Argo CD applications
Creating and deploying applications on the OpenShift cluster by using the Argo CD dashboard, oc tool, or GitOps CLI
Abstract
Chapter 1. Deploying a Spring Boot application with Argo CD Copy linkLink copied to clipboard!
With Argo CD, you can deploy your applications to the OpenShift Container Platform cluster either by using the Argo CD dashboard or by using the oc tool.
1.1. Creating an application by using the Argo CD dashboard Copy linkLink copied to clipboard!
Argo CD provides a dashboard which allows you to create applications.
Prerequisites
- You have logged in to the OpenShift Container Platform cluster as an administrator.
- You have installed the Red Hat OpenShift GitOps Operator on your OpenShift Container Platform cluster.
- You have logged in to Argo CD instance.
Procedure
- In the Argo CD dashboard, click NEW APP to add a new Argo CD application.
For this workflow, create a spring-petclinic application with the following configurations:
- Application Name
-
spring-petclinic - Project
-
default - Sync Policy
-
Automatic - Repository URL
-
https://github.com/redhat-developer/openshift-gitops-getting-started - Revision
-
HEAD - Path
-
app - Destination
-
https://kubernetes.default.svc - Namespace
-
spring-petclinic
- Click CREATE to create your application.
- Open the Administrator perspective of the web console and expand Administration → Namespaces.
-
Search for and select the namespace, then enter
argocd.argoproj.io/managed-by=openshift-gitopsin the Label field so that the Argo CD instance in theopenshift-gitopsnamespace can manage your namespace.
1.2. Creating an application by using the oc tool Copy linkLink copied to clipboard!
You can create Argo CD applications in your terminal by using the oc tool.
Prerequisites
- You have installed the Red Hat OpenShift GitOps Operator on your OpenShift Container Platform cluster.
- You have logged in to an Argo CD instance.
Procedure
Download the sample application:
git clone git@github.com:redhat-developer/openshift-gitops-getting-started.git
$ git clone git@github.com:redhat-developer/openshift-gitops-getting-started.gitCopy to Clipboard Copied! Toggle word wrap Toggle overflow Create the application:
oc create -f openshift-gitops-getting-started/argo/app.yaml
$ oc create -f openshift-gitops-getting-started/argo/app.yamlCopy to Clipboard Copied! Toggle word wrap Toggle overflow Run the
oc getcommand to review the created application:oc get application -n openshift-gitops
$ oc get application -n openshift-gitopsCopy to Clipboard Copied! Toggle word wrap Toggle overflow Add a label to the namespace your application is deployed in so that the Argo CD instance in the
openshift-gitopsnamespace can manage it:oc label namespace spring-petclinic argocd.argoproj.io/managed-by=openshift-gitops
$ oc label namespace spring-petclinic argocd.argoproj.io/managed-by=openshift-gitopsCopy to Clipboard Copied! Toggle word wrap Toggle overflow
1.3. Verifying Argo CD self-healing behavior Copy linkLink copied to clipboard!
Argo CD constantly monitors the state of deployed applications, detects differences between the specified manifests in Git and live changes in the cluster, and then automatically corrects them. This behavior is referred to as self-healing.
You can test and observe the self-healing behavior in Argo CD.
Prerequisites
- You have installed the Red Hat OpenShift GitOps Operator on your OpenShift Container Platform cluster.
- You have logged in to an Argo CD instance.
-
The sample
app-spring-petclinicapplication is deployed and configured.
Procedure
-
In the Argo CD dashboard, verify that your application has the
Syncedstatus. -
Click the
app-spring-petclinictile in the Argo CD dashboard to view the application resources that are deployed to the cluster. - In the OpenShift Container Platform web console, navigate to the Developer perspective.
Modify the Spring PetClinic deployment and commit the changes to the
app/directory of the Git repository. Argo CD will automatically deploy the changes to the cluster.- Fork the OpenShift GitOps getting started repository.
-
In the
deployment.yamlfile, change thefailureThresholdvalue to5. In the deployment cluster, run the following command to verify the changed value of the
failureThresholdfield:oc edit deployment spring-petclinic -n spring-petclinic
$ oc edit deployment spring-petclinic -n spring-petclinicCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Test the self-healing behavior by modifying the deployment on the cluster and scaling it up to two pods while watching the application in the OpenShift Container Platform web console.
