n8500x/argocd repository overview

⁠n8500x/argocd

Self-contained Argo CD Helm chart image for air-gapped installs. ENTRYPOINT is helm.

This image bakes the vendored Argo CD Helm chart (plus an empty repo config and an app-of-apps parent chart) on top of alpine/helm, so you can run helm subcommands against the chart with no network access. It is meant for air-gapped environments: mount a kubeconfig and use it to template or install Argo CD into your cluster. Container images referenced by the chart are not bundled — you must make them available to the target cluster on-prem.

⁠Quick start

docker pull n8500x/argocd

The entry point is helm, so pass helm subcommands as args. The chart is baked in at ./argo-cd-9.5.11.tgz (working directory /argocd).

Render the baked manifests (no cluster needed):

docker run --rm n8500x/argocd \
  template argocd ./argo-cd-9.5.11.tgz -n argocd

Install into a cluster (mount your kubeconfig read-only):

docker run --rm -v $HOME/.kube:/root/.kube:ro n8500x/argocd \
  install argocd ./argo-cd-9.5.11.tgz -n argocd --create-namespace

⁠What's inside

• Base image: alpine/helm (provides the helm binary and entry point).
• Argo CD Helm chart: argo-cd version 9.5.11 (vendored as argo-cd-9.5.11.tgz).
• Argo CD version: v3.3.9.
• App-of-apps parent chart: appofapps/ (chart version 0.1.0) — renders a set of child Argo CD Application resources from values.yaml, so a single parent Application can bootstrap a tree of children.
• Working directory: /argocd, containing the chart, an empty repo config, and the appofapps chart.

Container images are NOT bundled in this image — make the images referenced by the chart available to the target cluster on-prem (e.g. a local registry / mirror).

⁠Configuration

• Entry point: helm — the container runs helm <your args>. Provide the subcommand and flags (template, install, -n, --create-namespace, etc.).
• Volumes: mount a kubeconfig at /root/.kube (read-only) for commands that talk to a cluster, e.g. -v $HOME/.kube:/root/.kube:ro.
• Chart path: the Argo CD chart is at ./argo-cd-9.5.11.tgz relative to the /argocd working directory.

No custom environment variables or exposed ports are defined by this image; behavior is driven entirely by the helm subcommands you pass.

⁠App-of-apps values

The bundled appofapps chart is configured via appofapps/values.yaml. Shared defaults include argocdNamespace (argocd), project (default), destinationServer (https://kubernetes.default.svc), targetRevision (HEAD), a repoBase/repoSuffix used to derive each app's repoURL, chartPath, and a syncPolicy (automated prune + selfHeal, CreateNamespace=true). Each entry in applications is either a bare app name or a map overriding name, repoURL, path, namespace, targetRevision, or syncWave.

⁠Build

From this directory:

docker build -t argocd-installer:3.3.9 .

Save for air-gapped transport:

docker save argocd-installer:3.3.9 -o argocd-installer-3.3.9.tar

⁠Notes

• Air-gapped by design: everything the chart needs to render is baked into the image; no Helm repo or internet access is required to template/install.
• Images are not included: the chart still references Argo CD container images — mirror or preload them into the target cluster before installing.
• Argo CD runs in secure mode: the server serves HTTPS with its own self-signed cert, so anything fronting it must speak HTTPS to the backend and skip verifying that upstream cert (e.g. nginx backend-protocol: HTTPS + proxy-ssl-verify: off, or TLS passthrough). See EXPOSE.md, argocd-server-ingress.yaml, and argocd-ui-tunnel.sh for UI exposure on minikube and on-prem.
• Initial admin password (user admin):

  kubectl -n argocd get secret argocd-initial-admin-secret \
    -o jsonpath='{.data.password}' | base64 -d; echo
  

  Copy
• The Argo CD CLI accessed over the nginx ingress needs --grpc-web.