Argo CDargocd admin export命令详解导出全部 Argo CD 数据到 stdout 或文件【免费下载链接】argo-cdDeclarative Continuous Deployment for Kubernetes项目地址: https://gitcode.com/GitHub_Trending/ar/argo-cd本文基于 Argo CD 官方命令参考文档 argocd_admin_export.md 及其底层源码实现系统讲解argocd admin export命令的完整参数、导出数据范围、命名空间过滤规则与--strip-status清理机制并结合 cmd/argocd/commands/admin/backup.go 中的真实实现说明导出产物干净、可重建这一特性的成因。读完后你将能够独立完成 Argo CD 集群的完整数据备份配置、密钥、项目、Application 与 ApplicationSet并理解备份文件在后续argocd admin import恢复时的可消费性。命令定位admin 组下的离线备份工具argocd admin命令组是 Argo CD 为管理员提供的一组需要直接访问 Kubernetes API 服务器的工具命令见 NewAdminCommand 的定义其 Short 描述即 Contains a set of commands useful for Argo CD administrators and requires direct Kubernetes access。export是其中的核心备份命令官方定义为argocd admin export [flags]Export all Argo CD data to stdout (default) or a file导出所有 Argo CD 数据到 stdout默认或文件与通过 Argo CD API Server 交互的普通 CLI 命令不同export直接使用 kubeconfig 中的凭据与集群 API 通信因此它要求执行者拥有对 Argo CD 控制面命名空间默认即安装时的 namespace中相关资源的读写权限。导出数据范围到底导出了哪些资源结合 NewExportCommand 的 Run 函数一条argocd admin export会按以下顺序导出四类资源1. 四个核心 ConfigMap命令会显式Get并导出以下四个命名固定的 ConfigMap名称常量定义见 common/common.goConfigMap 名称用途argocd-cmcommon.ArgoCDConfigMapNameArgo CD 主配置argocd-rbac-cmcommon.ArgoCDRBACConfigMapNameRBAC 策略配置argocd-ssh-known-hosts-cmcommon.ArgoCDKnownHostsConfigMapNameSSH 已知主机指纹argocd-tls-certs-cmcommon.ArgoCDTLSCertsConfigMapName自定义 CA/TLS 证书这与源码中 isArgoCDConfigMap 函数认定的well known configmaps名单完全一致。2. Argo CD 相关的 Secret命令会列出命名空间内全部 Secret并用 isArgoCDSecret 过滤出属于 Argo CD 的条目满足以下任一条件即被导出名称为argocd-secret包含admin.password、server.secretkey等关键凭证见测试构造函数 newSecretsObject带有argocd.argoproj.io/secret-type标签即common.LabelKeySecretType仓库凭据、集群凭据等 Secret 均带此标签带有managed-by: argocd.argoproj.io注解common.AnnotationKeyManagedBycommon.AnnotationValueManagedByArgoCD。也就是说仓库 HTTPS 凭据、SSH 证书、集群 kubeconfig 等凭据都会被一并备份而命名空间中与 Argo CD 无关的 Secret 会被自动排除。3. AppProject 与 ApplicationAppProject控制面命名空间内的全部 AppProject 都会导出不做命名空间过滤。Application默认只导出控制面命名空间Argo CD namespace内的 Application如果显式指定了额外的应用命名空间则先列出全部命名空间的 Application 再做后置过滤源码注释明确写道 To support applications and applicationsets in any namespace, we must list ALL namespaces and filter them afterwards见 backup.go#L80-L86。4. ApplicationSet可选CRD 不存在时优雅降级ApplicationSet 的导出是容错的如果集群未安装 ApplicationSet CRDIsNotFound或当前账号无权限IsForbidden命令仅记录一条 warning 并继续执行而不是整体失败见 backup.go#L123-L130。命名空间过滤规则--application-namespaces与--applicationset-namespaces这两个 flag 是export命令最具特色的参数其取值遵循一个三级优先回退规则与 argocd_admin_export.md 中的 Options 描述一致命令行显式指定--application-namespaces ns1,ns2,ns-*逗号分隔的命名空间 glob 列表未指定时回退读取argocd-cmd-params-cmConfigMap 中的application.namespacesApplicationSet 对应applicationsetcontroller.namespaces键值该逻辑由 getAdditionalNamespaces 实现值按逗号拆分并去除空白两者都未定义时只导出控制面命名空间内的 Application/ApplicationSet。无论哪一级生效控制面命名空间Argo CD namespace内的 Application/ApplicationSet 总是被导出额外命名空间只是叠加。判断是否允许导出某命名空间的核心函数是 IsNamespaceEnabledfunc IsNamespaceEnabled(namespace string, serverNamespace string, enabledNamespaces []string) bool { return namespace serverNamespace || glob.MatchStringInList(enabledNamespaces, namespace, glob.REGEXP) }从源码结构看列表中的条目按正则 glob 语义匹配glob.REGEXP因此apps-*、team-a这类写法都合法。