|
| 1 | +--- |
| 2 | +layout: src/layouts/Default.astro |
| 3 | +pubDate: 2026-03-13 |
| 4 | +modDate: 2026-03-13 |
| 5 | +title: AWS Managed Argo CD |
| 6 | +description: Install Argo CD Gateway on EKS with Argo CD Capability |
| 7 | +navOrder: 10 |
| 8 | +hideInThisSectionHeader: true |
| 9 | +--- |
| 10 | + |
| 11 | +The Argo CD Gateway can be installed into an AWS EKS cluster and connect to an Argo CD instance managed by the Argo CD Capability. |
| 12 | + |
| 13 | +## Differences from a standard Argo CD instance |
| 14 | + |
| 15 | +AWS managed Argo CD instances differ from standard self-hosted installations in the following ways: |
| 16 | + |
| 17 | +### External URL |
| 18 | + |
| 19 | +Standard installations connect to Argo CD using the in-cluster Kubernetes service DNS name (e.g. `argocd-server.argocd.svc.cluster.local`). AWS managed Argo CD instances are not accessible via in-cluster DNS, so the publicly accessible EKS capabilities URL must be used instead. |
| 20 | + |
| 21 | +### Valid TLS certificate |
| 22 | + |
| 23 | +AWS managed Argo CD instances are served with a publicly trusted TLS certificate. Unlike self-hosted installations that may use self-signed certificates, the **Argo CD instance uses self-signed certificates** option should remain unchecked to keep certificate verification enabled. |
| 24 | + |
| 25 | +### gRPC-Web |
| 26 | + |
| 27 | +AWS EKS Argo CD instances are exposed through a load balancer that does not support native gRPC (HTTP/2). The gateway must be configured to use gRPC-Web, which encapsulates gRPC communication over HTTP/1.1, by setting `gateway.argocd.grpcWeb="true"` or `gateway.argocd.grpcWebRootPath="/argo/api"`. |
| 28 | + |
| 29 | +## Installation |
| 30 | + |
| 31 | +The installation process follows the [standard process](/docs/argo-cd/instances#installing-the-octopus-argo-cd-gateway), with a few adjustments required for AWS managed Argo CD instances. |
| 32 | + |
| 33 | +1. Replace the default value for the Argo CD service DNS name with the publicly accessible URL for the Argo CD instance, without the protocol prefix. For example: `xxxxxxxx.eks-capabilities.ap-southeast-2.amazonaws.com` |
| 34 | +2. Uncheck the **Argo CD instance uses self-signed certificates** option |
| 35 | +3. Copy the generated Helm command and append the following value: `--set gateway.argocd.grpcWeb="true"`, if your Argo CD instance's API is not hosted at the root path you can set the following value instead: `--set gateway.argocd.grpcWebRootPath="/argo/api"` |
| 36 | + |
| 37 | +The resulting Helm command will look similar to the following: |
| 38 | + |
| 39 | +```bash |
| 40 | +helm install --atomic \ |
| 41 | +--create-namespace --namespace octo-argo-gateway-<instance-name> \ |
| 42 | +--version "*.*" \ |
| 43 | +--set registration.octopus.name="<instance-name>" \ |
| 44 | +--set registration.octopus.serverApiUrl="https://your-instance.octopus.app/" \ |
| 45 | +--set registration.octopus.serverAccessToken="API-XXXXXXXXXXXXXXXX" \ |
| 46 | +--set registration.octopus.spaceId="Spaces-1" \ |
| 47 | +--set gateway.octopus.serverGrpcUrl="grpc://your-instance.octopus.app:8443" \ |
| 48 | +--set gateway.argocd.serverGrpcUrl="grpc://xxxxxxxx.eks-capabilities.<region>.amazonaws.com" \ |
| 49 | +--set gateway.argocd.insecure="false" \ |
| 50 | +--set gateway.argocd.plaintext="false" \ |
| 51 | +--set gateway.argocd.authenticationToken="<Argo API Token>" \ |
| 52 | +--set gateway.argocd.grpcWeb="true" \ |
| 53 | +<instance-name> \ |
| 54 | +oci://registry-1.docker.io/octopusdeploy/octopus-argocd-gateway-chart |
| 55 | +``` |
0 commit comments