1
kind: Cluster
2
apiVersion: kind.x-k8s.io/v1alpha4
3
networking:
4
  apiServerAddress: "10.10.151.201"
5
nodes:
6
- role: control-plane
7
  extraPortMappings:
8
  - containerPort: 6443
9
    hostPort: 6443
10
    listenAddress: "10.10.151.201"
11
    protocol: tcp
12
- role: control-plane
13
- role: control-plane
14
- role: worker
15
- role: worker
16
- role: worker

1
sudo kind create cluster --config=huari.yaml --name huari-test --image kindest/node:v1.34.0 --retain; sudo kind export logs --name huari-test

1
sudo kubectl cluster-info --context kind-huari-test

1
# 查看集群节点
2
sudo kubectl get nodes
3

4
# 查看集群全部的pod
5
sudo kubectl get pods -A -owide

1
sudo kind delete cluster --name huari-test

1
# 更新helm repo
2
helm repo add argo https://argoproj.github.io/argo-helm
3
helm repo update
4

5
# 部署argocd
6
helm upgrade --install argocd argo/argo-cd \
7
  --version 7.3.5 \
8
  --namespace argo \
9
  --create-namespace

1
helm pull argo/argo-cd --version 7.3.5
2
helm upgrade --install argocd ./argo-cd-7.3.5.tgz \
3
  --namespace argo \
4
  --create-namespace

1
# 获取初始管理员密码
2
kubectl -n argo get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

1
helm install argocd-image-updater argo/argocd-image-updater --namespace argo --create-namespace --set installCRDs=true
2

3
# 等待部署完成
4
kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=argocd-image-updater -n argo --timeout=300s

1
# 确认 Pod 正常运行
2
kubectl get pods -n argo -l app.kubernetes.io/name=argocd-image-updater
3

4
# 确认 ImageUpdater CRD 已安装（v1.x 必须有此 CRD）
5
kubectl get crd | grep imageupdater
6
# 期望输出：imageupdaters.argocd-image-updater.argoproj.io

1
# 查看 Image Updater 日志（controller 名称为 argocd-image-updater-controller）
2
kubectl logs -n argo deployment/argocd-image-updater-controller -f

1
# Docker Hub
2
kubectl create secret docker-registry dockerhub-secret \
3
  --docker-username=your-username \
4
  --docker-password=your-password \
5
  -n argo
6

7
# 或者阿里云 ACR
8
kubectl create secret docker-registry aliyun-acr-secret \
9
  --docker-server=registry.cn-hangzhou.aliyuncs.com \
10
  --docker-username=your-username \
11
  --docker-password=your-password \
12
  -n argo

1
kubectl edit configmap argocd-image-updater-config -n argo

1
apiVersion: v1
2
kind: ConfigMap
3
metadata:
4
  name: argocd-image-updater-config
5
  namespace: argo
6
data:
7
  registries.conf: |
8
    registries:
9
    - name: Docker Hub
10
      api_url: https://registry-1.docker.io
11
      ping: yes
12
      credentials: pullsecret:argo/dockerhub-secret
13
    - name: Aliyun ACR
14
      api_url: https://registry.cn-hangzhou.aliyuncs.com
15
      ping: yes
16
      credentials: pullsecret:argo/aliyun-acr-secret

1
kubectl rollout restart deployment argocd-image-updater-controller -n argo

1
# 查看集群中安装的版本
2
kubectl get pod -n argo -l app.kubernetes.io/name=argocd-image-updater \
3
  -o jsonpath='{.items[0].spec.containers[0].image}'
4
# 示例输出：quay.io/argoprojlabs/argocd-image-updater:v1.1.0
5

6
# 下载对应版本的 CLI binary（以 v1.1.0 linux/amd64 为例）
7
curl -Lo argocd-image-updater \
8
  https://github.com/argoproj-labs/argocd-image-updater/releases/download/v1.1.0/argocd-image-updater-linux_amd64
9
chmod +x argocd-image-updater

1
# 基本测试（默认使用 semver 策略，查看 nginx 的最新版本）
2
./argocd-image-updater test nginx --loglevel info

1
INFO[0000] retrieving information about image            command=test image_name=nginx image_registry=
2
INFO[0000] Fetching available tags and metadata from registry  command=test image_name=nginx image_registry=
3
INFO[0001] Found 1049 tags in registry                   command=test image_name=nginx image_registry=
4
INFO[0001] latest image according to constraint is nginx:1.29.5  command=test image_name=nginx image_registry=

1
# 查看 nginx 1.17.x 分支中的最新 patch 版本
2
./argocd-image-updater test nginx --semver-constraint "1.17.x" --loglevel info
3
# 预期：latest image according to constraint is nginx:1.17.10

