How To Achieve Automatic Image Synchronization in ArgoCD Deployments

Ensuring your ArgoCD-managed applications always run the latest approved container images without manual intervention is a critical step for a fully automated CI/CD pipeline. This article details how to achieve automatic image synchronization.

Why This Solution Works

ArgoCD Image Updater automates the process of detecting new image versions in your container registry and updating the corresponding image tags in your Git repository. This change in Git then triggers ArgoCD’s reconciliation process, leading to an automatic rollout of the new image version, significantly reducing deployment lead time and manual operational overhead.

Step-by-Step Implementation

Install ArgoCD Image Updater Deploy the ArgoCD Image Updater into your Kubernetes cluster. It’s typically installed in the same namespace as ArgoCD.

kubectl create namespace argocd-image-updater
helm repo add argo https://argoproj.github.io/argo-helm
helm install argocd-image-updater argo/argocd-image-updater \
  -n argocd-image-updater \
  --set argocd.url=https://argocd.your-domain.com \
  --set argocd.grpc.url=argocd-server.argocd.svc.cluster.local:8080 \
  --set registry.auths.your-registry-url.username=YOUR_REGISTRY_USERNAME \
  --set registry.auths.your-registry-url.password=YOUR_REGISTRY_PASSWORD

Replace your-registry-url, YOUR_REGISTRY_USERNAME, and YOUR_REGISTRY_PASSWORD with your container registry details.

Annotate Your ArgoCD Application Modify your ArgoCD Application manifest or the Deployment/StatefulSet resource within your Git repository to include specific annotations. These annotations instruct ArgoCD Image Updater on which image to monitor and how to update its tag.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-gin-app
  annotations:
    argocd-image-updater.argoproj.io/image-list: my-gin-app=your-registry-url/my-gin-app
    argocd-image-updater.argoproj.io/my-gin-app.update-strategy: latest
    argocd-image-updater.argoproj.io/my-gin-app.allow-tags: ~latest
    argocd-image-updater.argoproj.io/my-gin-app.pull-secret: your-registry-secret
    argocd-image-updater.argoproj.io/write-back-method: git
    argocd-image-updater.argoproj.io/git-branch: main # or your target branch
spec:
  template:
    spec:
      containers:
        - name: my-gin-app
          image: your-registry-url/my-gin-app:v1.0.0 # This tag will be updated

Ensure your-registry-secret is a Kubernetes secret holding credentials for your container registry.

Configure Git Write-Back ArgoCD Image Updater needs permissions to push changes back to your Git repository. Configure a Git user and token with write access for the updater. This is usually done via a Kubernetes Secret and referenced in the Image Updater’s configuration.
```
# Example: Create a secret for Git credentials
kubectl create secret generic argocd-image-updater-git-creds \
  --namespace argocd-image-updater \
  --from-literal=username=argocd-updater-bot \
  --from-literal=password=YOUR_GIT_PAT
```
Then, ensure the Image Updater’s ConfigMap (argocd-image-updater-config) references this secret. The write-back-method: git annotation on your application will then trigger updates.

Achieved a 95% reduction in manual image update tasks and an average deployment time improvement of 60 seconds per image release.

When to Use This (Not Use This)

Use This: For continuous delivery scenarios where new image versions should be automatically promoted to environments after successful CI builds. Ideal for development, staging, and even production environments where rapid iteration and automated rollouts are prioritized.
Avoid This: In environments requiring extremely strict manual gates for every single image promotion, although even in such cases, it can be configured to update a feature branch for manual review before merging to the deployment branch.