In this lesson, you will learn how to securely expose the Argo CD API server to facilitate administrative dashboard access within your Kubernetes cluster.
Once you have installed Argo CD via Helm, the API server—which powers both the Web UI and the argocd CLI—is typically configured as a ClusterIP service by default. This is secure but unreachable from outside your cluster. To interact with your GitOps controller, you must expose it via a stable ingress point.
Secure Access via Ingress
The recommended production approach is to use an Ingress controller (like NGINX or Traefik). You must configure your Ingress resource to handle TLS termination, as Argo CD requires HTTPS for secure communication.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: argocd-server-ingress
annotations:
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
spec:
ingressClassName: nginx
rules:
- host: argocd.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: argocd-server
port:
number: 443
Note: Because Argo CD performs TLS termination internally, using ssl-passthrough is often necessary to avoid conflicts between the Ingress controller and the Argo CD server.
Temporary Access via Port-Forwarding
For quick administrative tasks, troubleshooting, or local development where setting up an Ingress is overkill, you can bypass external exposure entirely using kubectl port-forward. This creates a temporary, encrypted tunnel between your local machine and the cluster service.
Run the following command in your terminal:
kubectl port-forward svc/argocd-server -n argocd 8080:443
Once executed, you can point your browser to https://localhost:8080. Since this connection is local to your machine, it is highly secure and ideal for initial cluster setup or emergency intervention. Avoid using this for continuous team access, as it requires an active terminal session and lacks the scalability of an Ingress-based routing layer.
Key Takeaway: Use Ingress controllers for persistent, secure team access to the Argo CD dashboard, and reserve port-forwarding for isolated administrative tasks and rapid troubleshooting.