[Git and GitOps 21] Deploy with Argo CD: Installation, Projects and Git Access

For the first GitOps deployment, inspect the resources before enabling automatic synchronization. Install Argo CD and manually sync an nginx Deployment and Service into a dedicated namespace. Use a separate lab cluster; these initial installation examples are not intended for direct production use.

You need a separate, disposable lab cluster with working kubectl, kubeconfig and DNS. The Argo CD 3.5.5 release and installation manifest were checked on October 18, 2026. The YAML below was reviewed for syntax and static configuration; it was not deployed to a live Kubernetes cluster for this article.

Git · GitOps All Series · 21 / 24

On this page

1. Check and install the target cluster

kubectl config current-context
kubectl get nodes
kubectl create namespace argocd
curl -fL -o argocd-install-v3.5.5.yaml \
  https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.5/manifests/install.yaml
# Review the downloaded manifest before applying to the dedicated lab cluster.
kubectl apply --server-side -n argocd -f argocd-install-v3.5.5.yaml
kubectl -n argocd get pods

Server-side apply avoids the comment size limitations of client-side apply on large CRDs. Since this is a dedicated lab environment that is being installed for the first time, if there is a field ownership conflict, the cause is read and it stops. I don’t habitually add --force-conflicts to cover up existing installations.

This installation adds cluster permissions and CRDs. Just because you narrow down the AppProject doesn’t mean the installation itself has less permissions. The target namespace retains argocd, which the default installation references. When using a different version or namespace, check the official upgrade/installation documentation first.

2. Access the management screen

After the Pod is ready, forward the port on the PC running kubectl. The results of the command to read the initial password are sensitive values ​​and are not shared as logs or screen data.

kubectl -n argocd port-forward svc/argocd-server 18081:443

Read the initial password from another terminal. The Bash commands below are Linux or Git Bash-based.

kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath='{.data.password}' | base64 --decode

Go to https://localhost:18081 in your browser, log in as admin and change your password. Verifies the origin of the default self-signed certificate, and configures trusted certificates and SSO/RBAC in team operations. After changing, the initial password Secret is no longer needed.

kubectl -n argocd delete secret argocd-initial-admin-secret
kubectl create namespace gitops-demo

3. Create a distribution repository and add nginx declaration

Create an empty gitops-config repository in Gitea and clone it. Commit and push config/environments/dev/deployment.yaml from the example bundle to environments/dev/deployment.yaml in the repository. The digest below is the image index confirmed from the official nginx registry and you should re-examine the security updates at the time of change.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitops-web
  namespace: gitops-demo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gitops-web
  template:
    metadata:
      labels:
        app: gitops-web
    spec:
      containers:
        - name: web
          image: nginx@sha256:970364228b1e4f932abc22d321932816782cca8a20b85a77552a7cfe9acfb3b5
          ports:
            - containerPort: 80
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 128Mi
          readinessProbe:
            httpGet:
              path: /
              port: 80
            initialDelaySeconds: 2
            periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: gitops-web
  namespace: gitops-demo
spec:
  selector:
    app: gitops-web
  ports:
    - port: 80
      targetPort: 80

Resource requests and limits are small starting values for training. These are not operational recommendations based on actual load measurements. In clusters with restricted Pod Security, you must ensure that the default nginx root execution and permissions comply with the policy.

4. Make Argo CD read Gitea

Set the storage URL to an internal DNS and port accessible from the Pod. Replace git.example.internal and YOUR_USER in this article with actual values. Do not put the localhost tunnel address from Part 15 here.

Register a read-only deploy key for this repository in Gitea. Add verified SSH known_hosts in Certificates in Argo CD Settings, and register SSH URL and private key in Repositories. If the menu name has changed, follow the official private repositories instructions. First check if it is Connection Successful.

SSH authentication keys and server host keys have different roles. If you choose HTTPS, register your organization’s CA and use read-only credentials. You’re not putting your actual private key into Git’s bootstrap YAML.

5. Register a project with limited sources and targets

Replace the repository URLs of project.yaml and application.yaml below with the same actual values. Since the namespace was created separately earlier, the project does not need to allow cluster-scoped namespace creation.

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: git-training
  namespace: argocd
spec:
  sourceRepos:
    - 'ssh://git@git.example.internal:12222/YOUR_USER/gitops-config.git'
  destinations:
    - namespace: gitops-demo
      server: https://kubernetes.default.svc
  clusterResourceWhitelist: []
  namespaceResourceWhitelist:
    - group: apps
      kind: Deployment
    - group: ''
      kind: Service

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: gitops-web
  namespace: argocd
spec:
  project: git-training
  source:
    repoURL: 'ssh://git@git.example.internal:12222/YOUR_USER/gitops-config.git'
    targetRevision: main
    path: environments/dev
  destination:
    server: https://kubernetes.default.svc
    namespace: gitops-demo
  syncPolicy: {}

kubectl apply -f project.yaml
kubectl apply -f application.yaml
kubectl -n argocd get applications

The first state can be OutOfSync or Missing because the resource is not yet present. Read the Application Diff from the UI and check that the creation target is only Deployment·Service of gitops-demo. Run Sync and check Synced and Healthy status and target resources together.

kubectl -n gitops-demo get deploy,svc,pods
kubectl -n gitops-demo rollout status deployment/gitops-web --timeout=120s
kubectl -n gitops-demo port-forward svc/gitops-web 18082:80

Check your browser for the http://localhost:18082 response. ImagePullBackOff examines image/registry connections, ComparisonError examines storage authentication/path/YAML, and permission denial examines AppProject and cluster RBAC.

The installation standard is Argo CD Getting Started, the scope limit is Projects, and repository authentication is covered in Private Repositories. In the next part, we’ll cover the difference between automatic synchronization and the actual state.

Previous · [Git and GitOps 20] Apply GitOps Principles and Separate App and Deployment Repositories · Next · [Git and GitOps 22] Review Auto-Sync, selfHeal, prune and Git Revert · Series list and example files