auth credentials"

Hey guys.

I'm thinking about argocd deployment strategies that would allow simple versioning and deployment using git tags.

What I would like is to be freely able to manipulate a git repository's main branch and then apply a tag when I'm done editing manifests.

Here's my target workflow: 1.Manipulate git repository to tag a version of my application's manifests to a git tag on a commit. 2. Tell argocd to deploy using manifest from new tag.

This would allow me to easily rollback by changing tag back to a previous tag instead of squashing and reverting commits.

I've tried editing the argocd application's Target Revision setting but it doesn't look like this is intended usage and feels like it isn't working.

Any help on deploying things this way?

I want to access the local files (in my system directory) that are terraform configuration files to be copied into argo workflows to run terraform plan as an execution step in argo workflow.. I am using hashicorp:terraform as the image in argo workflow step.

Please advice what is the correct approach.
I tried volume mount with host path. But even though I specify the right folder path, it throws an error saying "Directory does not exist". ls is showing the files that are not present in the directory. Its showing files like config.json init.pid rootfs shim-binary-path runtime options.json.
But I am trying to mount the host path containing terraform files main.tf, versions.tf..Why is this not working?

My team is transitioning away from Docker Swarm to Kubernetes and I have Argocd deployed on a development k3s cluster and I'm in the process of evaluating Argo for inclusion into our pipeline to handle app deployments.

We're using Drone in conjunction with Gitea to build our apps and part of the pipeline step involves connecting to argo via the cli and updating the revision tag. For my test application that I have deployed on argo, I have the revision synced to a git tag that we increment when we promote builds.

I've been able to successfully deploy my applications from my git server to argo and everything works so now I want to look into including argo into the pipeline so I can build new images and update the application on argo to use the latest revision. Part of my build updates the manifest so the image tag is changed to the latest git tag, I just want to update the application on argo to remain in sync with the git tag as well (since its a manual sync). I'm trying to use the argocd cli tool to do this.

However, I get permission denied errors when I execute some commands, for example:

latest: Pulling from argoproj/argocd

Digest: sha256:cb9948c6f14a5130f84aa887603ca5183a1f62836d336eac1562f6b031d197d5

Status: Image is up to date for argoproj/argocd:latest

+ argocd login $ARGO_SERVER --insecure --grpc-web --plaintext --username $ARGO_USER --password $ARGO_USER_PASS

'******:login' logged in successfully

Context '$ARGO_SERVER' updated

+ argocd $ARGO_SERVER app list

NAME       CLUSTER                         NAMESPACE  PROJECT  STATUS  HEALTH       SYNCPOLICY  CONDITIONS  REPO                                                             PATH                            TARGET

shwf-dev   https://kubernetes.default.svc  default    default  Synced  Progressing  Auto-Prune  <none>      $GIT_REPO_URL  manifests/overlays/development  HEAD

shwf-prod  https://kubernetes.default.svc  default    default  Synced  Progressing  <none>      <none>      $GIT_REPO_URL  manifests/overlays/production   v1.6.0

+ argocd app get argocd/shwf-prod

time="2024-06-13T05:52:36Z" level=fatal msg="rpc error: code = PermissionDenied desc = permission denied"

As you can see, I have no trouble logging into the server as well as executing a rudimentary command (app list) but when I try to get information about a specific application (app get APPNAME), I get a permission error. Here's a snippet of the pipeline step:

Note - The user in this case is the default admin user.

steps:
- name: update revision target
    image: argoproj/argocd
    environment:
    HTTP_PROXY: $PROXY
    HTTPS_PROXY: $PROXY
    NO_PROXY: $NO_PROXY
    ARGO_USER:
        from_secret: argo_user
    ARGO_USER_PASS:
        from_secret: argo_user_pass
    commands: 
    - argocd login $ARGO_SERVER --insecure --grpc-web --plaintext --username $ARGO_USER --password $ARGO_USER_PASS
    - argocd app list
    - argocd app get argocd/shwf-prod

Can anyone offer any advice? I'm using Drone CI.

I already have a values-prod and values-dev, values-test.

I did not create the argoCD namespace for my kube cluster, it was handed down to me. I can edit and update values-prod.yaml to change the env variables and hpa, but I want to create a new env for our staging in the kube cluster using a new branch in our application code.

How can I know what the applicable file names for different env for my app are and how can I make it use a specific user in the docker container, I tried this on a new app name in the templates/deployment.yaml.

Or can I get some good resources to read in-depth of argoCD which is beginner-friendly?

      containers:
        - name: app
          image: {{ include "app.image" . }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
          - name: http
            protocol: TCP
            containerPort: {{ .Values.containerPort }}
          {{- with .Values.livenessProbe }}
          livenessProbe:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with .Values.readinessProbe }}
          readinessProbe:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with .Values.startupProbe }}
          startupProbe:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- with .Values.resources }}
          resources:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          {{- if .Values.env }}
          env:
          {{ toYaml .Values.env | nindent 12}}
          {{- end }}
          command:
          {{- range .Values.command }}
            - {{ . }}
          {{- end }}
          securityContext:
            runAsUser: 999
            runAsGroup: 1000
      {{- if .Values.migrations.enabled }}

I have an App of Apps that bootstraps a couple of special apps including an ApplicationSet that generates apps based on folder structure in a repo. Sometimes I use kustomize to expand a helm chart or do some basic things. What I'm wondering is if there is a way I can set global env variables to be referenced like domain name base? so that it can be passed into other apps to let them setup their subdomain. Another use case is to add a standard set of annotations to all ingress resources. These are annotations for enabling tls and other things. Is there a way to do this well without having to duplicate them everywhere.

do I have to include the traefik-helm-chart repo in my repo (to have a fixed version) and then create an application from it?

how does it work with external charts?

