Setting Up Argo CD on Kubernetes

Argo CD is a Kubernetes-native, declarative GitOps tool for deploying applications at scale. It pulls application manifests directly from a Git repository and syncs them to a Kubernetes cluster, supports YAML, Kustomize, Jsonnet, and Helm, and ships with a built-in web UI for monitoring sync status and application health. This guide installs Argo CD on a Kubernetes cluster, sets up access to its web UI and CLI, and deploys applications through both a YAML manifest and the Argo CD dashboard. By the end, you'll have Argo CD running behind TLS with two applications deployed and synced through it. Before you begin, you'll need access to a Kubernetes cluster with at least three nodes, a Linux-based local or remote instance to test the Argo CD CLI, the kubectl CLI installed and configured on your local machine, the Helm client installed locally, and a domain name for your Argo CD installation (for example, argo.example.com). 1. Install Argo CD 1. Create a namespace for Argo CD: $ kubectl create namespace argocd 2. Create a new directory for Argo CD in your home directory: $ mkdir ~/argocd 3. Switch to the argocd directory: $ cd ~/argocd 4. Clone the Argo CD Helm repository: $ git clone https://github.com/argoproj/argo-helm.git 5. Navigate to the argo-cd chart directory: $ cd argo-helm/charts/argo-cd/ 6. Update Helm dependencies: $ helm dependency up 7. Install Argo CD into the argocd namespace using Helm: $ helm install argocd . -f values.yaml -n argocd On success, you'll see metadata about the installation: NAME: argocd LAST DEPLOYED: Sun Jun 11 18:13:17 2023 NAMESPACE: argocd STATUS: deployed ... 8. Verify that Argo CD is deployed to the argocd namespace: $ kubectl get pods -n argocd The output should display pods with names starting with argocd-. 9. Check the running services and ports: $ kubectl get services -n argocd Output: NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE ... argocd-server ClusterIP 10.101.247.167 80/TCP,443/TCP 53s The argocd-server service serves the Argo CD UI. 2. Access the Argo CD UI The Argo CD UI isn't reachable from outside the cluster by default. Use port forwarding to expose it locally without exposing the service externally. 1. Extract the default admin password from the argocd-initial-admin-secret secret: $ kubectl get secrets -n argocd argocd-initial-admin-secret -o yaml The encrypted password appears in the output: apiVersion: v1 data: password: TU1DaWRNQVJXNWJ3S1FBNA== kind: Secret ... Copy the encrypted password (TU1DaWRNQVJXNWJ3S1FBNA== above) for decoding. 2. Decode the password: $ echo TU1DaWRNQVJXNWJ3S1FBNA== | base64 --decode 3. Forward port 443 of the argocd-server service to port 8080 on your localhost: $ kubectl port-forward svc/argocd-server -n argocd 8080:443 Output: Forwarding from 127.0.0.1:8080 -> 8080 Forwarding from [::1]:8080 -> 8080 This occupies your current terminal session. 4. Open the Argo CD UI in a browser: http://127.0.0.1:8080 5. Sign in with username admin and the decoded password. You can only access the dashboard while the port forward is active — press Ctrl + C in the terminal to end it. Optional: Access Argo CD Using the CLI Tool Keep the port forward from the previous step active in one terminal, then open a new terminal for the following steps. 1. Download the Argo CD CLI tool: $ wget https://github.com/argoproj/argo-cd/releases/download/v2.7.4/argocd-linux-amd64 This installs version 2.7.4. Check the Assets section of the official releases page for the latest version. 2. Move the binary to /usr/local/bin/: $ sudo mv argocd-linux-amd64 /usr/local/bin/argocd 3. Grant execute permissions: $ sudo chmod +x /usr/local/bin/argocd 4. Log in to the Argo CD server: $ argocd login localhost:8080 Accept the server certificate, then enter username admin and the decoded password: WARNING: server certificate had error: x509: certificate signed by unknown authority. Proceed insecurely (y/n)? y Username: admin Password: On success: 'admin:login' logged in successfully Context 'localhost:8080' updated 5. Change the default admin password: $ argocd account update-password You'll be prompted for your existing password, a new password, and confirmation. 3. Deploy Argo CD Applications You can deploy Argo CD applications via a YAML manifest, the web UI, or the CLI. Creating and Deploying an Application Using a YAML Manifest 1. Create a YAML file for the application: $ nano argocd-app.yaml Add the following: apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: argo-application namespace: argocd spec: project: default source: repoURL: https://gitlab.com/jasmine.harit/argocd-app-config.git targetRevision: HEAD path: dev destination: server: https://kubernetes.default.svc namespace: myapp syncPolicy: syncOptions: - CreateNamespace=true automated: selfHeal: true prune: true Save and close the file. 2. Apply the configuration: $ kubectl apply -f argocd-app.yaml 3. Check the deployment status: $ kubectl get app -n argocd Output: NAME SYNC STATUS HEALTH STATUS argo-application Synced Healthy You can also verify this with the CLI: $ argocd app list Output: NAME CLUSTER NAMESPACE PROJECT STATUS