# Implementing ArgoCD Image Updater using Artifact Registry Google Cloud Platform ### Overview The Argo CD Image Updater can check for new versions of the container images that are deployed with your Kubernetes workloads and automatically update them to their latest allowed version using Argo CD. Usage is simple: You annotate your Argo CD `Application` resources with a list of images to be considered for update, along with a version constraint to restrict the maximum allowed new version for each image. Argo CD Image Updater then regularly polls the configured applications from Argo CD and queries the corresponding container registry for possible new versions. If a new version of the image is found in the registry, and the version constraint is met, Argo CD Image Updater instructs Argo CD to update the application with the new image. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1719071688160/c3a093c8-533b-4b87-ab1b-1a2248d07886.jpeg align="center") There are 4 [update strategies](https://argocd-image-updater.readthedocs.io/en/stable/#features) available for Argo CD image updater: * `semver`: update to highest allowed version according to given image constraint, * `latest`: update to the most recently created image tag, * `name`: update to the last tag in an alphabetically sorted list * `digest`: update to the most recent pushed version of a mutable tag And for this tutorial, we will use [digest update strategies](https://argocd-image-updater.readthedocs.io/en/stable/basics/update-strategies/#strategy-digest). ### Installation You can install the Image Updater alongside Argo CD, typically as a separate pod within the same namespace as Argo CD: ```plaintext kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj-labs/argocd-image-updater/stable/manifests/install.yaml ``` ### Usage 1. **Authenticate to Artifact Registry** To fully utilize the Argo CD Image Updater, it’s crucial to configure it to [connect with your image registry properly](https://argocd-image-updater.readthedocs.io/en/stable/basics/authentication/#authentication-to-container-registries), especially if you are using private registries or private repositories on public registries. Make sure you have service account key file with json format with appropriate permissions. Please read [Create Service Account](https://cloud.google.com/iam/docs/service-accounts-create) for more information. ```plaintext cat sa-gcr-prd.json | docker login -u _json_key --password-stdin https://asia-southeast2-docker.pkg.dev ``` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1718939747401/fd06884f-2a71-4205-a308-14579f40b25c.png align="center") The second step is to create secret from docker config file, so the ArgoCD Image Updater can use that for scanning dan watch every time there are new images pushed. Mostly docker saved the credential to authenticate with Registry in **/home/user/.docker/config.json** so you can take that file for generating secret. ```yaml apiVersion: v1 kind: Secret metadata: name: gcr-prd namespace: argocd data: .dockerconfigjson: type: kubernetes.io/dockerconfigjson ``` 2. **Configuring ArgoCD Image Updater** After setting up the credentials, include them in the [ArgoCD Image Updater’s configurationto authenticate with the image regis](https://argocd-image-updater.readthedocs.io/en/stable/configuration/registries/#configuration-format)try. ```yaml apiVersion: v1 kind: ConfigMap metadata: labels: app.kubernetes.io/name: argocd-image-updater-config app.kubernetes.io/part-of: argocd-image-updater name: argocd-image-updater-config data: git.commit-message-template: | Auto-commit by Argocd Image Updater [{{ .AppName }}] {{ range .AppChanges -}} updates image {{ .Image }} tag '{{ .OldTag }}' to '{{ .NewTag }}' {{ end -}} log.level: debug registries.conf: | registries: - name: asia-southeast2-docker.pkg.dev api_url: https://asia-southeast2-docker.pkg.dev ping: no credentials: pullsecret:argocd/gcr-prd #namespaceName/secretName defaultns: library prefix: asia-southeast2-docker.pkg.dev ``` As i mentioned above, we annotate Argo CD `Application` resources with a list of images to be considered for update, and here is the example. ```yaml apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: your-argocd-app-name namespace: argocd labels: key: value finalizers: - resources-finalizer.argocd.argoproj.io annotations: notifications.argoproj.io/subscribe.on-deployed.slack: report-argocd notifications.argoproj.io/subscribe.on-sync-failed.slack: report-argocd argocd-image-updater.argoproj.io/image-list: frontend=asia-southeast2-docker.pkg.dev/PROJECT-ID/REPOSITORY/IMAGE:tag,backend=asia-southeast2-docker.pkg.dev/PROJECT-ID/REPOSITORY/IMAGE:tag argocd-image-updater.argoproj.io/frontend.update-strategy: digest argocd-image-updater.argoproj.io/backend.update-strategy: digest argocd-image-updater.argoproj.io/write-back-method: git spec: project: your-argocd-project-name source: repoURL: https://gitlab.com/your-gitops-repository/repository.git targetRevision: your-branch-name path: target-folder-git destination: server: https://your-cluster-external-endpoint namespace: your-target-deployed-to syncPolicy: automated: selfHeal: true prune: true ``` 3. Once everything is applied, Argo CD Image updater will be able to do this kind of commit to your repository, and Argo CD will do the rest: ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1718971002252/93b48cab-d6f9-4563-8d62-4f899d47321b.png align="center") If you are interested in testing it, I hope this post showed you how **easy it is to configure** Argo CD Image Updater for your infrastructure. 😄