Configuration

Argo CD's runtime configuration lives in a small set of well-known ConfigMaps and Secrets in the install namespace (typically argocd). The full schema is documented at https://argo-cd.readthedocs.io/en/stable/operator-manual/argocd-cm-yaml/ and friends; this page maps each of those resources to where the loader lives in the codebase.

ConfigMaps

Name	Purpose	Loader
argocd-cm	Main settings: SSO, repo defaults, custom tooling, resource customizations, accounts, RBAC scopes.	util/settings/settings.go (ArgoCDSettings, GetSettings)
argocd-rbac-cm	Casbin policy. Built-in roles + custom policies + group bindings.	util/rbac/rbac.go (Enforcer, policyChanged)
argocd-tls-certs-cm	Trusted TLS CA certs for repos. Mounted into argocd-server and argocd-repo-server.	util/tls/, util/cert/
argocd-ssh-known-hosts-cm	SSH known-hosts file for git-over-SSH. Mounted into the repo server.	Mounted, no Go loader.
argocd-gpg-keys-cm	GPG public keys for signature verification.	util/gpg/, reposerver/gpgwatcher.go
argocd-notifications-cm	Notification triggers, templates, services, subscriptions.	util/notification/k8s/, util/notification/settings/
argocd-cmd-params-cm	Per-component command-line params expressed as ConfigMap entries.	Wired into each component's flag parsing in cmd/<binary>/commands/.

Secrets

Name	Purpose	Loader
argocd-secret	Master signing key, OIDC client secrets, webhook secrets, local-account passwords, Dex config.	util/settings/settings.go, util/dex/
argocd-notifications-secret	Notification service credentials.	util/notification/k8s/
argocd-initial-admin-secret	Bootstrap admin password (auto-generated on first install).	util/password/, cmd/argocd/commands/admin/initial_password.go
Cluster Secrets (label argocd.argoproj.io/secret-type=cluster)	Registered destination clusters.	util/db/cluster.go
Repository Secrets (label argocd.argoproj.io/secret-type=repository)	Registered source repos with credentials.	util/db/repository.go, repository_secrets.go
Repo-creds Secrets (label argocd.argoproj.io/secret-type=repo-creds)	URL-prefix-matched credential templates.	util/db/repo_creds.go

Notification catalog ConfigMap

notifications_catalog/install.yaml packages the curated triggers/templates as a single ConfigMap that operators apply alongside argocd-notifications-cm. The catalog source lives in notifications_catalog/triggers/ and notifications_catalog/templates/.

Reload behavior

util/settings/settings.go watches its source ConfigMaps and Secrets via a Kubernetes informer. Updates trigger a typed SettingsChanged event and components subscribe to it (the API server, controllers, repo server). This means most configuration changes take effect within seconds without a restart.

GPG keys and TLS certs reload via mount-based watches (reposerver/gpgwatcher.go and util/tls/).

Per-component flags vs ConfigMap

Most binary flags also have a corresponding entry in argocd-cmd-params-cm so operators can change them without editing the Deployment. The mapping is wired in each binary's commands/ package — for example cmd/argocd-server/commands/argocd_server.go reads default values from environment variables that the install YAML populates from the ConfigMap.

See also

• docs/operator-manual/argocd-cm-yaml/ — the canonical user-facing reference.
• features/sso-and-rbac — RBAC policy details.
• Security — secrets handling and trust boundaries.