Argo CD applications
Creating and deploying applications on the OpenShift cluster by using the Argo CD dashboard, oc tool, or GitOps CLI
Abstract
Chapter 1. Deploying a Spring Boot application with Argo CD
With Argo CD, you can deploy your applications to the OpenShift Container Platform cluster either by using the Argo CD dashboard or by using the oc
tool.
1.1. Creating an application by using the Argo CD dashboard
Argo CD provides a dashboard which allows you to create applications.
Prerequisites
- You have logged in to the OpenShift Container Platform cluster as an administrator.
- You have installed the Red Hat OpenShift GitOps Operator on your OpenShift Container Platform cluster.
- You have logged in to Argo CD instance.
Procedure
- In the Argo CD dashboard, click NEW APP to add a new Argo CD application.
For this workflow, create a spring-petclinic application with the following configurations:
- Application Name
-
spring-petclinic
- Project
-
default
- Sync Policy
-
Automatic
- Repository URL
-
https://github.com/redhat-developer/openshift-gitops-getting-started
- Revision
-
HEAD
- Path
-
app
- Destination
-
https://kubernetes.default.svc
- Namespace
-
spring-petclinic
- Click CREATE to create your application.
- Open the Administrator perspective of the web console and expand Administration → Namespaces.
-
Search for and select the namespace, then enter
argocd.argoproj.io/managed-by=openshift-gitops
in the Label field so that the Argo CD instance in theopenshift-gitops
namespace can manage your namespace.
1.2. Creating an application by using the oc
tool
You can create Argo CD applications in your terminal by using the oc
tool.
Prerequisites
- You have installed the Red Hat OpenShift GitOps Operator on your OpenShift Container Platform cluster.
- You have logged in to an Argo CD instance.
Procedure
Download the sample application:
$ git clone git@github.com:redhat-developer/openshift-gitops-getting-started.git
Create the application:
$ oc create -f openshift-gitops-getting-started/argo/app.yaml
Run the
oc get
command to review the created application:$ oc get application -n openshift-gitops
Add a label to the namespace your application is deployed in so that the Argo CD instance in the
openshift-gitops
namespace can manage it:$ oc label namespace spring-petclinic argocd.argoproj.io/managed-by=openshift-gitops
1.3. Verifying Argo CD self-healing behavior
Argo CD constantly monitors the state of deployed applications, detects differences between the specified manifests in Git and live changes in the cluster, and then automatically corrects them. This behavior is referred to as self-healing.
You can test and observe the self-healing behavior in Argo CD.
Prerequisites
- You have installed the Red Hat OpenShift GitOps Operator on your OpenShift Container Platform cluster.
- You have logged in to an Argo CD instance.
-
The sample
app-spring-petclinic
application is deployed and configured.
Procedure
-
In the Argo CD dashboard, verify that your application has the
Synced
status. -
Click the
app-spring-petclinic
tile in the Argo CD dashboard to view the application resources that are deployed to the cluster. - In the OpenShift Container Platform web console, navigate to the Developer perspective.
Modify the Spring PetClinic deployment and commit the changes to the
app/
directory of the Git repository. Argo CD will automatically deploy the changes to the cluster.- Fork the OpenShift GitOps getting started repository.
-
In the
deployment.yaml
file, change thefailureThreshold
value to5
. In the deployment cluster, run the following command to verify the changed value of the
failureThreshold
field:$ oc edit deployment spring-petclinic -n spring-petclinic
Test the self-healing behavior by modifying the deployment on the cluster and scaling it up to two pods while watching the application in the OpenShift Container Platform web console.
Run the following command to modify the deployment:
$ oc scale deployment spring-petclinic --replicas 2 -n spring-petclinic
- In the OpenShift Container Platform web console, notice that the deployment scales up to two pods and immediately scales down again to one pod. Argo CD detected a difference from the Git repository and auto-healed the application on the OpenShift Container Platform cluster.
- In the Argo CD dashboard, click the app-spring-petclinic tile → APP DETAILS → EVENTS. The EVENTS tab displays the following events: Argo CD detecting out of sync deployment resources on the cluster and then resyncing the Git repository to correct it.
Chapter 2. Creating an application by using the GitOps CLI
With Argo CD, you can create your applications on an OpenShift Container Platform cluster by using the GitOps argocd
CLI.
2.1. Creating an application in the default mode by using the GitOps CLI
You can create applications in the default mode by using the GitOps argocd
CLI.
Prerequisites
- You have installed the Red Hat OpenShift GitOps Operator on your OpenShift Container Platform cluster.