1
# newest-build 策略（按构建时间排序，适合 CI 产出的非 semver 镜像）
2
./argocd-image-updater test ghcr.io/argoproj/argocd \
3
  --update-strategy newest-build --loglevel info

1
export REGISTRY_CREDS="myuser:mypassword"
2
./argocd-image-updater test registry.cn-hangzhou.aliyuncs.com/your-ns/your-image \
3
  --credentials env:REGISTRY_CREDS --loglevel info

1
kubectl edit configmap argocd-image-updater-config -n argo

1
data:
2
  log.level: debug

1
kubectl rollout restart deployment argocd-image-updater-controller -n argo

1
commonUpdateSettings:
2
  updateStrategy: "newest-build"
3
  allowTags: "regexp:^[0-9a-f]{7}$"    # 仅匹配 7 位 git commit sha
4
  ignoreTags: ["latest", "master"]       # 排除特定标签

1
commonUpdateSettings:
2
  updateStrategy: "alphabetical"
3
  allowTags: "regexp:^[0-9]{4}-[0-9]{2}-[0-9]{2}$"   # 仅匹配 YYYY-MM-DD 格式

1
# 删除可能存在的旧 Application 和 ImageUpdater CR，避免配置冲突
2
kubectl delete application nginx-test -n argo --ignore-not-found
3
kubectl delete imageupdater nginx-test-updater -n argo --ignore-not-found

1
cat <<EOF | kubectl apply -f -
2
apiVersion: argoproj.io/v1alpha1
3
kind: Application
4
metadata:
5
  name: nginx-test
6
  namespace: argo
7
spec:
8
  project: default
9
  source:
10
    repoURL: docker.m.daocloud.io/bitnamicharts   # OCI Helm 仓库
11
    chart: nginx
12
    targetRevision: 18.3.6
13
    helm:
14
      parameters:
15
        - name: image.registry
16
          value: docker.io
17
        - name: image.repository
18
          value: library/nginx                      # 改为官方 nginx 仓库
19
        - name: image.tag
20
          value: "1.24.0"                           # 官方 nginx 存在该 tag
21
        - name: global.security.allowInsecureImages
22
          value: "true"                             # 可选，对官方镜像无影响
23
  destination:
24
    server: https://kubernetes.default.svc
25
    namespace: default
26
  syncPolicy:
27
    automated:
28
      prune: true
29
      selfHeal: true
30
    syncOptions:
31
      - CreateNamespace=true
32
EOF

1
kubectl get application nginx-test -n argo -w

1
cat <<EOF | kubectl apply -f -
2
apiVersion: argocd-image-updater.argoproj.io/v1alpha1
3
kind: ImageUpdater
4
metadata:
5
  name: nginx-test-updater
6
  namespace: argo
7
spec:
8
  namespace: argo
9
  writeBackConfig:
10
    method: argocd
11
  applicationRefs:
12
    - namePattern: "nginx-test"
13
      images:
14
        - alias: nginx
15
          imageName: docker.io/library/nginx:1.x      # 版本约束直接写在 imageName 中
16
          commonUpdateSettings:
17
            updateStrategy: semver
18
          manifestTargets:
19
            helm:
20
              tag: "image.tag"                         # 映射到 Helm 参数 image.tag
21
EOF

1
kubectl logs -n argo deployment/argocd-image-updater-controller -f|grep images_updated=1

1
level=info msg="Successfully updated image 'docker.io/nginx:1.24.0' to 'docker.io/nginx:1.29.5'
2

3
level=info msg="Processing results: applications=1 images_considered=1 images_skipped=0 images_updated=1 errors=0

1
# 1. 查看 Application 的 image.tag 参数是否已被自动更新
2
kubectl get application nginx-test -n argo \
3
  -o jsonpath='{.spec.source.helm.parameters[?(@.name=="image.tag")].value}'
4
# 期望输出：1.29.5（或其他最新版本，而不是初始的 1.25.0）
5

6
# 2. 查看 Application 同步状态和实际运行的镜像版本
7
kubectl get application nginx-test -n argo \
8
  -o jsonpath='{.status.sync.status} {.status.summary.images}'
9
# 期望输出：Synced ["docker.io/nginx:1.29.5"]
10

11
# 3. 查看 Application 的完整更新历史
12
kubectl get application nginx-test -n argo \
13
  -o jsonpath='{.status.history[*].source.helm.parameters[?(@.name=="image.tag")].value}'
14
# 期望输出：1.25.0 1.29.5（显示从旧版本更新到新版本的历史）
15

16
# 4. 查看 ImageUpdater CR 状态
17
kubectl describe imageupdater nginx-test-updater -n argo

1
kubectl delete imageupdater nginx-test-updater -n argo
2
kubectl delete application nginx-test -n argo