Run the following command to modify the deployment:
oc scale deployment spring-petclinic --replicas 2 -n spring-petclinic
$ oc scale deployment spring-petclinic --replicas 2 -n spring-petclinicCopy to Clipboard Copied! Toggle word wrap Toggle overflow - In the OpenShift Container Platform web console, notice that the deployment scales up to two pods and immediately scales down again to one pod. Argo CD detected a difference from the Git repository and auto-healed the application on the OpenShift Container Platform cluster.
- In the Argo CD dashboard, click the app-spring-petclinic tile → APP DETAILS → EVENTS. The EVENTS tab displays the following events: Argo CD detecting out of sync deployment resources on the cluster and then resyncing the Git repository to correct it.
Chapter 2. Creating an application by using the GitOps CLI Copy linkLink copied to clipboard!
With Argo CD, you can create your applications on an OpenShift Container Platform cluster by using the GitOps argocd CLI.
2.1. Creating an application in the default mode by using the GitOps CLI Copy linkLink copied to clipboard!
You can create applications in the default mode by using the GitOps argocd CLI.
Prerequisites
- You have installed the Red Hat OpenShift GitOps Operator on your OpenShift Container Platform cluster.
-
You have installed the OpenShift CLI (
oc). -
You have installed the Red Hat OpenShift GitOps
argocdCLI. - You have logged in to Argo CD instance.
Procedure
Get the
adminaccount password for the Argo CD server:ADMIN_PASSWD=$(oc get secret openshift-gitops-cluster -n openshift-gitops -o jsonpath='{.data.admin\.password}' | base64 -d)$ ADMIN_PASSWD=$(oc get secret openshift-gitops-cluster -n openshift-gitops -o jsonpath='{.data.admin\.password}' | base64 -d)Copy to Clipboard Copied! Toggle word wrap Toggle overflow Get the Argo CD server URL:
SERVER_URL=$(oc get routes openshift-gitops-server -n openshift-gitops -o jsonpath='{.status.ingress[0].host}')$ SERVER_URL=$(oc get routes openshift-gitops-server -n openshift-gitops -o jsonpath='{.status.ingress[0].host}')Copy to Clipboard Copied! Toggle word wrap Toggle overflow Log in to the Argo CD server by using the
adminaccount password and enclosing it in single quotes:ImportantEnclosing the password in single quotes ensures that special characters, such as
$, are not misinterpreted by the shell. Always use single quotes to enclose the literal value of the password.argocd login --username admin --password ${ADMIN_PASSWD} ${SERVER_URL}$ argocd login --username admin --password ${ADMIN_PASSWD} ${SERVER_URL}Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example
argocd login --username admin --password '<password>' openshift-gitops.openshift-gitops.apps-crc.testing
$ argocd login --username admin --password '<password>' openshift-gitops.openshift-gitops.apps-crc.testingCopy to Clipboard Copied! Toggle word wrap Toggle overflow Verify that you are able to run
argocdcommands in the default mode by listing all applications:argocd app list
$ argocd app listCopy to Clipboard Copied! Toggle word wrap Toggle overflow If the configuration is correct, then existing applications will be listed with the following header:
Sample output
NAME CLUSTER NAMESPACE PROJECT STATUS HEALTH SYNCPOLICY CONDITIONS REPO PATH TARGET
NAME CLUSTER NAMESPACE PROJECT STATUS HEALTH SYNCPOLICY CONDITIONS REPO PATH TARGETCopy to Clipboard Copied! Toggle word wrap Toggle overflow Create an application in the default mode:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Label the
spring-petclinicdestination namespace to be managed by theopenshif-gitopsArgo CD instance:oc label ns spring-petclinic "argocd.argoproj.io/managed-by=openshift-gitops"
$ oc label ns spring-petclinic "argocd.argoproj.io/managed-by=openshift-gitops"Copy to Clipboard Copied! Toggle word wrap Toggle overflow List the available applications to confirm that the application is created successfully and repeat the command until the application has the
HealthyandSyncedstatuses:argocd app list
$ argocd app listCopy to Clipboard Copied! Toggle word wrap Toggle overflow
2.2. Creating an application in core mode by using the GitOps CLI Copy linkLink copied to clipboard!
You can create applications in core mode by using the GitOps argocd CLI.