-
You have installed the OpenShift CLI (
oc
). -
You have installed the Red Hat OpenShift GitOps
argocd
CLI. - You have logged in to Argo CD instance.
Procedure
Get the
admin
account password for the Argo CD server:$ ADMIN_PASSWD=$(oc get secret openshift-gitops-cluster -n openshift-gitops -o jsonpath='{.data.admin\.password}' | base64 -d)
Get the Argo CD server URL:
$ SERVER_URL=$(oc get routes openshift-gitops-server -n openshift-gitops -o jsonpath='{.status.ingress[0].host}')
Log in to the Argo CD server by using the
admin
account password and enclosing it in single quotes:ImportantEnclosing the password in single quotes ensures that special characters, such as
$
, are not misinterpreted by the shell. Always use single quotes to enclose the literal value of the password.$ argocd login --username admin --password ${ADMIN_PASSWD} ${SERVER_URL}
Example
$ argocd login --username admin --password '<password>' openshift-gitops.openshift-gitops.apps-crc.testing
Verify that you are able to run
argocd
commands in the default mode by listing all applications:$ argocd app list
If the configuration is correct, then existing applications will be listed with the following header:
Sample output
NAME CLUSTER NAMESPACE PROJECT STATUS HEALTH SYNCPOLICY CONDITIONS REPO PATH TARGET
Create an application in the default mode:
$ argocd app create app-spring-petclinic \ --repo https://github.com/redhat-developer/openshift-gitops-getting-started.git \ --path app \ --revision main \ --dest-server https://kubernetes.default.svc \ --dest-namespace spring-petclinic \ --directory-recurse \ --sync-policy automated \ --self-heal \ --sync-option Prune=true \ --sync-option CreateNamespace=true
Label the
spring-petclinic
destination namespace to be managed by theopenshif-gitops
Argo CD instance:$ oc label ns spring-petclinic "argocd.argoproj.io/managed-by=openshift-gitops"
List the available applications to confirm that the application is created successfully and repeat the command until the application has the
Healthy
andSynced
statuses:$ argocd app list
2.2. Creating an application in core mode by using the GitOps CLI
You can create applications in core
mode by using the GitOps argocd
CLI.
Prerequisites
- You have installed the Red Hat OpenShift GitOps Operator on your OpenShift Container Platform cluster.
-
You have installed the OpenShift CLI (
oc
). -
You have installed the Red Hat OpenShift GitOps
argocd
CLI.
Procedure
Log in to the OpenShift Container Platform cluster by using the
oc
CLI tool:$ oc login -u <username> -p <password> <server_url>
Example
$ oc login -u kubeadmin -p '<password>' https://api.crc.testing:6443
Check whether the context is set correctly in the
kubeconfig
file:$ oc config current-context
Set the default namespace of the current context to
openshift-gitops
:$ oc config set-context --current --namespace openshift-gitops
Set the following environment variable to override the Argo CD component names:
$ export ARGOCD_REPO_SERVER_NAME=openshift-gitops-repo-server
Verify that you are able to run
argocd
commands incore
mode by listing all applications:$ argocd app list --core
If the configuration is correct, then existing applications will be listed with the following header:
Sample output
NAME CLUSTER NAMESPACE PROJECT STATUS HEALTH SYNCPOLICY CONDITIONS REPO PATH TARGET
Create an application in
core
mode:$ argocd app create app-spring-petclinic --core \ --repo https://github.com/redhat-developer/openshift-gitops-getting-started.git \ --path app \ --revision main \ --dest-server https://kubernetes.default.svc \ --dest-namespace spring-petclinic \ --directory-recurse \ --sync-policy automated \ --self-heal \ --sync-option Prune=true \ --sync-option CreateNamespace=true
Label the
spring-petclinic
destination namespace to be managed by theopenshif-gitops
Argo CD instance:$ oc label ns spring-petclinic "argocd.argoproj.io/managed-by=openshift-gitops"
List the available applications to confirm that the application is created successfully and repeat the command until the application has the
Healthy
andSynced
statuses:$ argocd app list --core
2.3. Additional resources
Chapter 3. Managing the application resources in non-control plane namespaces
As a cluster administrator, you can create and manage the Application
resources in non-control plane namespaces declaratively other than the openshift-gitops
control plane namespace. This functionality is called the Applications in any namespace feature in the Argo CD open source project.
As a developer, if you are creating Argo CD applications in non-control plane namespaces other than the openshift-gitops
control plane namespace, ensure that your cluster administrator grants the necessary permissions to them.
