ArgoCD Setup Guide for IBM Cloud

by Bala

Complete guide for setting up ArgoCD on IBM Cloud Kubernetes Service (IKS)

This guide provides detailed instructions for setting up ArgoCD on IBM Cloud Kubernetes Service (IKS), including IBM Cloud-specific configurations and integrations.

Prerequisites

  • IBM Cloud CLI installed and configured
  • kubectl configured for IKS
  • IBM Cloud account with required permissions
  • Helm (optional)

IKS Cluster Setup

1. Create IKS Cluster

ibmcloud ks cluster create classic \
  --name argocd-cluster \
  --zone dal10 \
  --machine-type b3c.4x16 \
  --workers 3 \
  --version latest

2. Configure Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argocd-network-policy
  namespace: argocd
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: argocd-server
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: TCP
      port: 443

ArgoCD Installation

1. Install ArgoCD

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

2. Configure IBM Cloud Load Balancer

apiVersion: v1
kind: Service
metadata:
  name: argocd-server
  namespace: argocd
  annotations:
    service.kubernetes.io/ibm-load-balancer-cloud-provider-ip-type: "public"
    service.kubernetes.io/ibm-load-balancer-cloud-provider-vpc: "true"
    service.kubernetes.io/ibm-load-balancer-cloud-provider-enable-features: "proxy-protocol"
spec:
  type: LoadBalancer
  ports:
  - port: 443
    targetPort: 8080
    protocol: TCP
    name: https
  selector:
    app.kubernetes.io/name: argocd-server

IBM Cloud Integration

1. IBM Cloud Object Storage Integration

argocd-cm has no backup.destination/backup.schedule/aws.endpoint keys - ArgoCD has no built-in scheduled backup feature. These credentials are consumed by the CronJob in the Backup Configuration section instead, which drives the actual backup via argocd admin export.

apiVersion: v1
kind: Secret
metadata:
  name: ibm-cos-credentials
  namespace: argocd
type: Opaque
stringData:
  access-key-id: your-access-key
  secret-access-key: your-secret-key

2. IBM Container Registry Integration

apiVersion: v1
kind: Secret
metadata:
  name: registry-credentials
  namespace: argocd
type: kubernetes.io/dockerconfigjson
stringData:
  .dockerconfigjson: |
    {
      "auths": {
        "us.icr.io": {
          "auth": "base64-encoded-credentials"
        }
      }
    }

IBM Cloud Monitoring

1. IBM Cloud Monitoring Configuration

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  monitoring.enabled: "true"
  monitoring.endpoint: "https://monitoring.cloud.ibm.com"

2. Sysdig Integration

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: argocd-metrics
  namespace: argocd
  labels:
    sysdig: "true"
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: argocd-metrics
  endpoints:
  - port: metrics
    interval: 30s

Auto Scaling Configuration

1. Horizontal Pod Autoscaling

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: argocd-server
  namespace: argocd
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: argocd-server
  minReplicas: 2
  maxReplicas: 5
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 80

2. Cluster Autoscaler

apiVersion: v1
kind: ConfigMap
metadata:
  name: ibm-cluster-autoscaler
  namespace: kube-system
data:
  workerPoolsConfig.json: |
    [{
      "name": "default",
      "minSize": 3,
      "maxSize": 6,
      "enabled": true
    }]

IBM Cloud Secrets Manager Integration

There’s no ibmcloud.ibm.com CRD group shipped with IKS for Key Protect/Secrets Manager - the documented way to pull secrets into the cluster is the External Secrets Operator’s IBM Cloud provider (the same operator used for AWS/GCP/Azure elsewhere in this series):

1. Secrets Manager Setup

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: ibm-secrets-manager
  namespace: argocd
spec:
  provider:
    ibm:
      serviceUrl: https://your-instance.us-south.secrets-manager.appdomain.cloud
      auth:
        secretRef:
          secretApiKeySecretRef:
            name: ibm-secrets-manager-creds
            key: apiKey

2. External Secret

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: argocd-secrets
  namespace: argocd
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: ibm-secrets-manager
    kind: SecretStore
  target:
    name: argocd-secret
  data:
  - secretKey: admin.password
    remoteRef:
      key: argocd-admin-password
  - secretKey: server.secretkey
    remoteRef:
      key: argocd-server-secretkey

