What is the difference between argocd app sync and refresh?

Refresh re-compares the Git state with the live cluster and updates the app status. Sync actually applies the Git state to the cluster.

Can I use the argocd CLI without exposing the Argo CD server?

Yes. Either port-forward svc/argocd-server to localhost and log in with --insecure, or use argocd login --core to talk directly to Kubernetes through your kubeconfig.

Argo CD Commands by Function and Examples

Q: How do I get the Argo CD admin password?

Run argocd admin initial-password -n argocd, or decode the argocd-initial-admin-secret secret with kubectl.

Q: Why does argocd app rollback fail?

Rollback is blocked when automated sync is enabled. Run argocd app set --sync-policy none first, roll back to the desired history ID, then re-enable auto-sync.

Q: How do I force Argo CD to delete resources removed from Git?

Use argocd app sync --prune for a one-time prune, or enable --auto-prune in the automated sync policy to prune on every sync.

Updated Jul 2026 · originally published Jul 2026 · Tested on Argo CD 2.x, Argo CD 3.x, Kubernetes

Argo CD is a declarative, GitOps native continuous delivery tool for Kubernetes. In a typical setup the application configurations (manifests, Helm charts or Kustomize) are stored in a Git repository and based on your settings it can automatically pull and then deploys them to target Kubernetes clusters. It can also continuously monitor for any configuration drift and correct it with auto heal.

The Argo CD offers a user interface for interaction however command line interface (argocd) is a powerful tool for managing GitOps workflows, troubleshooting applications and configuring cluster infrastructure from the terminal interface.

This page groups the commands by what you are actually trying to do. Every example is copy paste ready. You can just replace the placeholder values and run.

Tested against Argo CD 2.x/3.x. The CLI talks to the Argo CD API server, so you need to log in first.

Install the Argo CD using CLI in the argocd namespace, assuming kubernetes cluster is already setup

Linux:

curl -sSL -o argocd https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
sudo install -m 555 argocd /usr/local/bin/argocd
argocd version --client

macOS (Homebrew):

brew install argocd

Get the initial admin password:

argocd admin initial-password -n argocd

Or read the secret directly using kubectl command:

kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d; echo

Log in to the Argo CD server:

argocd login argocd.example.com --username admin --password 'YOUR_PASSWORD'

Log in with port-forward (no ingress needed):

kubectl port-forward svc/argocd-server -n argocd 8080:443 &
argocd login localhost:8080 --username admin --insecure

Log in using the current kubeconfig context (no password):

argocd login --core

Change the admin password:

argocd account update-password

Check who you are logged in as:

argocd account get-user-info

Switch between Argo CD servers (contexts):

argocd context
argocd context argocd.example.com

Log out:

argocd logout argocd.example.com

Creating Applications with argocd CLI

Create an app from a Git repo:

argocd app create my-app \
  --repo https://github.com/example/my-repo.git \
  --path k8s/overlays/prod \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace my-app

Create an app from a Helm chart in a repo:

argocd app create my-helm-app \
  --repo https://github.com/example/charts.git \
  --path charts/my-app \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace my-app \
  --helm-set image.tag=v1.2.3 \
  --values values-prod.yaml

Create an app from a Helm registry (OCI or classic):

argocd app create redis \
  --repo https://charts.bitnami.com/bitnami \
  --helm-chart redis \
  --revision 19.6.4 \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace redis

Create an app with auto-sync, pruning and self-heal enabled:

argocd app create my-app \
  --repo https://github.com/example/my-repo.git \
  --path k8s \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace my-app \
  --sync-policy automated \
  --auto-prune \
  --self-heal \
  --sync-option CreateNamespace=true

Create an app from a YAML manifest (declarative, recommended for GitOps):

kubectl apply -n argocd -f application.yaml

Syncing Applications

Sync an app (deploy the latest Git state):

argocd app sync my-app

Sync and wait until it is healthy:

argocd app sync my-app && argocd app wait my-app --health --timeout 300

Sync with pruning (delete resources removed from Git):

# Use with caution
argocd app sync my-app --prune

Force sync (replace resources instead of patching):

argocd app sync my-app --force

Sync only specific resources:

argocd app sync my-app --resource apps:Deployment:my-deployment

Sync all apps matching a label:

argocd app sync -l team=platform

Dry run a sync (see what would change without applying):

argocd app sync my-app --dry-run

Retry a failed sync automatically:

argocd app sync my-app --retry-limit 3 --retry-backoff-duration 10s

Inspecting Applications

List all applications:

argocd app list

List apps in a specific project:

argocd app list -p my-project

Show full details of one app:

argocd app get my-app

Show the diff between Git and the live cluster:

argocd app diff my-app

Show the rendered manifests Argo CD will apply:

argocd app manifests my-app

Show deployment history (revisions):

argocd app history my-app

Tail logs of an app’s pods:

argocd app logs my-app --follow

List individual resources managed by an app:

argocd app resources my-app

Output app status as JSON (for scripting):

argocd app get my-app -o json | jq '.status.sync.status, .status.health.status'

Rollback and Recovery

Roll back to the previous revision:

argocd app history my-app          # find the ID
argocd app rollback my-app 5       # roll back to history ID 5