Otherwise, after the Argo CD reconciliation, you will see an error message similar to the following example:
Example error message
error while validating and normalizing app: error getting application's project: application 'app' in namespace 'dev' is not allowed to use project 'default'
To use this functionality, you must explicitly enable and configure the target namespaces in the following objects:
-
The
ArgoCD
custom resource (CR) of your user-defined cluster-scoped Argo CD instance -
The
AppProject
custom resource (CR) -
The
Application
CR
The process of creating and managing the Application
resources in non-control plane namespaces consists of the following procedures:
-
Configuring the
ArgoCD
CR of your user-defined cluster-scoped Argo CD instance with the target namespaces. -
Creating and configuring a user-defined
AppProject
instance in theopenshift-gitops
control plane namespace and specify the target namespaces in the.spec.sourceNamespaces
field of the user-definedAppProject
instance. -
Configuring the
metadata.namespace
and.spec.project
fields of theApplication
CR to reference the target namespaces and user-definedAppProject
instance.
This functionality is useful in multitenancy environments when you want to manage deployments of Argo CD applications for your isolated teams.
To prevent privilege escalations for your application teams, you must meet the following requirements:
-
Do not configure non-control plane namespaces in the
.spec.sourceNamespaces
field of any privilegedAppProject
instance, for example, thedefault
instance of yourAppProject
CR installed in either theopenshift-gitops
control plane namespace or your defined namespace. -
Do not grant access to the
openshift-gitops
control plane namespace within theAppProject
CRD. -
Always create and configure user-defined
AppProject
instances in theopenshift-gitops
control plane namespace, and then configure non-control plane namespaces in the.spec.sourceNamespaces
field within the corresponding user-definedAppProject
instance.
3.1. Prerequisites
- You have installed Red Hat OpenShift GitOps 1.13.0 or a later version on your OpenShift Container Platform cluster.
-
You have a user-defined cluster-scoped Argo CD instance in your defined namespace, for example,
spring-petclinic
namespace.
3.2. Configuring the Argo CD CR of your user-defined cluster-scoped Argo CD instance with the target namespaces
As a cluster administrator, you can define a certain set of non-control plane namespaces in which users can create, update, and reconcile Application
resources. You must first explicitly configure the target namespaces in the ArgoCD
custom resource (CR) of your user-defined cluster-scoped Argo CD instance per your requirements.
Prerequisites
- You are logged in to the OpenShift Container Platform cluster as an administrator.
- You have installed Red Hat OpenShift GitOps 1.13.0 or a later version on your OpenShift Container Platform cluster.
-
You have a user-defined cluster-scoped Argo CD instance in your defined namespace, for example,
spring-petclinic
namespace.
Procedure
- In the Administrator perspective of the web console, click Operators → Installed Operators.
- From the Project list, select the project where the user-defined cluster-scoped Argo CD instance is installed.
- Select Red Hat OpenShift GitOps from the installed Operators list and go to the Argo CD tab.
- Click your user-defined cluster-scoped Argo CD instance.
Configure the
ArgoCD
CR of your user-defined cluster-scoped Argo CD instance with the target namespaces:-
Click the YAML tab and edit the YAML file of the
ArgoCD
CR. In the
ArgoCD
CR, set the value of thesourceNamespaces
parameter to include the non-control plane namespaces:Example
ArgoCD
CRapiVersion: argoproj.io/v1beta1 kind: ArgoCD metadata: name: example 1 namespace: spring-petclinic 2 spec: sourceNamespaces: 3 - dev 4 - app-team-* 5
- 1
- The name of the user-defined cluster-scoped Argo CD instance.
- 2
- The namespace where you want to run the user-defined cluster-scoped Argo CD instance.
- 3
- The list of non-control plane namespaces for creating and managing
Application
resources. - 4
- The name of the target namespace for the Argo CD server to create and manage
Application
resources. - 5
- With wildcards (
*
), specifies the name of the target namespaces matching the patternapp-team-*
, such asapp-team-1
andapp-team-2
, for the Argo CD server to create and manageApplication
resources.
Click Save and Reload.
NoteWhen a target namespace is specified under the
sourceNamespaces
field, the Operator adds theargocd.argoproj.io/managed-by-cluster-argocd
label to the specified namespace.Example
dev
target namespaceapiVersion: v1 kind: Namespace metadata: name: dev labels: argocd.argoproj.io/managed-by-cluster-argocd: spring-petclinic 1 kubernetes.io/metadata.name: dev 2
-
Click the YAML tab and edit the YAML file of the
Verify that Operator adds the
argocd.argoproj.io/managed-by-cluster-argocd
label to the specified namespace:- Go to Administration → Namespaces and click Create Namespace.
In the Create Namespace dialog box, provide the Name and click Create.
For example, to create
dev
target namespace, enterdev
in the Name field. You can repeat the previous steps to create theapp-team-1
andapp-team-2
target namespaces.The Namespaces page displays the created target namespaces.
-
Click the target namespace and go to the YAML tab to verify the
argocd.argoproj.io/managed-by-cluster-argocd
label added by the Operator.
Verify that your user-defined cluster-scoped Argo CD instance is configured with a cluster role to manage cluster-scoped resources:
- Go to User Management → Roles and from the Filter list, select Cluster-wide Roles.