Prerequisites
- You have installed the Red Hat OpenShift GitOps Operator on your OpenShift Container Platform cluster.
-
You have installed the OpenShift CLI (
oc). -
You have installed the Red Hat OpenShift GitOps
argocdCLI.
Procedure
Log in to the OpenShift Container Platform cluster by using the
ocCLI tool:oc login -u <username> -p <password> <server_url>
$ oc login -u <username> -p <password> <server_url>Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example
oc login -u kubeadmin -p '<password>' https://api.crc.testing:6443
$ oc login -u kubeadmin -p '<password>' https://api.crc.testing:6443Copy to Clipboard Copied! Toggle word wrap Toggle overflow Check whether the context is set correctly in the
kubeconfigfile:oc config current-context
$ oc config current-contextCopy to Clipboard Copied! Toggle word wrap Toggle overflow Set the default namespace of the current context to
openshift-gitops:oc config set-context --current --namespace openshift-gitops
$ oc config set-context --current --namespace openshift-gitopsCopy to Clipboard Copied! Toggle word wrap Toggle overflow Set the following environment variable to override the Argo CD component names:
export ARGOCD_REPO_SERVER_NAME=openshift-gitops-repo-server
$ export ARGOCD_REPO_SERVER_NAME=openshift-gitops-repo-serverCopy to Clipboard Copied! Toggle word wrap Toggle overflow Verify that you are able to run
argocdcommands incoremode by listing all applications:argocd app list --core
$ argocd app list --coreCopy to Clipboard Copied! Toggle word wrap Toggle overflow If the configuration is correct, then existing applications will be listed with the following header:
Sample output
NAME CLUSTER NAMESPACE PROJECT STATUS HEALTH SYNCPOLICY CONDITIONS REPO PATH TARGET
NAME CLUSTER NAMESPACE PROJECT STATUS HEALTH SYNCPOLICY CONDITIONS REPO PATH TARGETCopy to Clipboard Copied! Toggle word wrap Toggle overflow Create an application in
coremode:Copy to Clipboard Copied! Toggle word wrap Toggle overflow Label the
spring-petclinicdestination namespace to be managed by theopenshif-gitopsArgo CD instance:oc label ns spring-petclinic "argocd.argoproj.io/managed-by=openshift-gitops"
$ oc label ns spring-petclinic "argocd.argoproj.io/managed-by=openshift-gitops"Copy to Clipboard Copied! Toggle word wrap Toggle overflow List the available applications to confirm that the application is created successfully and repeat the command until the application has the
HealthyandSyncedstatuses:argocd app list --core
$ argocd app list --coreCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Chapter 3. Managing the application resources in non-control plane namespaces Copy linkLink copied to clipboard!
As a cluster administrator, you can create and manage the Application resources in non-control plane namespaces declaratively other than the openshift-gitops control plane namespace. This functionality is called the Applications in any namespace feature in the Argo CD open source project.
As a developer, if you are creating Argo CD applications in non-control plane namespaces other than the openshift-gitops control plane namespace, ensure that your cluster administrator grants the necessary permissions to them.
Otherwise, after the Argo CD reconciliation, you will see an error message similar to the following example:
Example error message
error while validating and normalizing app: error getting application's project: application 'app' in namespace 'dev' is not allowed to use project 'default'
error while validating and normalizing app: error getting application's project: application 'app' in namespace 'dev' is not allowed to use project 'default'
To use this functionality, you must explicitly enable and configure the target namespaces in the following objects:
-
The
ArgoCDcustom resource (CR) of your user-defined cluster-scoped Argo CD instance -
The
AppProjectcustom resource (CR) -
The
ApplicationCR
The process of creating and managing the Application resources in non-control plane namespaces consists of the following procedures:
-
Configuring the
ArgoCDCR of your user-defined cluster-scoped Argo CD instance with the target namespaces. -
Creating and configuring a user-defined
AppProjectinstance in theopenshift-gitopscontrol plane namespace and specify the target namespaces in the.spec.sourceNamespacesfield of the user-definedAppProjectinstance. -
Configuring the
metadata.namespaceand.spec.projectfields of theApplicationCR to reference the target namespaces and user-definedAppProjectinstance.
