Skip to content

Running Argo CD Image Updater

The argocd-image-updater provides some command line parameters to control the behaviour of its operations. The following is a list of available parameters and their description.

Command "version"


argocd-image-updater version


Prints out the version of the binary and exits.

Command "run"


argocd-image-updater run [flags]


Runs the Argo CD Image Updater, possibly in an endless loop.


--argocd-auth-token token

Use token for authenticating to the Argo CD API. This token must be a base64 encoded JWT, as generated by Argo CD.

The token can also be set using the ARGOCD_TOKEN environment variable.


If this flag is given, use the gRPC-web protocol to connect to the Argo CD API. This can be useful if your Argo CD API is behind a proxy that does not support HTTP/2, or only accept HTTP/2 on the front end.

Can also be set using the ARGOCD_GRPC_WEB environment variable.


If specified, the certificate of the Argo CD API server is not verified. Useful if you are using a self-signed TLS certificate for the Argo CD API server. As the name implies, this is an insecure setting and should not be used for production systems.

Can also be set using the ARGOCD_INSECURE environment variable.


If specified, use an unencrypted HTTP connection to the ArgoCD API instead of TLS.

Can also be set using the ARGOCD_PLAINTEXT environment variable.

--argocd-server-addr server address

Connect to the Argo CD API server at server address. server address must be a valid IP address or DNS host name, optionally with a port specification delimited using a colon, i.e. or argocd-server.argocd:8080. If no port given, the protocol default will be used: Port 80 for plaintext connections, and port 443 for TLS connections.

Can also be set using the ARGOCD_SERVER environment variable.


If running locally, and you do not have a working connection to any Kubernetes cluster, this flag will prevent Argo CD Image Updater from creating a client to interact with Kubernetes. When Kubernetes access is disabled, pull secrets for images can only be specified from an environment variable.


If this flag is set, Argo CD Image Updater won't actually perform any changes to workloads it found in need for upgrade.

--health-port port

Specifies the local port to bind the health server to. The health server is used to provide health and readiness probes when running as K8s workload. Use value 0 for port to disable launching the health server.

--interval duration

Sets the interval for checking whether there are new images available to duration. duration must be given as a valid duration identifier with a unit suffix, i.e. 2m for 2 minutes or 30s for 30 seconds. If no unit is given, milliseconds will be assumed. If set to 0, ArgoCD Image Updater will exit after the first run, effectively disabling the interval. Default value is 2m0s.

--kubeconfig path

Specify the Kubernetes client config file to use when running outside a Kubernetes cluster, i.e. ~/.kube/config. When specified, Argo CD Image Updater will use the currently active context in the configuration to connect to the Kubernetes cluster.

--loglevel level

Set the log level to level, where level can be one of trace, debug, info, warn or error.

Can also be set using the IMAGE_UPDATER_LOGLEVEL environment variable.

--match-application-name pattern

Only process applications that have a valid annotation and matches the given pattern. The pattern is a simple glob pattern and supports file system style wildcards, i.e. *-staging would match any application name with a suffix of -staging. Can be specified multiple times to define more than one pattern, from which at least one has to match.

--max-concurrency number

Process a maximum of number applications concurrently. To disable concurrent application processing, specify a number of 1.


A shortcut for specifying --check-interval 0 --health-port 0. If given, Argo CD Image Updater will exit after the first update cycle.

--registries-conf-path path

Load the registry configuration from file at path. Defaults to the path /app/config/registries.conf. If no configuration should be loaded, and the default configuration should be used instead, specify the empty string, i.e. --registries-conf-path="".