1장. Setting up an Argo CD instance


By default, Red Hat OpenShift GitOps installs an instance of Argo CD in the openshift-gitops namespace with additional permissions for managing certain cluster-scoped resources. This default Argo CD instance is also called as the default cluster-scoped instance.

To prevent the default Argo CD instance from starting in the openshift-gitops namespace, you can use the openshift-gitops-operator subscription and configure the DISABLE_DEFAULT_ARGOCD_INSTANCE environment variable in it by setting the string value to "true".

참고

For GitOps version 1.13 and later:

  • The default Route TLS termination mode is reencrypt for both default and user-defined Argo CD instances. TLS connections to Argo CD instances now use the default ingress certificate configured in OpenShift Container Platform instead of the self-signed Argo CD certificate. To change the route TLS termination policy, configure the .spec.server.route.tls field in the Argo CD CR.
  • Restricted pod security admission (PSA) labels are applied to the openshift-gitops namespace to ensure compliance with OpenShift Container Platform standards. If you are running additional workloads in this namespace, such as monitoring or logging, ensure that they comply with the restricted PSA requirements. If compliance is not feasible, consider using a user-defined, cluster-scoped Argo CD instance, where PSA labels are not applied or controlled by the GitOps Operator.

To manage cluster configurations or deploy applications, you can install and deploy a new user-defined Argo CD instance. By default, any new user-defined instance has permissions to manage resources only in the namespace where it is deployed.

주의
  • A Kubernetes user with access to the Argo CD namespace is an Argo CD administrator and can bypass any role-based access control (RBAC) restrictions configured in Argo CD. Never grant non-administrator users any read or write access to the Argo CD namespace.
  • If non-administrator users create applications, do not allow them to bind to the default AppProject custom resource (CR) because it has no restrictions. Otherwise, the Kubernetes permissions of the Argo CD instance and the default AppProject CR can allow deployment of anything to any location. To avoid this risk, lock down the default AppProject CR so no one can use it by mistake, even if the Argo CD RBAC is misconfigured.

You can create a user-defined Argo CD instance in any namespace, other than the openshift-gitops namespace.

중요

If you want to create a user-defined Argo CD instance within the openshift-gitops namespace, set the DISABLE_DEFAULT_ARGOCD_INSTANCE flag value in the openshift-gitops-operator subscription to "true" and do not name the instance as openshift-gitops.

1.1. Installing a user-defined Argo CD instance

To manage cluster configurations or deploy applications, you can install and deploy a new user-defined Argo CD instance.

Prerequisites

  • You have access to the cluster with cluster-admin privileges.
  • You have installed the Red Hat OpenShift GitOps Operator on your OpenShift Container Platform cluster.

Procedure

  1. Log in to the OpenShift Container Platform web console.
  2. In the Administrator perspective of the web console, click Operators Installed Operators.
  3. Create or select the project where you want to install the user-defined Argo CD instance from the Project list.
  4. Select Red Hat OpenShift GitOps from the installed Operators list and click the Argo CD tab.
  5. Click Create ArgoCD to configure the parameters:

    1. Enter the Name of the instance. By default, the Name is set to example.
    2. Create an external operating system Route to access Argo CD server. Click Server Route and check Enabled.

      작은 정보

      You can alternatively configure YAML to create an external OS Route as shown in the following example:

      Example Argo CD with external OS route created:

      apiVersion: argoproj.io/v1beta1
      kind: ArgoCD
      metadata:
        name: example
        namespace: openshift-gitops
      spec:
        server:
          route:
            enabled: true
    3. Optional: Change the route TLS termination policy by configuring the .spec.server.route.tls field of the Argo CD CR.

      참고

      When configuring custom TLS certificates for Argo CD Server route, avoid using the .spec.server.route.tls.key and .spec.server.route.tls.certificate fields. Use the .spec.server.route.tls.externalCertificate field instead. For more information about configuring a route for custom TLS certificate, see examples in Custom TLS certificates for Routes.

  6. Click Create.
  7. Go to Networking Routes <instance_name>-server in the project where the user-defined Argo CD instance is installed.
  8. On the Details tab, click the Argo CD web UI link under Route details Location. The Argo CD web UI opens in a separate browser window.
  9. Optional: To log in with your OpenShift Container Platform credentials, ensure you are a user of the cluster-admins group and then select the LOG IN VIA OPENSHIFT option in the Argo CD user interface.

    참고

    To be a user of the cluster-admins group, use the oc adm groups new cluster-admins <user> command, where <user> is the default cluster role that you can bind to users and groups cluster-wide or locally.

  10. Obtain the password for the user-defined Argo CD instance:

    1. Use the navigation panel to go to the Workloads Secrets page.
    2. Use the Project list and select the namespace where the user-defined Argo CD instance is created.
    3. Select the <argo_CD_instance_name>-cluster instance to display the password.
    4. On the Details tab, copy the password under Data admin.password.
  11. Use admin as the Username and the copied password as the Password to log in to the Argo CD UI in the new window.
Red Hat logoGithubRedditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 문서 정보

Legal Notice

Theme

© 2026 Red Hat
맨 위로 이동