该判断同时被 export 与 import 复用保证导得出的命名空间导得回两侧白名单语义对称。完整参数说明命令自身 Options以下为argocd admin export的完整选项继承自 argocd_admin_export.md 原文档--application-namespaces strings Comma-separated list of namespace globs to export applications from, in addition to the control plane namespace (Argo CD namespace). By default, all applications from the control plane namespace are always exported. If this flag is provided, applications from the specified namespaces are exported along with the control plane namespace. If not specified, the value from application.namespaces in argocd-cmd-params-cm is used (if defined in the ConfigMap). If the ConfigMap value is not set, only applications from the control plane namespace are exported. --applicationset-namespaces strings Comma-separated list of namespace globs to export ApplicationSets from, in addition to the control plane namespace (Argo CD namespace). By default, all ApplicationSets from the control plane namespace are always exported. If this flag is provided, ApplicationSets from the specified namespaces are exported along with the control plane namespace. If not specified, the value from applicationsetcontroller.namespaces in argocd-cmd-params-cm is used (if defined in the ConfigMap). If the ConfigMap value is not set, only ApplicationSets from the control plane namespace are exported. --as string Username to impersonate for the operation --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server -h, --help help for export --insecure-skip-tls-verify If true, the servers certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to a kube config. Only required if out-of-cluster -n, --namespace string If present, the namespace scope for this CLI request -o, --out string Output to the specified file instead of stdout (default -) --password string Password for basic authentication to the API server --proxy-url string If provided, this URL will be used to connect via proxy --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means dont timeout requests. (default 0) --server string The address and port of the Kubernetes API server --strip-status Strip status field from exported resources for a clean, re-creatable manifest set --tls-server-name string If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used. --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server其中几个核心参数值得单独强调参数默认值说明与影响-o, --out-stdout输出目标。值为-时写 stdout否则os.Create创建文件并使用bufio.Writer缓冲写入退出前统一 Flush见 backup.go#L55-L69--application-namespaces回退argocd-cmd-params-cm的application.namespaces控制额外导出的 Application 命名空间glob 语义逗号分隔--applicationset-namespaces回退argocd-cmd-params-cm的applicationsetcontroller.namespaces控制额外导出的 ApplicationSet 命名空间glob 语义--strip-statusfalse从导出资源中移除status字段得到干净、可重建的 manifest 集合-n, --namespacekubeconfig 当前命名空间指定控制面Argo CD命名空间ConfigMap/Secret 的读取以及 Application 的默认白名单都以它为基准其余--kubeconfig、--context、--server、--token、--as等为标准 kubectl 风格的连接参数由 cli.AddKubectlFlagsToCmd 统一注入用于选择直接访问 Kubernetes 的哪条通道。