argocd
Chart · GitOps · standard · v0.0.25
Argo CD, the CNCF declarative GitOps continuous-delivery controller for Kubernetes. One multi-call binary serves every component (server, repo-server, application-controller, applicationset-controller, commit-server, notifications, cmp-server), selected by argv[0] exactly as upstream does, so the chart picks a role with a single command. Built from source with upstream's own asset pipeline, so the server really serves its React web console instead of 404ing every UI route. Ships git, git-lfs, openssh-client and gnupg for private and signature-verified repos, plus Helm 3 built from source and the Wolfi Kustomize, both of which the repo-server execs by bare name.
Version
The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version. Only the most recent releases are listed — an older chart pins an older image digest.
Deployed image digest
sha256:2117c67822324feb09e7142c3ba34e1b7d3c9c705cb77fbaa13eb53df68840ccChart OCI version
oci://ghcr.io/quenchworks/charts/argocd:0.0.25The chart pins its image by this signed digest, so you never track it yourself. Signatures, SBOM, and provenance attach to the same digest.
Security report (Trivy)
Security report (Trivy) · image argocd 3.4.12
Install the chart
Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.
Install (latest)
helm install my-argocd oci://ghcr.io/quenchworks/charts/argocd --version 0.0.25Deploys images (digest-pinned)
- argocd3.4.12D
ghcr.io/quenchworks/images/argocd@sha256:2117c67822324feb09e7142c3ba34e1b7d3c9c705cb77fbaa13eb53df68840cc - redis8.10.2A+
ghcr.io/quenchworks/images/redis@sha256:86b6ea473a7b34a8141c3989f7ea7e973e50fd73fa21ee79b0bab71112180d88
- Chart version
- 0.0.25
- App version
- 3.4.12
- Chart license
- Apache-2.0
- App license
- Apache-2.0
- Signed
- cosign (keyless)
- Values schema
- yes
- Last published
- 2026-10-22
Values keys
- image: repository digest pullPolicy
- nameOverride
- logFormat
- logLevel
- crds: install keep annotations
- configs: url cm rbac sshKnownHosts tlsCerts gpgKeys secret
- server: replicaCount containerPort metricsPort insecure rootpath extraArgs service resources
- repoServer: replicaCount metricsPort disableTLS parallelismLimit helmWorkingDirSizeLimit extraArgs service resources
- controller: replicaCount metricsPort statusProcessors operationProcessors shardingAlgorithm extraArgs resources
- applicationSet: enabled replicaCount webhookPort metricsPort probePort enableLeaderElection extraArgs resources
- notifications: enabled metricsPort cm secret extraArgs resources
- redis: enabled architecture auth persistence resources
- externalRedis: host port db password existingSecret existingSecretPasswordKey
- rbac: create clusterScoped
- serviceAccount: create annotations server repoServer controller applicationSet notifications
- networkPolicy: enabled allowExternal
- podLabels
- podAnnotations
- nodeSelector
- affinity
- tolerations
- topologySpreadConstraints
- priorityClassName
- schedulerName
- terminationGracePeriodSeconds
- updateStrategy
- extraEnvVars
- extraEnvVarsCM
- extraEnvVarsSecret
- extraVolumes
- extraVolumeMounts
- initContainers
- sidecars
- lifecycleHooks
- podSecurityContext
- containerSecurityContext
- livenessProbe
- readinessProbe
- customLivenessProbe
- customReadinessProbe
- customStartupProbe
Verify the chart
cosign verify ghcr.io/quenchworks/charts/argocd:0.0.25 \
--certificate-identity-regexp 'https://github.com/quenchworks/.+' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comTransparency
The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.
Upstream project: https://argo-cd.readthedocs.io