Configure ArgoCD Image Updater for automated container deployments

Update system packages

Ensure your package manager has the latest package information before installing dependencies.

sudo apt update && sudo apt upgrade -y

sudo dnf update -y

Install kubectl and required tools

Install kubectl for Kubernetes cluster interaction and curl for API calls.

sudo apt install -y curl git
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

sudo dnf install -y curl git
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

Verify ArgoCD installation

Confirm that ArgoCD is already running in your cluster. ArgoCD Image Updater requires an existing ArgoCD installation.

kubectl get pods -n argocd
kubectl get svc -n argocd

Create ArgoCD Image Updater namespace and RBAC

Set up the namespace and service account with appropriate permissions for the Image Updater to function.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: argocd-image-updater
  namespace: argocd
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: argocd-image-updater
rules:
apiGroups:
  - ""
  resources:
  - secrets
  - configmaps
  verbs:
  - get
  - list
  - watch
apiGroups:
  - argoproj.io
  resources:
  - applications
  - appprojects
  verbs:
  - get
  - list
  - update
  - patch
  - watch
apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: argocd-image-updater
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: argocd-image-updater
subjects:
kind: ServiceAccount
  name: argocd-image-updater
  namespace: argocd

kubectl apply -f /tmp/argocd-image-updater-rbac.yaml

Deploy ArgoCD Image Updater

Install the Image Updater deployment with the latest stable version from the official repository.

kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj-labs/argocd-image-updater/stable/manifests/install.yaml

Configure Image Updater settings

Create a ConfigMap with global configuration settings for the Image Updater behavior and logging.

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-image-updater-config
  namespace: argocd
data:
  registries.conf: |
    registries:
    - name: Docker Hub
      api_url: https://registry-1.docker.io
      prefix: docker.io
      ping: yes
      credentials: secret:argocd/docker-registry#creds
      credsexpire: 10h
    - name: Quay
      api_url: https://quay.io
      prefix: quay.io
      ping: yes
    - name: GitHub Container Registry
      api_url: https://ghcr.io
      prefix: ghcr.io
      ping: yes
  git.conf: |
    git:
      user: argocd-image-updater
      email: argocd-image-updater@example.com
  log.conf: |
    log:
      level: info

kubectl apply -f /tmp/argocd-image-updater-config.yaml

Create Git repository access secret

Configure credentials for the Image Updater to commit changes back to your Git repository.

kubectl create secret generic git-credentials \
  --from-literal=username=your-git-username \
  --from-literal=password=your-git-token \
  -n argocd

kubectl label secret git-credentials \
  "argocd.argoproj.io/secret-type=repo-creds" \
  -n argocd

Configure container registry credentials

Set up authentication for private container registries that require credentials.

kubectl create secret generic docker-registry \
  --from-literal=creds=username:password \
  -n argocd

kubectl label secret docker-registry \
  "argocd.argoproj.io/secret-type=repository" \
  -n argocd

Annotate ArgoCD Application for automatic updates

Add annotations to your existing ArgoCD Application to enable automatic image updates.

kubectl patch application my-app -n argocd --type merge --patch '{
  "metadata": {
    "annotations": {
      "argocd-image-updater.argoproj.io/image-list": "myapp=docker.io/myuser/myapp:latest",
      "argocd-image-updater.argoproj.io/write-back-method": "git",
      "argocd-image-updater.argoproj.io/git-branch": "main"
    }
  }
}'

Configure update strategy

Define how the Image Updater should determine which new versions to deploy.

kubectl patch application my-app -n argocd --type merge --patch '{
  "metadata": {
    "annotations": {
      "argocd-image-updater.argoproj.io/myapp.update-strategy": "semver",
      "argocd-image-updater.argoproj.io/myapp.allow-tags": "regexp:^v[0-9]+\\.[0-9]+\\.[0-9]+$",
      "argocd-image-updater.argoproj.io/myapp.ignore-tags": "latest,dev,staging"
    }
  }
}'

Enable Helm chart image updates

For Helm-based applications, configure the Image Updater to modify Helm values.