从父命令继承的 OptionsargocdCLI 的所有全局参数同样可用于argocd admin export--argocd-context string The name of the Argo-CD server context to use --auth-token string Authentication token; set this or the ARGOCD_AUTH_TOKEN environment variable --client-crt string Client certificate file --client-crt-key string Client certificate key file --config string Path to Argo CD config (default /home/user/.config/argocd/config) --controller-name string Name of the Argo CD Application controller; set this or the ARGOCD_APPLICATION_CONTROLLER_NAME environment variable when the controllers name label differs from the default, for example when installing via the Helm chart (default argocd-application-controller) --core If set to true then CLI talks directly to Kubernetes instead of talking to Argo CD API server --grpc-web Enables gRPC-web protocol. Useful if Argo CD server is behind proxy which does not support HTTP2. --grpc-web-root-path string Enables gRPC-web protocol. Useful if Argo CD server is behind proxy which does not support HTTP2. Set web root. -H, --header strings Sets additional header to all requests made by Argo CD CLI. (Can be repeated multiple times to add multiple headers, also supports comma separated headers) --http-retry-max int Maximum number of retries to establish http connection to Argo CD server --insecure Skip server certificate and domain verification --kube-context string Directs the command to the given kube-context --logformat string Set the logging format. One of: json|text (default json) --loglevel string Set the logging level. One of: debug|info|warn|error (default info) --plaintext Disable TLS --port-forward Connect to a random argocd-server port using port forwarding --port-forward-namespace string Namespace name which should be used for port forwarding --prompts-enabled Force optional interactive prompts to be enabled or disabled, overriding local configuration. If not specified, the local configuration value will be used, which is false by default. --redis-compress string Enable this if the application controller is configured with redis compression enabled. (possible values: gzip, none) (default gzip) --redis-haproxy-name string Name of the Redis HA Proxy; set this or the ARGOCD_REDIS_HAPROXY_NAME environment variable when the HA Proxys name label differs from the default, for example when installing via the Helm chart (default argocd-redis-ha-haproxy) --redis-name string Name of the Redis deployment; set this or the ARGOCD_REDIS_NAME environment variable when the Rediss name label differs from the default, for example when installing via the Helm chart (default argocd-redis) --repo-server-name string Name of the Argo CD Repo server; set this or the ARGOCD_REPO_SERVER_NAME environment variable when the servers name label differs from the default, for example when installing via the Helm chart (default argocd-repo-server) --server-crt string Server certificate file --server-name string Name of the Argo CD API server; set this or the ARGOCD_SERVER_NAME environment variable when the servers name label differs from the default, for example when installing via the Helm chart (default argocd-server)底层实现导出产物为什么是干净、可重建的理解 export() 函数 是理解备份文件格式的关键。