Argo CD

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

kubectl get pods -n argocd

helm repo add argo https://argoproj.github.io/argo-helm
helm repo update
helm install argocd argo/argo-cd \
  --namespace argocd \
  --create-namespace \
  --set server.service.type=LoadBalancer

# Linux
curl -sSL -o argocd https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
chmod +x argocd
sudo mv argocd /usr/local/bin/

kubectl port-forward svc/argocd-server -n argocd 8080:443

argocd admin initial-password -n argocd

argocd login localhost:8080
argocd account update-password

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: <app-name>
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/<org>/<repo>.git
    path: <manifest-path>
    targetRevision: HEAD
  destination:
    server: https://kubernetes.default.svc
    namespace: <target-namespace>
  syncPolicy:
    automated:
      selfHeal: true
      prune: true
    syncOptions:
    - CreateNamespace=true

kubectl apply -n argocd -f <app-name>.yaml

argocd app create <app-name> \
  --repo https://github.com/<org>/<repo>.git \
  --path <manifest-path> \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace <target-namespace> \
  --sync-policy automated \
  --self-heal \
  --auto-prune

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: <app-name>
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://charts.example.com
    chart: <chart-name>
    targetRevision: <chart-version>
    helm:
      releaseName: <release-name>
      valuesObject:
        replicaCount: 3
        image:
          tag: latest
  destination:
    server: https://kubernetes.default.svc
    namespace: <target-namespace>

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: <appset-name>
  namespace: argocd
spec:
  generators:
  - clusters:
      selector:
        matchLabels:
          env: production
  template:
    metadata:
      name: '{{name}}-<app-name>'
    spec:
      project: default
      source:
        repoURL: https://github.com/<org>/<repo>.git
        path: <manifest-path>
        targetRevision: HEAD
      destination:
        server: '{{server}}'
        namespace: <target-namespace>

syncOptions:
- CreateNamespace=true
- PrunePropagationPolicy=foreground
- PruneLast=true
- ApplyOutOfSyncOnly=true
- ServerSideApply=true
- RespectIgnoreDifferences=true

metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "1"

apiVersion: batch/v1
kind: Job
metadata:
  name: db-migrate
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  template:
    spec:
      containers:
      - name: migrate
        image: <migration-image>
        command: ["./migrate.sh"]
      restartPolicy: Never

spec:
  ignoreDifferences:
  - group: apps
    kind: Deployment
    jsonPointers:
    - /spec/replicas
  - group: "*"
    kind: "*"
    managedFieldsManagers:
    - kube-controller-manager

# List available contexts
kubectl config get-contexts

# Add a cluster to Argo CD
argocd cluster add <context-name>

apiVersion: v1
kind: Secret
metadata:
  name: <cluster-name>
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: cluster
type: Opaque
stringData:
  name: <cluster-display-name>
  server: https://<cluster-api-endpoint>
  config: |
    {
      "bearerToken": "<service-account-token>",
      "tlsClientConfig": {
        "insecure": false,
        "caData": "<base64-ca-cert>"
      }
    }

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: <project-name>
  namespace: argocd
spec:
  description: <project-description>
  sourceRepos:
  - https://github.com/<org>/*
  destinations:
  - namespace: '<target-namespace>'
    server: https://kubernetes.default.svc
  clusterResourceWhitelist:
  - group: ''
    kind: Namespace
  namespaceResourceBlacklist:
  - group: ''
    kind: ResourceQuota
  roles:
  - name: <role-name>
    description: <role-description>
    policies:
    - p, proj:<project-name>:<role-name>, applications, get, <project-name>/*, allow
    - p, proj:<project-name>:<role-name>, applications, sync, <project-name>/*, allow

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.default: role:readonly
  policy.csv: |
    p, role:dev, applications, get, */*, allow
    p, role:dev, applications, sync, */*, allow
    p, role:dev, applications, action/*, */*, allow
    p, role:ops, applications, *, */*, allow
    p, role:ops, clusters, get, *, allow
    g, dev-team, role:dev
    g, ops-team, role:ops

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  url: https://<argocd-hostname>
  oidc.config: |
    name: <provider-name>
    issuer: https://<oidc-issuer-url>
    clientID: <client-id>
    clientSecret: $oidc.clientSecret
    requestedScopes:
    - openid
    - profile
    - email
    - groups

apiVersion: v1
kind: Secret
metadata:
  name: argocd-secret
  namespace: argocd
stringData:
  oidc.clientSecret: <client-secret>

kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj-labs/argocd-notifications/release-1.2/manifests/install.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-notifications-cm
  namespace: argocd
data:
  service.slack: |
    token: $slack-token
  service.webhook.teams: |
    url: https://outlook.office.com/webhook/<webhook-path>
    headers:
    - name: Content-Type
      value: application/json
  service.email: |
    host: <smtp-host>
    port: 587
    from: argocd@<domain>
    username: $email-username
    password: $email-password

data:
  template.app-sync-succeeded: |
    message: |
      Application {{.app.metadata.name}} sync succeeded.
      Revision: {{.app.status.sync.revision}}
    slack:
      attachments: |
        [{
          "color": "#18be52",
          "title": "{{.app.metadata.name}} synced",
          "text": "Revision: {{.app.status.sync.revision}}"
        }]
  trigger.on-sync-succeeded: |
    - when: app.status.operationState.phase in ['Succeeded']
      send: [app-sync-succeeded]
  trigger.on-health-degraded: |
    - when: app.status.health.status == 'Degraded'
      send: [app-health-degraded]

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  annotations:
    notifications.argoproj.io/subscribe.on-sync-succeeded.slack: <channel-name>
    notifications.argoproj.io/subscribe.on-health-degraded.email: <email-address>