Disaster Recovery

Argo CD is largely stateless with all data persisted as Kubernetes objects in etcd. This guide covers backup and restore procedures to protect your Argo CD configuration and application definitions.

Understanding Argo CD Data

Argo CD stores its state in:

Kubernetes etcd: All Application CRDs, AppProjects, and configuration
Redis: Temporary cache only (can be safely rebuilt)
Git repositories: Source of truth for application manifests

Redis is used only as a disposable cache and can be safely rebuilt without service disruption.

Backup Procedures

Using argocd admin export

The argocd admin tool provides built-in export functionality to backup all Argo CD data.

Check Argo CD version

Determine your Argo CD version to use the correct Docker image:

argocd version | grep server
# Export the version
export VERSION=v3.4.0

Configure kubeconfig

Ensure your ~/.kube/config points to your Argo CD cluster:

kubectl config current-context
# Should show your Argo CD cluster

Export data to backup

Create a backup file containing all Argo CD resources:

docker run -v ~/.kube:/home/argocd/.kube --rm \
  quay.io/argoproj/argocd:$VERSION \
  argocd admin export > backup.yaml

For non-default namespace:

docker run -v ~/.kube:/home/argocd/.kube --rm \
  quay.io/argoproj/argocd:$VERSION \
  argocd admin export -n <namespace> > backup.yaml

If you are running Argo CD in a namespace other than argocd, remember to pass the -n <namespace> parameter. The export command will not fail if you run it in the wrong namespace, but the backup will be incomplete.

What Gets Backed Up

The export includes:

Application definitions
AppProject configurations
Repository credentials (encrypted)
Cluster credentials (encrypted)
ConfigMaps (argocd-cm, argocd-rbac-cm, etc.)
Secrets (argocd-secret, repository secrets, cluster secrets)

Automated Backup Strategy

Implement automated backups using a CronJob:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: argocd-backup
  namespace: argocd
spec:
  schedule: "0 2 * * *"  # Daily at 2 AM
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: argocd-backup
          containers:
          - name: backup
            image: quay.io/argoproj/argocd:v3.4.0
            command:
            - sh
            - -c
            - |
              argocd admin export > /backup/argocd-backup-$(date +%Y%m%d-%H%M%S).yaml
            volumeMounts:
            - name: backup-storage
              mountPath: /backup
          volumes:
          - name: backup-storage
            persistentVolumeClaim:
              claimName: argocd-backup-pvc
          restartPolicy: OnFailure

Restore Procedures

Restoring from Backup

Prepare target cluster

Install Argo CD on the target cluster if not already present:

kubectl create namespace argocd
kubectl apply -n argocd -f \
  https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

Import backup data

Restore the backup using the import command:

docker run -i -v ~/.kube:/home/argocd/.kube --rm \
  quay.io/argoproj/argocd:$VERSION \
  argocd admin import - < backup.yaml

For non-default namespace:

docker run -i -v ~/.kube:/home/argocd/.kube --rm \
  quay.io/argoproj/argocd:$VERSION \
  argocd admin import -n <namespace> - < backup.yaml

Verify restoration

Check that applications and configurations are restored:

kubectl get applications -n argocd
kubectl get appprojects -n argocd
argocd app list

Alternative Backup Methods

Kubernetes etcd Backup

Since Argo CD data lives in Kubernetes, backing up etcd provides a complete snapshot:

ETCDCTL_API=3 etcdctl snapshot save argocd-snapshot.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

Velero Integration

Use Velero for cluster-wide backup including Argo CD:

# Install Velero
velero install --provider aws --bucket argocd-backups \
  --secret-file ./credentials-velero

# Create backup schedule
velero schedule create argocd-daily \
  --schedule="@daily" \
  --include-namespaces argocd

# Create on-demand backup
velero backup create argocd-backup-$(date +%Y%m%d) \
  --include-namespaces argocd