This functionality is useful in multitenancy environments when you want to manage deployments of Argo CD applications for your isolated teams.
To prevent privilege escalations for your application teams, you must meet the following requirements:
-
Do not configure non-control plane namespaces in the
.spec.sourceNamespacesfield of any privilegedAppProjectinstance, for example, thedefaultinstance of yourAppProjectCR installed in either theopenshift-gitopscontrol plane namespace or your defined namespace. -
Do not grant access to the
openshift-gitopscontrol plane namespace within theAppProjectCRD. -
Always create and configure user-defined
AppProjectinstances in theopenshift-gitopscontrol plane namespace, and then configure non-control plane namespaces in the.spec.sourceNamespacesfield within the corresponding user-definedAppProjectinstance.
3.1. Prerequisites Copy linkLink copied to clipboard!
- You have installed Red Hat OpenShift GitOps 1.13.0 or a later version on your OpenShift Container Platform cluster.
-
You have a user-defined cluster-scoped Argo CD instance in your defined namespace, for example,
spring-petclinicnamespace.
3.2. Configuring the Argo CD CR of your user-defined cluster-scoped Argo CD instance with the target namespaces Copy linkLink copied to clipboard!
As a cluster administrator, you can define a certain set of non-control plane namespaces in which users can create, update, and reconcile Application resources. You must first explicitly configure the target namespaces in the ArgoCD custom resource (CR) of your user-defined cluster-scoped Argo CD instance per your requirements.
Prerequisites
- You are logged in to the OpenShift Container Platform cluster as an administrator.
- You have installed Red Hat OpenShift GitOps 1.13.0 or a later version on your OpenShift Container Platform cluster.
-
You have a user-defined cluster-scoped Argo CD instance in your defined namespace, for example,
spring-petclinicnamespace.
Procedure
- In the Administrator perspective of the web console, click Operators → Installed Operators.
- From the Project list, select the project where the user-defined cluster-scoped Argo CD instance is installed.
- Select Red Hat OpenShift GitOps from the installed Operators list and go to the Argo CD tab.
- Click your user-defined cluster-scoped Argo CD instance.
Configure the
ArgoCDCR of your user-defined cluster-scoped Argo CD instance with the target namespaces:-
Click the YAML tab and edit the YAML file of the
ArgoCDCR. In the
ArgoCDCR, set the value of thesourceNamespacesparameter to include the non-control plane namespaces:Example
ArgoCDCRCopy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- The name of the user-defined cluster-scoped Argo CD instance.
- 2
- The namespace where you want to run the user-defined cluster-scoped Argo CD instance.
- 3
- The list of non-control plane namespaces for creating and managing
Applicationresources. - 4
- The name of the target namespace for the Argo CD server to create and manage
Applicationresources. - 5
- With wildcards (
*), specifies the name of the target namespaces matching the patternapp-team-*, such asapp-team-1andapp-team-2, for the Argo CD server to create and manageApplicationresources.
Click Save and Reload.
NoteWhen a target namespace is specified under the
sourceNamespacesfield, the Operator adds theargocd.argoproj.io/managed-by-cluster-argocdlabel to the specified namespace.Example
devtarget namespaceCopy to Clipboard Copied! Toggle word wrap Toggle overflow
-
Click the YAML tab and edit the YAML file of the
Verify that Operator adds the
argocd.argoproj.io/managed-by-cluster-argocdlabel to the specified namespace:- Go to Administration → Namespaces and click Create Namespace.
In the Create Namespace dialog box, provide the Name and click Create.
For example, to create
devtarget namespace, enterdevin the Name field. You can repeat the previous steps to create theapp-team-1andapp-team-2target namespaces.The Namespaces page displays the created target namespaces.
-
Click the target namespace and go to the YAML tab to verify the
argocd.argoproj.io/managed-by-cluster-argocdlabel added by the Operator.
Verify that your user-defined cluster-scoped Argo CD instance is configured with a cluster role to manage cluster-scoped resources:
- Go to User Management → Roles and from the Filter list, select Cluster-wide Roles.
