Skip to content

Argo CD

Big Bang deploys Argo CD as a GitOps control plane in the argocd namespace. This package wraps the upstream argo-cd Helm chart, adds the argocd-apps chart, a Big Bang Redis option, and Big Bang integration resources. For Argo CD concepts, application workflows, and product operations, use the upstream documentation.

Configure through Big Bang

Enable Argo CD with the canonical umbrella key addons.argocd. The legacy argocd key remains supported for compatibility; use the canonical key for new configuration. The umbrella owns package source and release wiring, global SSO, external Redis connection details, and release ordering. This repository owns package defaults and Big Bang resources consumed by that release.

Use addons.argocd.values to pass package values. The package values file exposes Big Bang-specific settings and selected upstream overrides. Configure other upstream options beneath upstream; see the versioned upstream chart values for the complete configuration surface.

addons:
  argocd:
    enabled: true
    values:
      upstream: {}

Access and URL

The package creates a Big Bang route to argocd.<domain> by default. Select a Big Bang Istio gateway with addons.argocd.ingress.gateway, or override the package route through addons.argocd.values.routes. If changing the externally visible host, keep the Argo CD upstream global.domain and any SSO redirect configuration aligned with that address. Consult the upstream ingress documentation for Argo CD-specific ingress settings.

SSO and authorization

When addons.argocd.sso.enabled is true, the umbrella maps its configured OIDC issuer, client ID, client secret, optional CA, and addons.argocd.sso.groups into Argo CD’s OIDC and RBAC configuration. The groups value is Argo CD RBAC policy CSV, so grant only the roles required for the identities it maps. Keep client secrets in the umbrella’s secret-management path rather than committing them to package values.

Argo CD projects, applications, ApplicationSets, repository credentials, and sync permissions define access to managed workloads. Manage their policy and repository access as privileged GitOps control-plane configuration. The argocd-apps values (applications, projects, and applicationsets) are available for package-managed resources; deployment-specific workload topology and repository credentials remain consumer-owned. See the upstream RBAC documentation and project documentation for their configuration and authorization semantics.

Redis

By default, the package enables its maintained redis-bb subchart and disables the upstream Redis deployment. Supplying addons.argocd.redis.host selects an external Redis backend and passes its host and port to Argo CD; the umbrella also supplies the corresponding route and network integration. Coordinate availability, authentication, persistence, monitoring, and network access with the external Redis owner before changing this selection.

Monitoring, mesh, and network policy

When Big Bang metric scraping is enabled, the package enables Argo CD and Redis metrics integration and configures ServiceMonitors for the Argo CD server, repository server, application controller, and packaged Redis. The umbrella orders Argo CD after monitoring when monitoring is enabled.

The package can add Istio resources, route traffic to the Argo CD server, and apply Big Bang network policies. Its default policy permits Prometheus metric scrapes, Grafana access to packaged Redis, Kubernetes API access for the Argo CD components that require it, and HTTPS egress from the repository server for external Git repositories. Network policies and mesh settings can affect UI, repository, cluster, metrics, and tracing traffic; render and test the selected mode before relying on it in an environment.

The umbrella orders Argo CD after active Istio releases and monitoring, and also honors explicit package dependencies or a dependsOnOverride. Do not use this package guide as a substitute for umbrella-wide dependency or ambient-mode configuration.

Package-specific operational notes

The chart includes bootstrap copies of Argo CD CRDs so Helm can install them before same-release argocd-apps resources render. Its optional post-install and post-upgrade hook labels and annotates a fixed set of Argo CD CRDs for Helm ownership. Those resources and Argo CD’s application controller are cluster-sensitive; test upgrades and application changes in a disposable integration environment before production use.

The package can inject AWS credentials into the repository server for supported SOPS use only when configured through its dedicated values. Treat those credentials, repository credentials, OIDC secrets, and cluster access as sensitive. Never place live values in documentation or ordinary values files.

Upstream resources