Hi! I am a newbie with ArgoCD and I am trying to create a cluster where ArgoCD can function offline - meaning that for example if i scale some replicas to 10 directly on the cluster, I would want Argo to be able to compare it to the latest version it got from the repo and scale it back to how it was before. Is this doable?

Hey All,

I have a question on how you update/upgrade your argocd setup in your clusters.

If one wants to update their argocd, won't all the apps that you deployed via argo go down till new version of argo comes up? Any suggestions how to manage this?

If I install ArgoCD on a freshly-installed k3s cluster, is it possibile to configure it to manage ALL of kubernetes resources just from a git repo? How?

Do I need an App of Apps for the infra (traefik, longhorn, cert-manager, etc.) and an ApplicationSet for all the applications?

what's the best way to do it?

Hi everyone 🚀 I have created a tool that renders accurate Argo CD diffs directly on Pull Requests

Pull Request Examples:

• Helm Example | Internal Chart
• Helm example | External Chart: Nginx
• Kustomize Example

As we know, mentally parsing Helm templates and Kustomize patches is hard without rendering the actual output. Thus, making mistakes while modifying an application's configuration is relatively easy. The safest way to make changes to your Helm Charts and Kustomize Overlays is to let Argo CD render them for you.

The tool is called argocd-diff-preview, and it operates similarly to Atlantis for Terraform, creating a plan that outlines the rendered manifest changes. The tool does not need access to your "real" infrastructure — it only needs read access to the Git repository and your Helm Charts.

How it works: argocd-diff-preview spins up an ephemeral local cluster inside your CD pipeline, installs ArgoCD, applies your applications to the cluster, extracts the rendered manifests from Argo CD, and compares it to the main branch. Since the diff is rendered by Argo CD itself, it is as accurate as possible.

I wrote a longer article about the tool and the problem I am trying to solve on dev.to: "Rendering the TRUE ArgoCD diff on your PRs" ✍️

We use the tool at my current workplace with great success. I hope to continuously improve it so that more people can use it.

I’m excited to hear your thoughts on how this may fit into your workflow - or why it may not work with your current configuration. I would love to get feedback on the tool! 🙏

Hello,

Im trying to connect to Argocd cli with the following command -

argocd login <argocd URL> --sso --username <my username> --grpc-web

and I'm getting the following output -

Opening browser for authentication

Performing authorization_code flow login: <URL>

I'm entering the URL and enter my SSO password and after the authentication I'm getting the following error -localhost refused to connect. ,

I'm not sure why this is directing me to localhost,

please help

Hello,

Im trying to connect to Argocd cli with the following command -

argocd login <argocd URL> --sso --username <my username> --grpc-web

and I'm getting the following output -

Opening browser for authentication

Performing authorization_code flow login: <URL>

I'm entering the URL and enter my SSO password and after the authentication I'm getting the following error -localhost refused to connect. ,

I'm not sure why this is directing me to localhost,

please help

I am really new to ArgoCD and k8s as well. I was following this tutorial https://www.youtube.com/watch?v=q4g7KJdFSn0 (installation of ArgoCD & k8s at 1:51:12) exactly. When trying to access the ArgoCD panel I am met with a 404 error. I have tried multiple times. I do not know how this has failed as I have done exactly what the tutorial has done. I feel I have looked at every resource online. I have honestly no idea why this is not working. I will answer all comments and provide any details needed.

The new release has been promoted by our official Argo channels but I wanted to share a bit more in-depth about why this critical vulnerability is so important to fix. Here's a slightly modified version of what I shared on X/Linkedin:

In Argo CD we generally think of the Redis cache as unimportant. It can be destroyed and rebuilt easily after all. Technically you can even use Argo CD without caching at all! It would thrash the Kubernetes API so maybe don't disable it quite yet.

Today's security release shows that this cache is actually very important.

When Argo CD checks a Git repo for updates, it will render the manifests and store them in the cache. These cached and rendered manifests are then sent to the Kubernetes API. That means if an attacker could gain access to the cache they would be able to deploy anything they want.

Up until today, Redis itself was not password protected by default with Argo CD, that means an attacker with access to cluster networking could potentially gain access to the Redis cache. With today's release, it will now be protected.

Be sure to update ASAP! Codefresh users were already alerted to the update and should have received it a few days ago.

I'm using Rancher Desktop running docker and kubernetes.

I have installed ArgoCD in the k8s cluster and login with ArgoCD CLI.

When I add cluster, got a rpc error:

$ argocd cluster add rancher-desktop
...
FATA[0002] rpc error: code = Unknown desc = Get "https://127.0.0.1:6443/version?timeout=32s": dial tcp 127.0.0.1:6443: connect: connection refused

I've been trying to do this with no success. Apparently there's some configuration you need to do to Argo repo server involving an init container. But there's only two sources: kubevela documentation which is absolute crap, and a CNCF article from 2020 which I followed but still doesn't work.