argocd CLI

The argocd command is the primary client for argocd-server. It is what humans, CI pipelines, and kubectl plugins use to drive Argo CD.

Purpose

• Authenticate against the Argo CD API server (or, in --core mode, talk directly to Kubernetes).
• Manage Applications, ApplicationSets, Projects, repositories, clusters, and accounts.
• Run common operational tasks: sync, refresh, rollback, wait, diff, terminal, port-forward.
• Run admin tasks (export/import, dashboard, initial password) via argocd admin.

Where it lives

Path	What it does
cmd/argocd/commands/root.go	Builds the root cobra command and registers all subcommands.
cmd/argocd/commands/app.go	The largest command package — all argocd app … subcommands. ~145 KB.
cmd/argocd/commands/applicationset.go	argocd appset ….
cmd/argocd/commands/cluster.go	argocd cluster ….
cmd/argocd/commands/repo.go, repocreds.go	argocd repo …, argocd repocreds ….
cmd/argocd/commands/project.go, project_role.go, projectwindows.go	argocd proj ….
cmd/argocd/commands/account.go	argocd account ….
cmd/argocd/commands/login.go, relogin.go, logout.go, context.go	Authentication and config context.
cmd/argocd/commands/cert.go, gpg.go	Certificate and GPG key management.
cmd/argocd/commands/admin/	The argocd admin subtree (backup, settings, redis-initial-password, dashboard, …).
cmd/argocd/commands/headless/	"Core mode" — runs an in-process API server when --core is set.
cmd/argocd/commands/initialize/	Cobra command-init helpers shared across subcommands.
cmd/argocd/commands/plugin.go	kubectl-style plugin dispatcher (argocd-foo binaries on PATH).

How it works

NewCommand() in cmd/argocd/commands/root.go wires every subcommand and persistent flag:

command.AddCommand(initialize.InitCommand(NewVersionCmd(&clientOpts, nil)))
command.AddCommand(initialize.InitCommand(NewClusterCommand(&clientOpts, pathOpts)))
command.AddCommand(initialize.InitCommand(NewApplicationCommand(&clientOpts)))
command.AddCommand(initialize.InitCommand(NewAppSetCommand(&clientOpts)))
command.AddCommand(NewLoginCommand(&clientOpts))
// ...

Persistent flags include --server, --auth-token, --insecure, --grpc-web, --port-forward, --core, --config, and the global --loglevel / --logformat. They live in cmd/argocd/commands/root.go.

Authentication and config

• Local config (server URL, auth token, current context) lives in a YAML file at ~/.config/argocd/config by default. util/localconfig/ reads/writes it.
• argocd login, argocd context, argocd relogin, and argocd logout mutate that file.
• --core short-circuits the API server entirely: the CLI starts an embedded headless API server inside the same process (cmd/argocd/commands/headless/) that talks directly to Kubernetes using your kubeconfig.

Plugin protocol

cmd/argocd/commands/plugin.go implements a kubectl-style plugin model: any executable on PATH named argocd-<name> is invoked when argocd <name> is not a built-in subcommand. NewDefaultPluginHandler() is referenced from cmd/main.go so plugin errors surface their real exit codes.

Admin tools

argocd admin … (in cmd/argocd/commands/admin/) is the Swiss army knife for cluster operators:

Subcommand	What it does	File
argocd admin export / import	Backup and restore the Argo CD state.	admin/backup.go
argocd admin settings	Inspect/lint argocd-cm/argocd-secret.	admin/settings.go, admin/settings_rbac.go
argocd admin app generate-spec	Build an Application spec from CLI flags.	admin/app.go
argocd admin cluster	Print cluster state, generate clusterRoleBindings.	admin/cluster.go
argocd admin dashboard	Open the local UI via port-forward.	admin/dashboard.go
argocd admin initial-password	Reveal the bootstrap admin password.	admin/initial_password.go
argocd admin notifications	Run the notifications controller's CLI tools.	admin/notifications.go
argocd admin proj	Project allowlist generation.	admin/project.go, admin/project_allowlist.go
argocd admin redis-initial-password	Reveal the Redis bootstrap password.	admin/redis_initial_password.go
argocd admin repo	Repo CLI tools that bypass the API server.	admin/repo.go

Connecting to the server

The CLI uses the gRPC client packages under pkg/apiclient/<service>/ (generated from the proto files). Persistent flags configure how the connection is established:

• --server — host:port of argocd-server.
• --insecure, --plaintext, --server-crt — TLS.
• --grpc-web, --grpc-web-root-path — when behind a proxy that doesn't speak HTTP/2.
• --port-forward, --port-forward-namespace — automatic port-forward into the cluster.
• --core — bypass the server entirely.

Entry points for modification

• Add a top-level subcommand → write NewFooCommand and register it in cmd/argocd/commands/root.go.
• Add an argocd app <verb> → extend cmd/argocd/commands/app.go (it is intentionally one big file with one cobra subcommand per verb).
• Add an admin tool → drop a file in cmd/argocd/commands/admin/ and register it from admin/admin.go.

For the wire protocol the CLI speaks, see argocd-server and API.