Note: rollback fails if auto-sync is enabled. Disable it first:

argocd app set my-app --sync-policy none
argocd app rollback my-app 5

Re-enable auto-sync after rollback:

argocd app set my-app --sync-policy automated --auto-prune --self-heal

Refresh app state (re-compare with Git):

argocd app get my-app --refresh

Hard refresh (invalidate manifest cache):

argocd app get my-app --hard-refresh

Delete and recreate a stuck resource:

argocd app delete-resource my-app \
  --kind Deployment --resource-name my-deployment

Terminate a stuck sync operation:

argocd app terminate-op my-app

Modifying Applications

Change the target revision (branch, tag or commit):

argocd app set my-app --revision v2.0.0

Change the source path:

argocd app set my-app --path k8s/overlays/staging

Set a Helm value:

argocd app set my-app --helm-set replicaCount=3

Set an image tag with Kustomize:

argocd app set my-app --kustomize-image myrepo/myimage:v1.2.3

Enable auto-sync on an existing app:

argocd app set my-app --sync-policy automated --auto-prune --self-heal

Disable auto-sync:

argocd app set my-app --sync-policy none

Add a sync option (example: skip namespace creation validation):

argocd app set my-app --sync-option Validate=false

Deleting Applications

Delete an app and its resources:

argocd app delete my-app

Delete the app but keep the deployed resources (orphan them):

argocd app delete my-app --cascade=false

Delete without the confirmation prompt (for scripts):

argocd app delete my-app --yes

Repository Management

Add a public Git repo:

argocd repo add https://github.com/example/my-repo.git

Add a private repo over HTTPS with a token:

argocd repo add https://github.com/example/private-repo.git \
  --username git --password ghp_YOUR_TOKEN

Add a private repo over SSH:

argocd repo add [email protected]:example/private-repo.git \
  --ssh-private-key-path ~/.ssh/id_ed25519

Add a Helm repo:

argocd repo add https://charts.bitnami.com/bitnami \
  --type helm --name bitnami

Add an OCI Helm registry:

argocd repo add registry-1.docker.io/bitnamicharts \
  --type helm --name bitnami-oci --enable-oci

List and remove repos:

argocd repo list
argocd repo rm https://github.com/example/my-repo.git

Cluster Management

Register an external cluster (uses your kubeconfig context):

kubectl config get-contexts
argocd cluster add my-prod-context

List registered clusters:

argocd cluster list

Remove a cluster:

argocd cluster rm https://prod-cluster-api.example.com

Projects and RBAC

Create a project:

argocd proj create platform \
  --description "Platform team apps" \
  --src https://github.com/example/* \
  --dest https://kubernetes.default.svc,platform-*

Allow a cluster-scoped resource in a project:

argocd proj allow-cluster-resource platform "" Namespace

Add a role and token to a project (for CI/CD):

argocd proj role create platform ci-role
argocd proj role add-policy platform ci-role \
  --action sync --permission allow --object "platform/*"
argocd proj role create-token platform ci-role

List projects:

argocd proj list

Generate an API token for an account:

argocd account generate-token --account ci-bot

Admin and Troubleshooting

Check Argo CD server version:

argocd version

Reset the admin password (regenerate the initial secret):

kubectl -n argocd delete secret argocd-initial-admin-secret
kubectl -n argocd rollout restart deployment argocd-server
argocd admin initial-password -n argocd

Export all Argo CD config for backup:

argocd admin export -n argocd > argocd-backup.yaml

Import from a backup:

argocd admin import -n argocd - < argocd-backup.yaml

Check why an app is OutOfSync from the cluster side:

kubectl -n argocd get applications
kubectl -n argocd describe application my-app

Restart Argo CD components:

kubectl -n argocd rollout restart deployment argocd-server
kubectl -n argocd rollout restart deployment argocd-repo-server
kubectl -n argocd rollout restart statefulset argocd-application-controller

Quick Reference Table

Task	Command
Log in	`argocd login <server>`
Initial admin password	`argocd admin initial-password -n argocd`
Create app	`argocd app create <app> --repo <url> --path <path> --dest-server <server> --dest-namespace <ns>`
Sync app	`argocd app sync <app>`
App status	`argocd app get <app>`
Diff Git vs live	`argocd app diff <app>`
History	`argocd app history <app>`
Rollback	`argocd app rollback <app> <id>`
Delete app	`argocd app delete <app>`
Add repo	`argocd repo add <url>`
Add cluster	`argocd cluster add <context>`
List apps	`argocd app list`
Tail logs	`argocd app logs <app> --follow`
Refresh	`argocd app get <app> --refresh`

FAQ

How do I get the Argo CD admin password? Run argocd admin initial-password -n argocd, or decode the argocd-initial-admin-secret secret with kubectl.

Why does argocd app rollback fail? Rollback is blocked when automated sync is enabled. Run argocd app set <app> --sync-policy none first, roll back, then re-enable auto-sync.

What is the difference between sync and refresh? Refresh re-compares Git with the cluster and updates the status. Sync actually applies the Git state to the cluster.

How do I force Argo CD to delete resources removed from Git? Use argocd app sync <app> --prune, or enable --auto-prune in the sync policy.

Can I use the argocd CLI without exposing the server? Yes. Either port-forward svc/argocd-server and log in to localhost, or use argocd login --core to talk directly through your kubeconfig.

kubectl error: couldn’t get current server API group list (Fixed)
Browse the DevOps topic for more GitOps and Kubernetes guides
Official docs and downloads on our RefDesk