Learn GitOps with ArgoCD - Installing ArgoCD

#Introduction

Up to episode 3, all the material was conceptual. Now it's time to touch the keyboard: we're going to install ArgoCD on a local cluster. Before jumping to the conclusion that installation is just "copy-paste YAML," remember that the decisions you make here — the installation method, how you manage the admin password, and your access strategy — will affect the security and operations of your ArgoCD forever.

In this episode we'll cover four installation methods, step-by-step installation, initial configuration (password, login, CLI), and production customizations like HA, ingress, and TLS.

#Choosing an Installation Method

There are four main paths to install ArgoCD:

Method	Best for	Approach
Manifest (`kubectl apply`)	Lab, quickstart	Official `install.yaml`
Helm chart	Production, customization	`argo-cd` chart from argoproj
Operator (argocd-operator)	Teams that like the operator pattern	`ArgoCD` CRD + reconciliation
ArgoCD Autopilot	GitOps-first bootstrap	Bootstrap via Git bootstrap manifest

For this series we start with the official manifest (most transparent, fewest unknown components), then cover the Helm variant in the customization section.

Tip

In a lab, installing via the official manifest is the best choice because you can see exactly what gets deployed. In production, the argo-cd Helm chart is the de facto standard because it lets you adjust values in a structured way.

#Installation Steps

Create the namespace first, then apply the official manifest:

Installation via kubectl apply

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
kubectl get pods -n argocd
kubectl get svc -n argocd

Verify all pods are Running (give it a minute or two for image pulls). After that, access the API server. For a local lab, port-forward is the simplest:

Access via port-forward

kubectl port-forward svc/argocd-server -n argocd 8080:443

The ArgoCD UI can now be opened at https://localhost:8080. The untrusted certificate warning is normal — it's self-signed for the lab.

#Initial Configuration

#Getting the Admin Password

The initial admin password is the argocd-server pod name:

Get the initial password

kubectl get secret argocd-initial-admin-secret -n argocd -o jsonpath='{.data.password}' | base64 -d

Log in for the first time from the browser with user admin and that password, then change the password immediately.

#Logging in from the CLI

Install the ArgoCD CLI, then log in:

argocd login localhost:8080 --insecure
argocd account update-password
argocd version

Warning

The default password is a public secret that's very easy to guess (the pod name). Change it right after the first login — make this a habit in every environment, not just the lab.

#Changing the Password from the UI

Click the avatar in the top-right corner → Update Password. Enter the old password, set a new one. After that, the old CLI session must be logout and you log back in.

#First UI Walkthrough

After logging in, you'll see:

Applications — the list of managed Applications (still empty).
Settings → Repositories and Clusters — where you register Git and target clusters.
Settings → Projects — Project management (default default).
The individual application page — once you have an Application (episode 6).

#Installing via Helm Chart (Production Option)

A more structured alternative is the official Helm chart:

Installation via Helm chart

helm repo add argo https://argoproj.github.io/argo-helm
helm repo update
helm install argocd argo/argo-cd --namespace argocd --create-namespace \
  --set server.service.type=LoadBalancer

#Production Customizations

#High Availability

ArgoCD supports HA mode: enable multiple server, repo-server, and dex replicas, plus Redis with Sentinel:

Enable HA mode

--set server.replicas=2 \
--set repoServer.replicas=2 \
--set redis-ha.enabled=true \
--set controller.replicas=1

Important note: the Application Controller uses leader election — only one is actively working, the rest are on standby.

#Ingress and TLS

In a real cluster, port-forward isn't enough. Expose it via Ingress with TLS:

Ingress with TLS

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-server-ingress
  namespace: argocd
  annotations:
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - argocd.example.com
      secretName: argocd-tls
  rules:
    - host: argocd.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: argocd-server
                port:
                  number: 443

This Ingress forwards traffic directly to the argocd-server service on port 443 — important because ArgoCD runs gRPC and HTTPS on a single port.

#Closing

ArgoCD is now running on your cluster:

Choose the method: official manifest (lab) or Helm chart (production).
Install: namespace → apply manifest → verify → port-forward.
Initial configuration: get the initial password, log in, and change the password immediately.
HA with multiple replicas, ingress + TLS for production access.

Installation is done, but it doesn't feel "alive" yet — the UI is still empty. In episode 5 we'll explore the ArgoCD UI and CLI: the dashboard, application view, tree view, diff, logs, and all the important CLI commands like argocd app list and argocd app sync. See you there!