kubectl patch application my-helm-app -n argocd --type merge --patch '{
  "metadata": {
    "annotations": {
      "argocd-image-updater.argoproj.io/image-list": "myapp=docker.io/myuser/myapp",
      "argocd-image-updater.argoproj.io/write-back-method": "git",
      "argocd-image-updater.argoproj.io/myapp.helm.image-name": "image.repository",
      "argocd-image-updater.argoproj.io/myapp.helm.image-tag": "image.tag"
    }
  }
}'

Configure Git write-back settings

Set up how the Image Updater commits changes back to your Git repository with proper commit messages.

kubectl patch configmap argocd-image-updater-config -n argocd --patch '{
  "data": {
    "git.conf": "git:\n  user: argocd-image-updater\n  email: argocd-image-updater@example.com\n  commit_user: ArgoCD Image Updater\n  commit_email: argocd-image-updater@example.com\n  commit_message_template: |\n    build: automatic update of {{ .AppName }}\n    \n    {{ range .AppChanges -}}\n    updates image {{ .Image }} tag '{{ .OldTag }}' to '{{ .NewTag }}'\n    {{ end -}}"
  }
}'

Configure webhook notifications

Set up webhook notifications to receive updates when images are automatically updated.

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-image-updater-config
  namespace: argocd
data:
  webhooks.conf: |
    webhooks:
    - name: slack
      url: https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK
      method: POST
      headers:
        Content-Type: application/json
      template: |
        {
          "text": "Image updated: {{ .AppName }}",
          "attachments": [
            {
              "color": "good",
              "fields": [
                {{ range .AppChanges -}}
                {
                  "title": "{{ .Image }}",
                  "value": "{{ .OldTag }} → {{ .NewTag }}",
                  "short": true
                }{{ if not (last .) }},{{ end }}
                {{ end -}}
              ]
            }
          ]
        }

kubectl patch configmap argocd-image-updater-config -n argocd --patch-file /tmp/webhook-config.yaml

Configure update schedules

Set up cron-based schedules for when the Image Updater should check for new images.

kubectl patch application my-app -n argocd --type merge --patch '{
  "metadata": {
    "annotations": {
      "argocd-image-updater.argoproj.io/myapp.update-schedule": "0 2   *",
      "argocd-image-updater.argoproj.io/myapp.platforms": "linux/amd64,linux/arm64"
    }
  }
}'

Enable detailed logging

Configure verbose logging to help with troubleshooting and monitoring update activities.

kubectl patch deployment argocd-image-updater -n argocd --patch '{
  "spec": {
    "template": {
      "spec": {
        "containers": [
          {
            "name": "argocd-image-updater",
            "args": [
              "--interval", "2m",
              "--loglevel", "debug",
              "--metrics-port", "8080",
              "--health-probe-port", "8081",
              "--argocd-server-addr", "argocd-server.argocd.svc.cluster.local:443",
              "--insecure"
            ]
          }
        ]
      }
    }
  }
}'

Set up Prometheus metrics

Enable metrics collection for monitoring the Image Updater performance and activity.

apiVersion: v1
kind: Service
metadata:
  name: argocd-image-updater-metrics
  namespace: argocd
  labels:
    app.kubernetes.io/component: image-updater
    app.kubernetes.io/name: argocd-image-updater
    app.kubernetes.io/part-of: argocd
spec:
  ports:
  - name: metrics
    port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    app.kubernetes.io/name: argocd-image-updater

kubectl apply -f /tmp/metrics-service.yaml

Create ServiceMonitor for Prometheus

Set up automatic metrics scraping if you have Prometheus Operator installed.

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: argocd-image-updater
  namespace: argocd
  labels:
    app.kubernetes.io/component: image-updater
    app.kubernetes.io/name: argocd-image-updater
spec:
  endpoints:
  - interval: 30s
    path: /metrics
    port: metrics
  namespaceSelector:
    matchNames:
    - argocd
  selector:
    matchLabels:
      app.kubernetes.io/name: argocd-image-updater

kubectl apply -f /tmp/servicemonitor.yaml