Search for the created cluster roles by using the Search by name field. For example,
example-spring-petclinic-argocd-application-controllerandexample-spring-petclinic-argocd-server.The Roles page displays the created cluster roles.
Verify that the following role-based access control (RBAC) resources are created by the GitOps Operator:
Expand Name Kind Purpose <argocd_name>-<argocd_namespace>-argocd-application-controllerClusterRoleandClusterRoleBindingFor the Argo CD Application Controller to watch and list
Applicationresources at cluster-level<argocd_name>-<argocd_namespace>-argocd-serverClusterRoleandClusterRoleBindingFor the Argo CD Server to watch and list
Applicationresources at cluster-level<argocd_name>-<target_namespace>RoleandRoleBindingFor the Argo CD server to manage
Applicationresources in target namespace through the UI, API, or CLI
3.3. Creating and configuring a user-defined AppProject instance with the target namespaces Copy linkLink copied to clipboard!
As a cluster administrator, you can define a certain set of non-control plane namespaces in which users can create, update, and reconcile Application resources. After you configure your user-defined cluster-scoped Argo CD instance with target namespaces, you must create and configure a user-defined AppProject instance in the openshift-gitops control plane namespace. In addition, you must explicitly configure the target namespaces in the .spec.sourceNamespaces field of the user-defined AppProject instance.
Applications in the GitOps control plane namespace (openshift-gitops) are allowed to set their .spec.project field to reference any AppProject instance, regardless of the restrictions placed by the .spec.sourceNamespaces field in the AppProject custom resource (CR).
Prerequisites
- You are logged in to the OpenShift Container Platform cluster as an administrator.
- You have installed Red Hat OpenShift GitOps 1.13.0 or a later version on your OpenShift Container Platform cluster.
Procedure
Create and configure a user-defined
AppProjectinstance in theopenshift-gitopscontrol plane namespace to specify the target namespaces in the.spec.sourceNamespacesfield:-
From the Project list, select the
openshift-gitopsproject. - In the Administrator perspective of the web console, click Operators → Installed Operators → Red Hat OpenShift GitOps and go to the AppProject tab.
Click Create AppProject and enter the following configuration in the YAML view:
Example user-defined
AppProjectinstanceCopy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- The name of the user-defined
AppProjectinstance. - 2
- The control plane namespace where you want to run the user-defined
AppProjectinstance. - 3
- The list of non-control plane namespaces for creating and managing
Applicationresources. - 4
- The name of the target namespace for the Argo CD server to create and manage
Applicationresources. - 5
- With wildcards (
*), specifies the name of the target namespaces matching the patternapp-team-*, such asapp-team-1andapp-team-2, for the Argo CD server to create and manageApplicationresources. - 6
- References to the clusters and namespaces into which applications within the user-defined
AppProjectinstance can deploy. - 7
- References to the repositories from which applications within the user-defined
AppProjectinstance can pull manifests.
Click Create.
The AppProjects page displays the created user-defined
AppProjectinstance.
-
From the Project list, select the
3.4. Creating and configuring the Application CR to reference the target namespace and user-defined AppProject instance Copy linkLink copied to clipboard!
As a cluster administrator, you can define a certain set of non-control plane namespaces in which users can create, update, and reconcile Application resources. After you configure the target namespaces in the .spec.sourceNamespaces field of the user-defined AppProject instance, you must explicitly create and configure the Application custom resource (CR) with the parameters for the metadata.namespace and .spec.project fields to reference the target namespace and user-defined AppProject instance.
Prerequisites
- You are logged in to the OpenShift Container Platform cluster as an administrator.
- You have installed Red Hat OpenShift GitOps 1.13.0 or a later version on your OpenShift Container Platform cluster.
Procedure
Create and configure the
ApplicationCR with the parameters for themetadata.namespaceand.spec.projectfields to reference the target namespace and user-definedAppProjectinstance:- From the Project list, select the target namespace.
- In the Administrator perspective of the web console, click Operators → Installed Operators → Red Hat OpenShift GitOps and go to the Application tab.
Click Create Application and enter the following configuration in the YAML view:
Example user-defined
AppProjectinstanceCopy to Clipboard Copied! Toggle word wrap Toggle overflow Click Create.
The Applications page displays the created application.
The
cluster-configsArgo CD application now has the statuses Healthy and Synced.