🚀 Argo CD Master Guide: Fully Conquering argocd-cm Core Properties

Hello everyone! Today, we’re going to dive deep into the argocd-cm configuration, which is like the heart of Argo CD, the most powerful tool for realizing GitOps in a Kubernetes environment. 🛠️

If you want to go beyond simple installation, enhance security, check custom statuses, and efficiently manage resources, please read this article to the end!

---

1. 🛡️ Enable GPG Signature Verification (gpg.enabled)

Security cannot be overemphasized. When you want to verify that content committed to a Git repository was indeed authored by a trusted user, you use GPG (GNU Privacy Guard) signature verification.

• Role: Ensures Argo CD verifies the GPG signature of a commit when fetching manifests from Git.
• Reason for setting: Even if an unauthorized user tampers with and pushes code, if the signature is invalid, Argo CD will refuse to synchronize, thereby protecting the cluster.

💻 Configuration Code Example

YAML

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  # Enable GPG signature verification 🔐
  gpg.enabled: "true"

💡 Note: After enabling this setting, you must register public keys with Argo CD. Please add trusted keys using the argocd gpg add command!

---

2. 🏥 Custom Resource Health Check (resource.customizations.health)

Argo CD can inherently determine the status (Healthy, Progressing, etc.) of standard resources like Deployments and Services. However, for CRDs (Custom Resource Definitions) or certain open-source resources, Argo CD might not be able to determine “Is this normal?” and may remain in a perpetually Progressing state.

This is where Lua scripts come in handy for custom health checks.

💻 Configuration Code Example (e.g., SealedSecrets resource)

YAML

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  # Define custom health check logic per resource 🩺
  resource.customizations.health.bitnami.com_SealedSecret: |
    hs = {}
    -- 리소스의 status 필드가 있는지 확인
    if obj.status ~= nil then
      -- 조건별 상태 로직 작성 (Lua 문법)
      if obj.status.observedGeneration < obj.metadata.generation then
        hs.status = "Progressing"
        hs.message = "대기 중: 새로운 사양 반영 중..."
        return hs
      end
    end
    hs.status = "Healthy"
    hs.message = "정상: 시크릿이 성공적으로 복호화되었습니다."
    return hs

• Important: The format resource.customizations.health._ must be followed.
• Tip: For performance, it’s better to simply read the resource’s status field value rather than performing complex operations.

---

3. 🎖️ Enable Status Badge (statusbadge.enabled)

Do you want to quickly show your team whether a currently running service is successfully synchronized (Synced) or if there’s an issue? Try adding an Argo CD badge to your GitHub README or internal dashboards!

• Feature: Allows external parties to retrieve the synchronization status of a specific Application in the form of an image link.

💻 Configuration Code Example

YAML

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  # Enable status badge feature 🎨
  statusbadge.enabled: "true"

After activation, you can use the badge via the following URL format: https:///api/badge?name=

---

4. 🏗️ Kustomize Binary Version Management (kustomize.binary.path)

Many teams use Kustomize for manifest management. Argo CD uses its built-in Kustomize version, but sometimes specific version features are needed, or a security-patched, newer version must be specified separately.

💻 Configuration Code Example

First, you need to mount a volume containing the desired version of the binary to the Argo CD Repo Server container or build a custom image. Then, specify the path in argocd-cm.

YAML

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  # Specify path for a specific Kustomize version 🛠️
  #(The binary must be located at this path beforehand)
  kustomize.path.v4.5.7: "/usr/local/bin/kustomize-4-5-7"

   # Or custom flags can be added via build options
  kustomize.buildOptions: "--load-restrictor LoadRestrictionsNone"

Hold on! As mentioned in a previous discussion, if you want to support multiple versions, you can use the kustomize.path.vX.X.X format to flexibly respond to different development environments.

---

📝 Full Configuration Summary (Full YAML)

Here’s what the argocd-cm file looks like, combining all the details explained above. Please read the comments carefully!

YAML

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
  labels:
    app.kubernetes.io/part-of: argocd
data:
   # 1. Security settings: GPG signature verification
  gpg.enabled: "true"

   # 2. Visibility: Expose status badge
  statusbadge.enabled: "true"

   # 3. Kustomize: Configure specific version usage
   # Multiple versions can be specified as needed.
  kustomize.path.v5.0.0: "/custom-bin/kustomize"

   # 4. Status management: Custom resource (e.g., Argo Rollouts) health check
   # Helps Argo CD determine the success of non-standard resources.
  resource.customizations.health.argoproj.io_Rollout: |
    hs = {}
    if obj.status ~= nil then
      if obj.status.phase == "Paused" then
        hs.status = "Suspended"
        hs.message = "배포가 일시 중지되었습니다 (Canary/BlueGreen)"
        return hs
      end
    end
    hs.status = "Healthy"
    return hs

   # 5. Other useful settings (including past discussions)
   # Used when customizing the Help menu in the UI
  help.chat.url: "https://slack.com/your-channel"
  help.chat.text: "데브옵스 팀에게 문의하기"

---

💡 Conclusion

The argocd-cm properties we covered today are essential elements that elevate Argo CD from a simple deployment tool to an enterprise-grade GitOps platform.

In particular, health checks via resource.customizations are a game-changer for increasing the reliability of Argo CD’s dashboard in complex microservice architectures. 🎯

Why not apply these to your cluster right now? If you have any questions, please leave a comment!

---