Skip to main content

Multi-cluster

Table of Contents​

  1. Multi-cluster architecture
  2. Add a cluster
  3. Deploy to multiple clusters
  4. Best practices
  5. Hands-on exercises

1 - Multi-cluster architecture​

Hub and Spoke​

Default local cluster​

# Le cluster où Argo CD est installé
# URL : https://kubernetes.default.svc

argocd cluster list
# SERVER                          NAME        STATUS
# https://kubernetes.default.svc  in-cluster  Successful

Use cases​

ScenarioDescription
Multi-envDev, staging, prod on different clusters
Multi-regionEU, US, Asia for latency
Multi-cloudAWS, GCP, Azure
EdgeEdge clusters for IoT

🔝 Back to table of contents​

2 - Add a cluster​

Via CLI​

# Lister les contextes kubectl disponibles
kubectl config get-contexts

# Ajouter un cluster
argocd cluster add my-cluster-context

# Avec un nom personnalisé
argocd cluster add my-cluster-context --name production-eu

Via declarative Secret​

apiVersion: v1
kind: Secret
metadata:
  name: prod-cluster
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: cluster
type: Opaque
stringData:
  name: production-eu
  server: https://prod-eu.example.com
  config: |
    {
      "bearerToken": "<service-account-token>",
      "tlsClientConfig": {
        "insecure": false,
        "caData": "<base64-encoded-ca-cert>"
      }
    }

Create a ServiceAccount for Argo CD​

# Sur le cluster distant
apiVersion: v1
kind: ServiceAccount
metadata:
  name: argocd-manager
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: argocd-manager
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: argocd-manager
    namespace: kube-system

Verify the connection​

argocd cluster list

# SERVER                          NAME            STATUS
# https://kubernetes.default.svc  in-cluster      Successful
# https://prod-eu.example.com     production-eu   Successful

🔝 Back to table of contents​

3 - Deploy to multiple clusters​

Application on a specific cluster​

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp-prod-eu
  namespace: argocd
spec:
  destination:
    server: https://prod-eu.example.com  # Cluster distant
    namespace: production
  source:
    repoURL: https://github.com/org/gitops.git
    path: apps/myapp

Multi-cluster ApplicationSet​

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: myapp-all-clusters
  namespace: argocd
spec:
  generators:
    - clusters: {}  # Tous les clusters enregistrés
  template:
    metadata:
      name: 'myapp-{{name}}'
    spec:
      project: default
      source:
        repoURL: https://github.com/org/gitops.git
        path: apps/myapp
      destination:
        server: '{{server}}'
        namespace: default
      syncPolicy:
        automated:
          prune: true

Filter by labels​

spec:
  generators:
    - clusters:
        selector:
          matchLabels:
            env: production
            region: eu

Add labels to clusters​

# Secret du cluster avec labels
apiVersion: v1
kind: Secret
metadata:
  name: prod-eu-cluster
  labels:
    argocd.argoproj.io/secret-type: cluster
    env: production
    region: eu

🔝 Back to table of contents​

4 - Best practices​

Cluster naming​

# Convention recommandée
name: <env>-<region>-<provider>

# Exemples
name: prod-eu-aws
name: staging-us-gcp
name: dev-local-kind

Standard labels​

labels:
  env: production|staging|dev
  region: eu|us|asia
  provider: aws|gcp|azure|onprem
  tier: critical|standard

Least privilege​

# Au lieu de cluster-admin, limiter les permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: argocd-manager
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps", ""]
    resources: ["deployments", "services", "configmaps", "secrets"]
    verbs: ["*"]

Multi-cluster monitoring​

# Prometheus scraping Argo CD
# Surveiller les métriques par cluster
argocd_app_info{dest_server="https://prod-eu.example.com"}

Disaster Recovery​

# Backup des configurations
argocd admin export > argocd-backup.yaml

# Restaurer
argocd admin import < argocd-backup.yaml

🔝 Back to table of contents​

5 - Hands-on exercises​

Exercise 1: Add a cluster (simulated)​

# Créer un second cluster avec kind
kind create cluster --name staging

# Ajouter à Argo CD
argocd cluster add kind-staging

# Vérifier
argocd cluster list

Exercise 2: Multi-cluster ApplicationSet​

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: demo-multi-cluster
  namespace: argocd
spec:
  generators:
    - clusters: {}
  template:
    metadata:
      name: 'demo-{{name}}'
    spec:
      project: default
      source:
        repoURL: https://github.com/argoproj/argocd-example-apps.git
        path: guestbook
      destination:
        server: '{{server}}'
        namespace: demo
      syncPolicy:
        automated:
          prune: true
        syncOptions:
          - CreateNamespace=true

Quiz​

Q1. How do you add an external cluster to Argo CD?

Answer

Via CLI:

argocd cluster add <kubectl-context-name>

Via Secret: Create a Secret with the label argocd.argoproj.io/secret-type: cluster containing the credentials.

Q2. How do you deploy the same app to all production clusters?

Answer

Use an ApplicationSet with the Cluster Generator:

generators:
  - clusters:
      selector:
        matchLabels:
          env: production

🔝 Back to table of contents​

Key takeaways​

  • Hub-spoke architecture: one Argo CD, multiple clusters
  • Add via CLI or declarative Secret
  • ApplicationSet with Cluster Generator for multi-cluster
  • Use labels to filter clusters
  • Apply least privilege for security

← Previous chapter | Next chapter: Security →