1
# nginx-test（已在 7.2 创建，若已清理需重新创建）
2
cat <<EOF | kubectl apply -f -
3
apiVersion: argoproj.io/v1alpha1
4
kind: Application
5
metadata:
6
  name: nginx-test
7
  namespace: argo
8
spec:
9
  project: default
10
  source:
11
    repoURL: docker.m.daocloud.io/bitnamicharts
12
    chart: nginx
13
    targetRevision: "18.3.6"
14
    helm:
15
      parameters:
16
        - name: image.registry
17
          value: docker.io
18
        - name: image.repository
19
          value: library/nginx
20
        - name: image.tag
21
          value: "1.24.0"
22
        - name: global.security.allowInsecureImages
23
          value: "true"
24
  destination:
25
    server: https://kubernetes.default.svc
26
    namespace: default
27
  syncPolicy:
28
    automated: {prune: true, selfHeal: true}
29
    syncOptions: [CreateNamespace=true]
30
EOF
31

32
# redis-test
33
cat <<EOF | kubectl apply -f -
34
apiVersion: argoproj.io/v1alpha1
35
kind: Application
36
metadata:
37
  name: redis-test
38
  namespace: argo
39
spec:
40
  project: default
41
  source:
42
    repoURL: docker.m.daocloud.io/bitnamicharts
43
    chart: redis
44
    targetRevision: "20.6.0"
45
    helm:
46
      parameters:
47
        - name: image.registry
48
          value: docker.io
49
        - name: image.repository
50
          value: library/redis
51
        - name: image.tag
52
          value: "7.0.0"
53
        - name: global.security.allowInsecureImages
54
          value: "true"
55
  destination:
56
    server: https://kubernetes.default.svc
57
    namespace: default
58
  syncPolicy:
59
    automated: {prune: true, selfHeal: true}
60
    syncOptions: [CreateNamespace=true]
61
EOF

1
kubectl get application -n argo

1
cat <<EOF | kubectl apply -f -
2
apiVersion: argocd-image-updater.argoproj.io/v1alpha1
3
kind: ImageUpdater
4
metadata:
5
  name: multi-app-updater
6
  namespace: argo
7
spec:
8
  namespace: argo
9
  writeBackConfig:
10
    method: "argocd"
11
  applicationRefs:
12
    - namePattern: "nginx-test"
13
      images:
14
        - alias: "nginx"
15
          imageName: "docker.io/library/nginx:1.x"
16
          commonUpdateSettings:
17
            updateStrategy: "semver"
18
    - namePattern: "redis-test"
19
      images:
20
        - alias: "redis"
21
          imageName: "docker.io/library/redis:7.x"
22
          commonUpdateSettings:
23
            updateStrategy: "semver"
24
EOF

1
kubectl logs -n argo deployment/argocd-image-updater-controller -f

1
level=info msg="Processing results: applications=2 images_considered=2 images_skipped=0 images_updated=2 errors=0"

1
kubectl delete imageupdater multi-app-updater -n argo
2
kubectl delete application nginx-test redis-test -n argo

1
cat <<EOF | kubectl apply -f -
2
apiVersion: argoproj.io/v1alpha1
3
kind: Application
4
metadata:
5
  name: nginx-test
6
  namespace: argo
7
  labels:
8
    env: test
9
    team: platform
10
spec:
11
  project: default
12
  source:
13
    repoURL: docker.m.daocloud.io/bitnamicharts
14
    chart: nginx
15
    targetRevision: "18.3.6"
16
    helm:
17
      parameters:
18
        - name: image.registry
19
          value: docker.io
20
        - name: image.repository
21
          value: library/nginx
22
        - name: image.tag
23
          value: "1.24.0"
24
        - name: global.security.allowInsecureImages
25
          value: "true"
26
  destination:
27
    server: https://kubernetes.default.svc
28
    namespace: default
29
  syncPolicy:
30
    automated: {prune: true, selfHeal: true}
31
    syncOptions: [CreateNamespace=true]
32
EOF

1
cat <<EOF | kubectl apply -f -
2
apiVersion: argocd-image-updater.argoproj.io/v1alpha1
3
kind: ImageUpdater
4
metadata:
5
  name: label-selector-updater
6
  namespace: argo
7
spec:
8
  namespace: argo
9
  writeBackConfig:
10
    method: "argocd"
11
  applicationRefs:
12
    - namePattern: "*"
13
      labelSelectors:
14
        matchLabels:
15
          env: test
16
      images:
17
        - alias: "nginx"
18
          imageName: "docker.io/library/nginx:1.x"
19
          commonUpdateSettings:
20
            updateStrategy: "semver"
21
EOF