它对每个待导出对象执行如下清理流程整体移除metadata子树unstructured.RemoveNestedField(un.Object, metadata)——这会一并抹掉uid、resourceVersion、creationTimestamp、generation、managedFields等运行时杂物保证导出文件不包含任何与具体集群实例绑定的标识按需重新写回有保留价值的元数据name、finalizers、labels、annotations、apiVersion、kind被逐一重新设置命名空间策略只有当资源命名空间不等于控制面命名空间时才显式写入namespace字段Explicitly add the namespace for appset and apps in any namespace见 backup.go#L475-L478。这意味着控制面内的资源在导出文件中不带 namespace恢复时由 import 侧统一落到 Argo CD namespace--strip-status开关为真时调用unstructured.RemoveNestedField(un.Object, status)把 Application 的 sync/health 状态、ApplicationSet 的 controller 状态等运行时字段全部剥离得到一个纯粹由 spec 定义的可重建 manifest 集合序列化与分隔对象被 marshal 成 YAML 写入 writer并在末尾追加---\n分隔符常量yamlSeparator定义于 admin.go#L25-L31。由此得到的备份文件是一个标准的多文档 YAML 流multi-document YAML stream每个文档之间以---分隔既可直接kubectl apply -f也可作为argocd admin import的输入。这一设计与 argocd admin import 的kube.SplitYAML(input)解析逻辑见 NewImportCommand严格对应import 侧对缺少 namespace 的对象默认回填 Argo CD namespaceFor objects without namespace, assume they belong in ArgoCD namespace。实战用法示例以下命令均可在当前仓库对应版本的 Argo CD CLI 上直接运行前提kubeconfig 已指向目标集群且具备 Argo CD 控制面命名空间内相关资源的访问权限。# 1. 全量导出到 stdout默认 -o 为 -可直接重定向到文件 argocd admin export backup.yaml # 2. 直接导出到指定文件内部走 bufio 缓冲写 Flush argocd admin export -o backup.yaml # 3. 指定控制面命名空间例如 Argo CD 安装在 argocd 之外 argocd admin export -n argocd -o backup.yaml # 4. 叠加导出其他命名空间中的 Application控制面内的始终包含在内 argocd admin export --application-namespaces apps-dev,apps-qa # 5. glob 写法批量覆盖某团队的命名空间前缀 argocd admin export --application-namespaces apps-* \ --applicationset-namespaces appsets-* # 6. 导出干净、可重建的 manifest 集去掉 status 字段 argocd admin export --strip-status -o backup.yaml # 7. 指定 kubeconfig 访问远端集群 argocd admin export --kubeconfig ~/.kube/prod-config -o prod-backup.yaml几个实践要点备份文件包含敏感信息argocd-secret管理员密码、服务端密钥、仓库凭据 Secret、集群凭据 Secret 都在导出范围内备份文件应按密钥级别管控与加密。ApplicationSet 不是硬性依赖即使集群未部署 ApplicationSet CRD 或缺少相应 RBACexport 也只会打印 warning 并跳过该部分其余资源照常导出。与 import 的语义对称性export 时用哪一套命名空间白名单导出的资源import 时默认也按同一套白名单flag →argocd-cmd-params-cm→ 仅控制面决定是否恢复判断逻辑同样走 IsNamespaceEnabled两侧不会导出了却恢复不了。验证与测试依据上述行为在仓库测试中均有对应覆盖admin_test.go 验证了getAdditionalNamespaces对argocd-cmd-params-cm中application.namespaces/applicationsetcontroller.namespaces的解析包括带空格的 foo , bar* 之类的取值清洗backup_test.go 则构造了argocd-cm、argocd-secret、AppProject、Application、ApplicationSet 等典型对象用于校验 export/import 两侧的清理、tracking 标签与状态处理逻辑。小结argocd admin export用一条命令即可完成 Argo CD 控制面的逻辑备份四个核心 ConfigMap、所有 Argo CD 凭据 Secret、全部 AppProject、以及按命名空间白名单过滤的 Application 与 ApplicationSet输出为以---分隔的干净多文档 YAML。通过--application-namespaces/--applicationset-namespaces或其argocd-cmd-params-cm中的对应键可以精确控制跨命名空间资源范围--strip-status则进一步剥离运行时状态产出可直接用于重建实例的 manifest 集。它与argocd admin import共同构成 Argo CD 官方推荐的迁移与灾备链路相关命令参考见 argocd_admin.md 与 argocd_admin_import.md。【免费下载链接】argo-cdDeclarative Continuous Deployment for Kubernetes项目地址: https://gitcode.com/GitHub_Trending/ar/argo-cd创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考 Argo CD `argocd admin export` 命令详解：导出全部 Argo CD 数据到 stdout 或文件
