Argo CD#

Overview#

Argo CD is the GitOps engine that reconciles the NVIDIA Mission Control component stack onto the k8s-admin cluster. It is also a GitOps-managed component itself, managing its own configuration and upgrades from the component tree. Operators sign in through Keycloak, the same identity provider NMC Launchpad uses.

How it works#

Argo CD is installed before the GitOps components (Argo CD Installation). When you publish the component tree, the argocd Application syncs in the last wave of the stack and Argo CD takes over managing itself. The Application pulls the pinned chart from the upstream Argo CD Helm repository and its values from the GitOps repository, so upgrades and configuration changes reach Argo CD through the same publish flow as every other component. The UI shows each Application’s sync and health state.

For single sign-on, Argo CD registers as the argocd OpenID Connect (OIDC) client in the Keycloak nmc realm. Its client secret is seeded as a bootstrap secret and stored in OpenBao (refer to Secrets). External Secrets delivers it to Argo CD at runtime. Single sign-on turns on when you publish the component tree with the Keycloak realm import enabled (keycloak.realmImportEnabled: true, the standard install setting).

Any user in the nmc realm can sign in, on the web UI with Log in via Keycloak or on the command line with argocd login <argocd-fqdn> --sso. Signed-in users get read-only access to every Application. Sync, create, and delete stay with the built-in admin account. To let your directory users sign in, federate the directory into the nmc realm (Keycloak).

Configuration#

Add these settings under the argocd key in values.yaml. The key already carries the pinned version and syncWave from Installing GitOps-Managed Components; the following fields are the ones you set. A field shown with a value uses that value as its default when you omit it.

argocd:
  fqdn: <argocd-fqdn>       # optional, the host name Argo CD is served on; defaults to argocd.dgx-<cluster-name>.nvidia.com
  routeEnabled: true        # optional, render an external route through the shared gateway
  useDockerHubRedisImage: false   # optional, pull Redis from Docker Hub instead of AWS ECR Public

  • fqdn – the host name Argo CD is served on. Defaults to argocd.dgx-<cluster-name>.nvidia.com. Set it to your environment’s host name.

  • routeEnabled – render an external route through the shared gateway. When false, no external route is emitted.

  • useDockerHubRedisImage – pull Argo CD’s Redis image from Docker Hub instead of AWS ECR Public. Set it to true if ECR Public rate-limits the pull.

Cross-field consistency rules:

  • fqdn must match k8s_argocd_fqdn from the Argo CD installation (Argo CD Installation). The gateway route and the Keycloak redirect URIs are built from fqdn, so a mismatch breaks access and sign-in.

  • useDockerHubRedisImage must match k8s_argocd_use_docker_hub_redis_image from the Argo CD installation (Argo CD Installation).

Secrets#

Argo CD consumes one bootstrap secret. Add it to secrets.yaml:

k8s_bootstrap_secrets_argocd_client_secret: ""   # argocd OIDC client secret; leave empty to auto-generate

  • k8s_bootstrap_secrets_argocd_client_secret – the client_secret for the argocd OIDC client. Leave it empty to auto-generate. Seeded together with Keycloak so both sides share the same value. External Secrets delivers it to Argo CD at runtime.

Verify#

Confirm Argo CD single sign-on:

  • The argocd Application reports Synced and Healthy, and the argocd-oidc Secret exists in the argocd namespace.

  • Open https://<argocd-fqdn>/. The sign-in page shows Log in via Keycloak.

  • Sign in as a Keycloak nmc-realm user; Verify the Deployment creates one. Argo CD opens with every Application visible and read-only, and a sync attempt is denied.

  • Run argocd login <argocd-fqdn> --sso and confirm the CLI signs in.

  • Sign in with the local admin account and confirm a sync succeeds.