1
kubectl logs -n argo deployment/argocd-image-updater-controller -f

1
level=info msg="Committing 1 parameter update(s) for application nginx-test"
2

3
level=info msg="Processing results: applications=1 images_considered=1 images_skipped=0 images_updated=1 errors=0"

1
kubectl delete imageupdater label-selector-updater -n argo
2
kubectl delete application nginx-test -n argo

1
apiVersion: argocd-image-updater.argoproj.io/v1alpha1
2
kind: ImageUpdater
3
metadata:
4
  name: kustomize-updater
5
  namespace: argo
6
spec:
7
  writeBackConfig:
8
    method: "git"
9
    gitConfig:
10
      branch: "main"
11
      writeBackTarget: "kustomization"    # 直接更新 kustomization.yaml
12
  applicationRefs:
13
    - namePattern: "my-kustomize-app"
14
      images:
15
        - alias: "myapp"
16
          imageName: "myregistry/myapp:1.x"
17
          commonUpdateSettings:
18
            updateStrategy: "semver"

1
gitConfig:
2
  branch: "main"
3
  # 相对于 Application 的 spec.source.path
4
  writeBackTarget: "kustomization:../../base"
5
  # 或绝对路径（以 / 开头）：
6
  # writeBackTarget: "kustomization:/config/base"

1
spec:
2
  writeBackConfig:
3
    method: "git"
4
    gitConfig:
5
      branch: "main"
6
      writeBackTarget: "helmvalues:values.yaml"    # 相对于 spec.source.path
7
      # 或绝对路径：
8
      # writeBackTarget: "helmvalues:/helm/config/values.yaml"

1
gitConfig:
2
  branch: "main:image-updater-updates"    # 基于 main，写入 image-updater-updates 分支

1
gitConfig:
2
  branch: "main:image-updater-{{.SHA256}}"

1
data:
2
  git.commit-message-template: |
3
    build: automatic update of {{ .AppName }}
4
    {{ range .AppChanges -}}
5
    updates image {{ .Image }} tag '{{ .OldTag }}' to '{{ .NewTag }}'
6
    {{ end -}}

1
# 创建 Docker Hub pull secret
2
kubectl create -n argo secret docker-registry dockerhub-secret \
3
  --docker-username someuser \
4
  --docker-password s0m3p4ssw0rd \
5
  --docker-server "https://registry-1.docker.io"
6

7
# 创建阿里云 ACR pull secret
8
kubectl create -n argo secret docker-registry aliyun-acr-secret \
9
  --docker-server registry.cn-hangzhou.aliyuncs.com \
10
  --docker-username your-username \
11
  --docker-password your-password

1
images:
2
  - alias: "myapp"
3
    imageName: "registry.cn-hangzhou.aliyuncs.com/your-ns/myapp:1.x"
4
    pullSecret: "pullsecret:argo/aliyun-acr-secret"
5
    commonUpdateSettings:
6
      updateStrategy: "semver"

1
kubectl create -n argo secret generic registry-creds \
2
  --from-literal=creds="myuser:mypassword"

1
# 测试时在 exec 中临时传入
2
export MY_CREDS="user:password"
3
./argocd-image-updater test myregistry/myimage --credentials env:MY_CREDS --loglevel info

1
# 实时日志（关注 WARN/ERROR 行）
2
kubectl logs -n argo deployment/argocd-image-updater-controller -f
3

4
# 过滤特定应用的相关日志
5
kubectl logs -n argo deployment/argocd-image-updater-controller | grep "my-app"

1
# 验证仓库连通性和版本筛选结果（开 debug 级别看详情）
2
./argocd-image-updater test nginx --semver-constraint "1.x" --loglevel debug
3

4
# 验证私有仓库 pull secret 是否有效
5
./argocd-image-updater test myregistry/myapp \
6
  --credentials "pullsecret:argo/my-secret" --loglevel info

1
# 确认 CR 是否正确创建
2
kubectl get imageupdater -n argo
3

4
# 查看 CR 事件和状态
5
kubectl describe imageupdater <name> -n argo

1
# 确认 Secret 存在且在正确命名空间
2
kubectl get secret -n argo
3

4
# 用 test 命令验证凭证是否正确
5
./argocd-image-updater test myregistry/myimage \
6
  --credentials "pullsecret:argo/my-secret" --loglevel debug

1
# 检查 git-creds Secret 是否存在
2
kubectl get secret git-creds -n argo -o yaml
3

4
# 查看日志中的 git 错误
5
kubectl logs -n argo deployment/argocd-image-updater-controller | grep -iE "git|push|commit|credential"

1
kubectl get application my-app -n argo \
2
  -o jsonpath='{.spec.source.targetRevision}'
3
# 期望输出：main（或其他分支名），而非 commit hash