ArgoCD on GKE: Setup & Operations Guide, Durrell Gemuh

Overview

This guide walks through deploying ArgoCD on GKE in a production-ready configuration, Helm install, Ingress with TLS via cert-manager, GitHub SSO, app-of-apps bootstrap, and operational best practices.

Prerequisites

A GKE cluster (Standard or Autopilot)
kubectl configured to your cluster
Helm 3 installed
A domain pointing to your cluster's Ingress IP
cert-manager deployed (for automatic TLS)

Step 1: Install ArgoCD via Helm

helm repo add argo https://argoproj.github.io/argo-helm
helm repo update

kubectl create namespace argocd

helm install argocd argo/argo-cd \
  --namespace argocd \
  --set server.ingress.enabled=true \
  --set server.ingress.ingressClassName=gce \
  --set server.ingress.hosts[0]=argocd.yourdomain.com \
  --set server.ingress.tls[0].secretName=argocd-tls \
  --set server.ingress.tls[0].hosts[0]=argocd.yourdomain.com

Step 2: Configure Ingress & TLS

Create a Certificate resource for cert-manager:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: argocd-tls
  namespace: argocd
spec:
  secretName: argocd-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - argocd.yourdomain.com

Step 3: Retrieve the Admin Password

kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d

Step 4: Configure GitHub SSO (Optional)

Edit the argocd-cm ConfigMap:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  url: https://argocd.yourdomain.com
  dex.config: |
    connectors:
      - type: github
        id: github
        name: GitHub
        config:
          clientID: $GITHUB_CLIENT_ID
          clientSecret: $GITHUB_CLIENT_SECRET
          orgs:
            - name: your-org

Step 5: App-of-Apps Bootstrap

Create a root Application that manages all other Applications:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: root
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/your-org/gitops-config
    targetRevision: main
    path: apps
  destination:
    server: https://kubernetes.default.svc
    namespace: argocd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

Operational Best Practices

RBAC: Restrict who can sync production apps. Use ArgoCD projects with source/destination restrictions.
Notifications: Set up argocd-notifications for Slack/email on sync failures.
Resource tracking: Use argocd.argoproj.io/tracking-id labels over annotations for better performance at scale.
Image Updater: Deploy argocd-image-updater if you want automated image tag bumps from your registry.
Backup: The entire state is in Git: ArgoCD itself is stateless. But back up the argocd namespace secrets (SSO, repo creds) separately.

Troubleshooting

Symptom	Likely Cause	Fix
Sync stuck in `Progressing`	Resource waiting for LoadBalancer IP	Check GCP quotas or switch to ClusterIP
`ComparisonError`	CRD not installed yet	Ensure CRDs deploy before apps that use them
TLS cert not issuing	cert-manager issuer misconfigured	`kubectl describe certificate -n argocd`
Health check failing	GKE Ingress health check path wrong	Set `server.ingress.annotations` with health check path `/healthz`

ArgoCD on GKE: Setup & Operations Guide