HEALTH SYNCPOLICY CONDITIONS REPO PATH TARGET argocd/argo-application https://kubernetes.default.svc myapp default Synced Healthy Auto-Prune https://gitlab.com/jasmine.harit/argocd-app-config.git dev HEAD 4. Get detailed information about the application: $ argocd app get argo-application Output: Name: argocd/argo-application Project: default Server: https://kubernetes.default.svc Namespace: myapp URL: https://localhost:8080/applications/argo-application Repo: https://gitlab.com/jasmine.harit/argocd-app-config.git Target: HEAD Path: dev SyncWindow: Sync Allowed Sync Policy: Automated (Prune) Sync Status: Synced to HEAD (9c92bf8) Health Status: Healthy GROUP KIND NAMESPACE NAME STATUS HEALTH HOOK MESSAGE Namespace myapp Running Synced namespace/myapp created Service myapp myapp-service Synced Healthy service/myapp-service created apps Deployment myapp myapp1 Synced Healthy deployment.apps/myapp1 created 5. Refresh the web dashboard to see the deployed application. Creating and Deploying an Application via the Dashboard and CLI 1. In the Argo CD UI, click NEW APP to open the Application configuration screen. In GENERAL, define the application name, project, and sync policy. In SOURCE, enter the repository path, revision, and URL — for example, the argocd-example-apps repository with the helm-guestbook application as the path. In DESTINATION, enter your cluster URL and namespace. Click CREATE to deploy the application. 2. Check the application status with the CLI: $ argocd app get guestbook Output: Name: argocd/guestbook Project: default Server: https://kubernetes.default.svc Namespace: argocd URL: https://argocd.example.com/applications/guestbook Repo: https://github.com/argoproj/argocd-example-apps.git Target: HEAD Path: helm-guestbook SyncWindow: Sync Allowed Sync Policy: Sync Status: OutOfSync from HEAD (4773b9f) Health Status: Missing GROUP KIND NAMESPACE NAME STATUS HEALTH HOOK MESSAGE Service argocd guestbook-helm-guestbook OutOfSync Missing apps Deployment argocd guestbook-helm-guestbook OutOfSync Missing The application is deployed but OutOfSync. Sync it with: $ argocd app sync guestbook This fetches the necessary manifests from the repository and applies them using kubectl. 3. On the web dashboard, verify the application's health status and click into it for more details. 4. Secure Argo CD with TLS Encryption Expose the Argo CD server through the Nginx Ingress controller, terminated with TLS. 1. Install the Nginx Ingress controller on your cluster: $ helm install my-ingress-nginx ingress-nginx \ --repo https://kubernetes.github.io/ingress-nginx \ --namespace ingress-nginx --create-namespace This installs the controller into a new ingress-nginx namespace, naming its resources my-ingress-nginx-*. 2. Check the Ingress service to get the load balancer IP address: $ kubectl get services -n ingress-nginx Output: NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE my-ingress-nginx-controller LoadBalancer 10.97.77.219 192.0.2.10 80:31808/TCP,443:30834/TCP 5m50s my-ingress-nginx-controller-admission ClusterIP 10.108.64.48 443/TCP 5m50s Note the EXTERNAL-IP of my-ingress-nginx-controller and create an A DNS record for your domain (e.g., argo.example.com) pointing to it with your DNS provider. It may take a few minutes for EXTERNAL-IP to populate — until then it shows as . 3. Install cert-manager: $ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.2/cert-manager.yaml This installs cert-manager v1.17.2 into the cert-manager namespace. Check the official releases page for the latest version. 4. Create a manifest for an Issuer resource: $ nano issuer.yaml Add the following, replacing admin@example.com with your email address (required for the Issuer to work): apiVersion: cert-manager.io/v1 kind: Issuer metadata: name: tls-certificate-issuer namespace: default spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: admin@example.com privateKeySecretRef: name: letsencrypt-private-key solvers: - http01: ingress: class: nginx Save and exit. 5. Create a manifest for the Ingress resource for the argocd-server service: $ nano ingress.yaml Add the following: apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: ingress-argocd namespace: argocd annotations: cert-manager.io/issuer: tls-certificate-issuer spec: ingressClassName: nginx rules: - host: argo.example.com http: paths: - pathType: Prefix path: "/" backend: service: name: argocd-server port: number: 80 tls: - hosts: - argo.example.com secretName: argocd-tls Save and exit. 6. Check the TLS certificate status: $ kubectl get certificate -n argocd Output: NAME READY SECRET AGE argocd-tls False argocd-tls 5m43s The status changes to True after a short wait. 7. Verify by visiting your domain (https://argo.example.com) in a browser. Next Steps Wire Argo CD into your CI pipeline to trigger automated syncs on every merge. Configure RBAC and SSO (OIDC/SAML) for team access to the Argo CD dashboard. Set up notifications (Slack, email) for sync and health status changes. Explore App-of-Apps and ApplicationSets for managing multiple applications at scale. For the full guide with additional tips, visit the original article on Vultr Docs.