Backup Configuration

1. IBM Cloud Object Storage Backup

ArgoCD’s CLI has no argocd admin backup command - the documented mechanism is argocd admin export, which dumps all ArgoCD resources as YAML to stdout (restored with the matching argocd admin import):

apiVersion: batch/v1
kind: CronJob
metadata:
  name: argocd-backup
  namespace: argocd
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: argocd-backup # needs read access to ArgoCD's CRDs/Secrets/ConfigMaps
          containers:
          - name: argocd-backup
            # custom image bundling both the argocd CLI and the aws CLI -
            # no single official image ships both
            image: your-registry/argocd-backup-tools:latest
            command:
            - /bin/sh
            - -c
            - |
              argocd admin export -n argocd > /tmp/backup.yaml
              aws s3 cp /tmp/backup.yaml "s3://argocd-backup/$(date +%Y-%m-%d).yaml" \
                --endpoint-url https://s3.us-south.cloud-object-storage.appdomain.cloud
            env:
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: ibm-cos-credentials
                  key: access-key-id
            - name: AWS_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: ibm-cos-credentials
                  key: secret-access-key
            - name: AWS_ENDPOINT_URL
              value: https://s3.us-south.cloud-object-storage.appdomain.cloud
          restartPolicy: OnFailure

Security Configuration

1. IBM Cloud Security Groups

VPC security groups are IBM Cloud infrastructure objects, not a Kubernetes CRD - manage them with the IBM Cloud CLI or Terraform:

ibmcloud is security-group-create argocd-security-group your-vpc-id
ibmcloud is security-group-rule-add argocd-security-group inbound tcp \
  --port-min 443 --port-max 443

2. IAM Integration

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  oidc.config: |
    name: IBM Cloud
    issuer: https://iam.cloud.ibm.com/identity
    clientID: your-client-id
    clientSecret: $oidc.ibm.clientSecret
    requestedScopes: ["openid", "email", "profile"]

Cost Optimization

1. Worker Node Configuration

apiVersion: apps/v1
kind: Deployment
metadata:
  name: argocd-server
spec:
  template:
    spec:
      nodeSelector:
        ibm-cloud.kubernetes.io/worker-pool-name: standard-pool

2. Resource Quotas

apiVersion: v1
kind: ResourceQuota
metadata:
  name: argocd-quota
  namespace: argocd
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi

Best Practices Checklist

  1. ✅ Use managed IKS cluster
  2. ✅ Configure load balancer
  3. ✅ Setup Object Storage backup
  4. ✅ Enable monitoring
  5. ✅ Configure auto scaling
  6. ✅ Implement Key Protect
  7. ✅ Enable encryption
  8. ✅ Regular monitoring
  9. ✅ Cost management
  10. ✅ Security compliance

Performance Optimization

1. Load Balancer Optimization

apiVersion: v1
kind: Service
metadata:
  name: argocd-server
  annotations:
    service.kubernetes.io/ibm-load-balancer-cloud-provider-zone: "dal10"
    service.kubernetes.io/ibm-load-balancer-cloud-provider-vlan: "public"

2. Resource Management

apiVersion: apps/v1
kind: Deployment
metadata:
  name: argocd-server
spec:
  template:
    spec:
      containers:
      - name: argocd-server
        resources:
          requests:
            cpu: 200m
            memory: 256Mi
          limits:
            cpu: 500m
            memory: 512Mi

Troubleshooting

1. Common Issues

  1. Load Balancer Issues
# Check load balancer status
ibmcloud ks nlb-dns ls --cluster argocd-cluster
kubectl describe service argocd-server -n argocd
  1. Worker Node Issues
# Check worker node status
ibmcloud ks worker ls --cluster argocd-cluster
kubectl get nodes

2. Logging with LogDNA

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: logdna-agent
  namespace: ibm-observe
spec:
  template:
    spec:
      containers:
      - name: logdna-agent
        env:
        - name: LOGDNA_INGESTION_KEY
          valueFrom:
            secretKeyRef:
              name: logdna-agent-key
              key: logdna-ingestion-key

Conclusion

This guide provides a comprehensive setup for running ArgoCD on IBM Cloud Kubernetes Service. Regular monitoring and updates are essential for optimal performance.

Additional Resources