Install with Argo CD
How an Argo CD install differs from Helm: hooks, sync waves and version pins.
Argo CD installs the same chart with the same values as Helm. Do the steps up to the values file as there (operators, DNS, the sign-in client, the master key), then let Argo CD apply the chart.
The Application
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: harthelm
namespace: argocd
spec:
project: default
destination:
server: https://kubernetes.default.svc
namespace: harthelm-system
sources:
- repoURL: <your registry>/charts
chart: harthelm
targetRevision: <version>
helm:
valueFiles: [$values/harthelm/values.yaml]
- repoURL: https://git.example.com/platform/config.git
targetRevision: main
ref: values
syncPolicy:
automated: {prune: true, selfHeal: true}
syncOptions: [ServerSideApply=true]- Use server-side apply (
ServerSideApply=true). - Keep the values in Git; a second source with
$values, as above, works. - Pin a chart version in
targetRevision. To upgrade or roll back, move the pin. - The AppProject must allow the cluster-scoped kinds of Permissions and the release namespace as a destination.
Render before you commit
An invalid value makes the Application Unknown instead of failing loudly. Render the values in CI or before every
commit: helm template --kube-version <cluster version> -f values.yaml oci://<your registry>/charts/harthelm --version <version>.
What differs from Helm
| Topic | Helm | Argo CD |
|---|---|---|
| Preflight | pre-install/pre-upgrade hook | PreSync hook; its RBAC and NetworkPolicy one wave earlier |
| Pre-migration dump | pre-upgrade hook, not on a first install | Sync hook in wave -1 on every sync; on the first sync it finds no database and exits 0 |
| NetworkPolicy probe | helm test fails when the policies are not enforced | A report-only client runs as a PostSync hook after every sync and never fails it; the doctor shows its result |
| UID guard | lookup of the ConfigMap <release>-volume-uid | No lookup: core's own check at start is the guard; security.uidGuard.state can feed the chart's by hand |
Edge mode auto | from the cluster's API versions | Argo passes them; a plain helm template needs --api-versions gateway.networking.k8s.io/v1/HTTPRoute |
| Protection | the backups PVC has helm.sh/resource-policy: keep | the database Cluster and the backups PVC carry Prune=false,Delete=false |
| Versions | --version | targetRevision |
Runtime objects in the team namespaces carry no Argo CD tracking labels, so Argo CD neither prunes nor heals them.
The licence fits GitOps: keep it in the Secret that
license.existingSecret names, created by
your secret tooling like the OIDC client's. The PreSync preflight checks it, and core reads a renewed licence from
the Secret within a minute, without a sync. See Licence.
Waves and storage that waits
Argo CD waits for every wave to be healthy, and a claim on a WaitForFirstConsumer StorageClass stays Pending until a
pod mounts it. The chart takes care of its backups claim: the archive receiver mounts it when
backup.workspaces.enabled is on; without the receiver a short Job <release>-backup-bind-<hash> mounts it
read-only and exits Since 1.0.2. A claim you bring with backup.persistence.existingClaim is yours to bind.
Restores under Argo CD
Switch the Application's automated sync off before you stop core for a restore, or self-heal scales core back up. See Backups and restore.