Search for the created cluster roles by using the Search by name field. For example,
example-spring-petclinic-argocd-application-controller
andexample-spring-petclinic-argocd-server
.The Roles page displays the created cluster roles.
Verify that the following role-based access control (RBAC) resources are created by the GitOps Operator:
Name Kind Purpose <argocd_name>-<argocd_namespace>-argocd-application-controller
ClusterRole
andClusterRoleBinding
For the Argo CD Application Controller to watch and list
Application
resources at cluster-level<argocd_name>-<argocd_namespace>-argocd-server
ClusterRole
andClusterRoleBinding
For the Argo CD Server to watch and list
Application
resources at cluster-level<argocd_name>-<target_namespace>
Role
andRoleBinding
For the Argo CD server to manage
Application
resources in target namespace through the UI, API, or CLI
Additional resources
3.3. Creating and configuring a user-defined AppProject instance with the target namespaces
As a cluster administrator, you can define a certain set of non-control plane namespaces in which users can create, update, and reconcile Application
resources. After you configure your user-defined cluster-scoped Argo CD instance with target namespaces, you must create and configure a user-defined AppProject
instance in the openshift-gitops
control plane namespace. In addition, you must explicitly configure the target namespaces in the .spec.sourceNamespaces
field of the user-defined AppProject
instance.
Applications in the GitOps control plane namespace (openshift-gitops
) are allowed to set their .spec.project
field to reference any AppProject
instance, regardless of the restrictions placed by the .spec.sourceNamespaces
field in the AppProject
custom resource (CR).
Prerequisites
- You are logged in to the OpenShift Container Platform cluster as an administrator.
- You have installed Red Hat OpenShift GitOps 1.13.0 or a later version on your OpenShift Container Platform cluster.
Procedure
Create and configure a user-defined
AppProject
instance in theopenshift-gitops
control plane namespace to specify the target namespaces in the.spec.sourceNamespaces
field:-
From the Project list, select the
openshift-gitops
project. - In the Administrator perspective of the web console, click Operators → Installed Operators → Red Hat OpenShift GitOps and go to the AppProject tab.
Click Create AppProject and enter the following configuration in the YAML view:
Example user-defined
AppProject
instancekind: AppProject apiVersion: argoproj.io/v1alpha1 metadata: name: project-one 1 namespace: openshift-gitops 2 spec: sourceNamespaces: 3 - dev 4 - app-team-* 5 destinations: 6 - name: '*' namespace: '*' server: '*' sourceRepos: 7 - '*'
- 1
- The name of the user-defined
AppProject
instance. - 2
- The control plane namespace where you want to run the user-defined
AppProject
instance. - 3
- The list of non-control plane namespaces for creating and managing
Application
resources. - 4
- The name of the target namespace for the Argo CD server to create and manage
Application
resources. - 5
- With wildcards (
*
), specifies the name of the target namespaces matching the patternapp-team-*
, such asapp-team-1
andapp-team-2
, for the Argo CD server to create and manageApplication
resources. - 6
- References to the clusters and namespaces into which applications within the user-defined
AppProject
instance can deploy. - 7
- References to the repositories from which applications within the user-defined
AppProject
instance can pull manifests.
Click Create.
The AppProjects page displays the created user-defined
AppProject
instance.
-
From the Project list, select the
3.4. Creating and configuring the Application CR to reference the target namespace and user-defined AppProject instance
As a cluster administrator, you can define a certain set of non-control plane namespaces in which users can create, update, and reconcile Application
resources. After you configure the target namespaces in the .spec.sourceNamespaces
field of the user-defined AppProject
instance, you must explicitly create and configure the Application
custom resource (CR) with the parameters for the metadata.namespace
and .spec.project
fields to reference the target namespace and user-defined AppProject
instance.
Prerequisites
- You are logged in to the OpenShift Container Platform cluster as an administrator.
- You have installed Red Hat OpenShift GitOps 1.13.0 or a later version on your OpenShift Container Platform cluster.
Procedure
Create and configure the
Application
CR with the parameters for themetadata.namespace
and.spec.project
fields to reference the target namespace and user-definedAppProject
instance:- From the Project list, select the target namespace.
- In the Administrator perspective of the web console, click Operators → Installed Operators → Red Hat OpenShift GitOps and go to the Application tab.
Click Create Application and enter the following configuration in the YAML view:
Example user-defined
AppProject
instancekind: Application apiVersion: argoproj.io/v1alpha1 metadata: name: cluster-configs 1 namespace: dev 2 spec: project: project-one 3 # ...
Click Create.
The Applications page displays the created application.
The
cluster-configs
Argo CD application now has the statuses Healthy and Synced.