Review Argo CD

Deploys a review environment as an Argo CD Application and removes it when the GitLab review environment stops.

The component creates or updates an Argo CD Application from the manifest input after expanding CI variables such as $CI_COMMIT_SHA. It uses the Argo CD API through the argocd CLI from the ci-tools tools image.

include:
  - component: $CI_SERVER_FQDN/$CI_PROJECT_PATH/helm@$CI_COMMIT_SHA
    inputs:
      name: my-app
      path: chart
  - component: $CI_SERVER_FQDN/$CI_PROJECT_PATH/review-argocd@$CI_COMMIT_SHA
    inputs:
      server: argocd.example.com
      token-variable: ARGOCD_AUTH_TOKEN
      needs:
        - job: build:helm:my-app
          artifacts: true
      manifest: |
        apiVersion: argoproj.io/v1alpha1
        kind: Application
        metadata:
          name: my-app-$CI_COMMIT_SHORT_SHA
          namespace: argocd
        spec:
          project: default
          sources:
            - repoURL: oci://$CI_REGISTRY_IMAGE/charts
              chart: my-app
              targetRevision: 0.0.0+$CI_COMMIT_SHA
          destination:
            server: "https://kubernetes.default.svc"
            namespace: review-my-app
          syncPolicy:
            automated:
              prune: true
              selfHeal: true
            syncOptions:
              - CreateNamespace=false
      url-script: scripts/review-argocd-url.sh

Set server or the ARGOCD_SERVER CI/CD variable to the Argo CD API server hostname. Generate an Argo CD API token and store it in the variable named by token-variable, which defaults to ARGOCD_AUTH_TOKEN. Set insecure: true for internal or self-signed Argo CD API servers where certificate validation is intentionally skipped.

For Helm OCI chart sources, the component accepts Helm-style oci:// repository URLs and normalizes them to the registry-style repoURL that Argo CD expects in an Application.

If url-script exists and is executable, it must print the review URL. Otherwise, the component uses the first URL reported in the Argo CD Application summary.

Set wait-enabled: false only for smoke tests or clusters where another validation step proves the Application reconciled. Production review environments should keep the default so the start job waits for Argo CD to report Synced and Healthy.

Argo CD account

Create a dedicated Argo CD local account for GitLab CI and allow it to read, sync, and delete the review Applications.

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  accounts.gitlab-review: apiKey
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.csv: |
    p, role:gitlab-review, applications, get, default/my-app-*, allow
    p, role:gitlab-review, applications, create, default/my-app-*, allow
    p, role:gitlab-review, applications, update, default/my-app-*, allow
    p, role:gitlab-review, applications, sync, default/my-app-*, allow
    p, role:gitlab-review, applications, delete, default/my-app-*, allow
    g, gitlab-review, role:gitlab-review

Generate a token with argocd account generate-token --account gitlab-review and store it as the masked CI/CD variable ARGOCD_AUTH_TOKEN:

argocd account generate-token --account gitlab-review

Set ARGOCD_SERVER to the Argo CD API endpoint, or pass the server input in the component include.

Inputs

Name	Description	Default	Type
---	---	---	---
environment	GitLab environment prefix.	test	string
environment-identifier	GitLab environment suffix.	/$CI_PIPELINE_IID-$CI_COMMIT_SHORT_SHA	string
insecure	Skip Argo CD server TLS certificate verification.	false	boolean
manifest	Argo CD Application manifest. Variables are expanded before applying.	apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: "$CI_PROJECT_PATH_SLUG-$CI_PIPELINE_IID-$CI_COMMIT_SHORT_SHA" namespace: argocd labels: app.kubernetes.io/managed-by: gitlab-ci app.kubernetes.io/part-of: "$CI_PROJECT_PATH_SLUG" spec: project: default sources: - repoURL: "$CI_PROJECT_URL.git" targetRevision: "$CI_COMMIT_SHA" path: chart destination: server: "https://kubernetes.default.svc" namespace: "$CI_ENVIRONMENT_SLUG" syncPolicy: automated: prune: true selfHeal: true syncOptions: - CreateNamespace=false	string
needs	The jobs that the start job depends on.	[]	array
needs-stop	The jobs that the stop job depends on.	[]	array
rules	Rules that control when review jobs run.	[{"if":"$CI_PIPELINE_SOURCE == \"merge_request_event\"","when":"always"},{"when":"never"}]	array
server	Argo CD API server. Defaults to ARGOCD_SERVER when unset.		string
stage	The pipeline stage for start and stop jobs.	test	string
timeout	Timeout while waiting for the Argo CD Application to sync and become healthy.	15m	string
token-variable	Environment variable that contains an Argo CD auth token.	ARGOCD_AUTH_TOKEN	string
url-script	Optional executable script that prints the review URL after sync.	scripts/review-argocd-url.sh	string
wait-enabled	Wait for the Argo CD Application to sync and become healthy.	true	boolean

Argo CD account​

Inputs​

Argo CD account

Inputs