Examples

Basic ImageUpdater with global defaults

apiVersion: argocd-image-updater.argoproj.io/v1alpha1
kind: ImageUpdater
metadata:
  name: my-image-updater
  namespace: argocd
spec:
  commonUpdateSettings:
    updateStrategy: "semver"
    forceUpdate: false
  applicationRefs:
    - namePattern: "my-app-*"
      images:
        - alias: "nginx"
          imageName: "nginx:1.20"

ImageUpdater with application-specific overrides

apiVersion: argocd-image-updater.argoproj.io/v1alpha1
kind: ImageUpdater
metadata:
  name: my-image-updater
  namespace: argocd
spec:
  commonUpdateSettings:
    updateStrategy: "semver"
  applicationRefs:
    - namePattern: "production-*"
      commonUpdateSettings:
        updateStrategy: "digest"  # Override for production apps
      images:
        - alias: "app"
          imageName: "myapp:latest"
    - namePattern: "staging-*"
      images:
        - alias: "app"
          imageName: "myapp:latest"
          commonUpdateSettings:
            updateStrategy: "newest-build"  # Override for this specific image

ImageUpdater with Git write-back

apiVersion: argocd-image-updater.argoproj.io/v1alpha1
kind: ImageUpdater
metadata:
  name: my-image-updater
  namespace: argocd
spec:
  writeBackConfig:
    method: "git"
    gitConfig:
      repository: "git@github.com:myorg/myrepo.git"
      branch: "main"
      writeBackTarget: "helmvalues:./values.yaml"
  applicationRefs:
    - namePattern: "my-app-*"
      images:
        - alias: "nginx"
          imageName: "nginx:1.20"
          manifestTargets:
            helm:
              name: "image.repository"
              tag: "image.tag"

Using digest update strategy for tracking mutable tags

apiVersion: argocd-image-updater.argoproj.io/v1alpha1
kind: ImageUpdater
metadata:
  name: dev-image-updater
  namespace: argocd
spec:
  commonUpdateSettings:
    updateStrategy: "digest"
  writeBackConfig:
    method: "argocd"
  applicationRefs:
    - namePattern: "dev"
      images:
        - alias: "api"
          imageName: "registry.com/vendor/api:latest"
        - alias: "front"
          imageName: "registry.com/vendor/front:latest"
---
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: app
          image: registry.com/vendor/api@sha256:38089... # Initial sha

Checking ImageUpdater status

After creating an ImageUpdater CR, you can monitor its status:

# Quick overview of all ImageUpdater resources
kubectl get imageupdater -n argocd

# Detailed status for a specific resource
kubectl get imageupdater production-updater -n argocd -o jsonpath='{.status}' | jq .

# Check conditions
kubectl get imageupdater production-updater -n argocd -o jsonpath='{.status.conditions}' | jq .

# Check recent image updates
kubectl get imageupdater production-updater -n argocd -o jsonpath='{.status.recentUpdates}' | jq .

Example status output:

status:
  observedGeneration: 3
  lastCheckedAt: "2026-03-02T22:10:00Z"
  lastUpdatedAt: "2026-03-02T22:12:35Z"
  applicationsMatched: 2
  imagesManaged: 3
  recentUpdates:
    - alias: "nginx"
      image: "nginx:1.20"
      newVersion: "1.21.0"
      applicationsUpdated: 2
      updatedAt: "2026-03-02T22:12:35Z"
      message: "Updated to latest semver version."
  conditions:
    - type: "Ready"
      status: "True"
      reason: "ReconcileSucceeded"
      message: "Reconciled 2 applications, 1 images updated."
    - type: "Reconciling"
      status: "False"
      reason: "Idle"
      message: "Last check completed. Awaiting next cycle."
    - type: "Error"
      status: "False"
      reason: "NoErrors"
      message: "No errors during last reconciliation."

ImageUpdater with GitHub Pull Request write-back

Opens a pull request for each image update instead of pushing directly to the tracked branch. Useful when the base branch is protected.

apiVersion: argocd-image-updater.argoproj.io/v1alpha1
kind: ImageUpdater
metadata:
  name: my-pr-image-updater
  namespace: argocd
spec:
  writeBackConfig:
    # HTTPS PAT or GitHub App credentials are required; SSH is not supported for PR mode.
    method: "git:secret:git-creds"
    gitConfig:
      repository: "https://github.com/myorg/myrepo.git"
      # Specify only the base branch. The colon "base:target" format is not
      # supported in PR mode and will cause a validation error.
      branch: "main"
      pullRequest:
        github: {}
  applicationRefs:
    - namePattern: "my-app"
      images:
        - alias: "api"
          imageName: "registry.com/myorg/api:1.x"
          commonUpdateSettings:
            updateStrategy: "semver"
      writeBackConfig:
        method: "git:secret:git-creds"
        gitConfig:
          writeBackTarget: "helmvalues:/helm/values.yaml"

The controller automatically pushes the update to a branch named image-updater-<targetKey>-<sha256> (where <targetKey> is a short hash of the write-back target) and opens a pull request from that branch into main. If an open PR for the same pair already exists it is left untouched. Multiple applications sharing the same write-back target will reuse the same PR branch, avoiding duplicate pull requests.

For Azure Repos, see the Azure DevOps configuration example. For Gitea or Forgejo, see the Gitea configuration example.

Using semver update strategy with version constraints

apiVersion: argocd-image-updater.argoproj.io/v1alpha1
kind: ImageUpdater
metadata:
  name: prod-image-updater
  namespace: argocd
spec:
  writeBackConfig:
    method: "argocd"
  applicationRefs:
    - namePattern: "prod"
      images:
        - alias: "api"
          imageName: "registry.com/vendor/api:1.x"
          commonUpdateSettings:
            updateStrategy: "semver"
        - alias: "front"
          imageName: "registry.com/vendor/front:1.x"
          commonUpdateSettings:
            updateStrategy: "semver"
---
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: app
          image: registry.com/vendor/api:1.0