Argo CDargocd admin export命令详解导出全部 Argo CD 数据到 stdout 或文件【免费下载链接】argo-cdDeclarative Continuous Deployment for Kubernetes项目地址: https://gitcode.com/GitHub_Trending/ar/argo-cd本文基于 Argo CD 官方命令参考文档 argocd_admin_export.md 及其底层源码实现系统讲解argocd admin export命令的完整参数、导出数据范围、命名空间过滤规则与--strip-status清理机制并结合 cmd/argocd/commands/admin/backup.go 中的真实实现说明导出产物干净、可重建这一特性的成因。读完后你将能够独立完成 Argo CD 集群的完整数据备份配置、密钥、项目、Application 与 ApplicationSet并理解备份文件在后续argocd admin import恢复时的可消费性。命令定位admin 组下的离线备份工具argocd admin命令组是 Argo CD 为管理员提供的一组需要直接访问 Kubernetes API 服务器的工具命令见 NewAdminCommand 的定义其 Short 描述即 Contains a set of commands useful for Argo CD administrators and requires direct Kubernetes access。export是其中的核心备份命令官方定义为argocd admin export [flags]Export all Argo CD data to stdout (default) or a file导出所有 Argo CD 数据到 stdout默认或文件与通过 Argo CD API Server 交互的普通 CLI 命令不同export直接使用 kubeconfig 中的凭据与集群 API 通信因此它要求执行者拥有对 Argo CD 控制面命名空间默认即安装时的 namespace中相关资源的读写权限。导出数据范围到底导出了哪些资源结合 NewExportCommand 的 Run 函数一条argocd admin export会按以下顺序导出四类资源1. 四个核心 ConfigMap命令会显式Get并导出以下四个命名固定的 ConfigMap名称常量定义见 common/common.goConfigMap 名称用途argocd-cmcommon.ArgoCDConfigMapNameArgo CD 主配置argocd-rbac-cmcommon.ArgoCDRBACConfigMapNameRBAC 策略配置argocd-ssh-known-hosts-cmcommon.ArgoCDKnownHostsConfigMapNameSSH 已知主机指纹argocd-tls-certs-cmcommon.ArgoCDTLSCertsConfigMapName自定义 CA/TLS 证书这与源码中 isArgoCDConfigMap 函数认定的well known configmaps名单完全一致。2. Argo CD 相关的 Secret命令会列出命名空间内全部 Secret并用 isArgoCDSecret 过滤出属于 Argo CD 的条目满足以下任一条件即被导出名称为argocd-secret包含admin.password、server.secretkey等关键凭证见测试构造函数 newSecretsObject带有argocd.argoproj.io/secret-type标签即common.LabelKeySecretType仓库凭据、集群凭据等 Secret 均带此标签带有managed-by: argocd.argoproj.io注解common.AnnotationKeyManagedBycommon.AnnotationValueManagedByArgoCD。也就是说仓库 HTTPS 凭据、SSH 证书、集群 kubeconfig 等凭据都会被一并备份而命名空间中与 Argo CD 无关的 Secret 会被自动排除。3. AppProject 与 ApplicationAppProject控制面命名空间内的全部 AppProject 都会导出不做命名空间过滤。Application默认只导出控制面命名空间Argo CD namespace内的 Application如果显式指定了额外的应用命名空间则先列出全部命名空间的 Application 再做后置过滤源码注释明确写道 To support applications and applicationsets in any namespace, we must list ALL namespaces and filter them afterwards见 backup.go#L80-L86。4. ApplicationSet可选CRD 不存在时优雅降级ApplicationSet 的导出是容错的如果集群未安装 ApplicationSet CRDIsNotFound或当前账号无权限IsForbidden命令仅记录一条 warning 并继续执行而不是整体失败见 backup.go#L123-L130。命名空间过滤规则--application-namespaces与--applicationset-namespaces这两个 flag 是export命令最具特色的参数其取值遵循一个三级优先回退规则与 argocd_admin_export.md 中的 Options 描述一致命令行显式指定--application-namespaces ns1,ns2,ns-*逗号分隔的命名空间 glob 列表未指定时回退读取argocd-cmd-params-cmConfigMap 中的application.namespacesApplicationSet 对应applicationsetcontroller.namespaces键值该逻辑由 getAdditionalNamespaces 实现值按逗号拆分并去除空白两者都未定义时只导出控制面命名空间内的 Application/ApplicationSet。无论哪一级生效控制面命名空间Argo CD namespace内的 Application/ApplicationSet 总是被导出额外命名空间只是叠加。判断是否允许导出某命名空间的核心函数是 IsNamespaceEnabledfunc IsNamespaceEnabled(namespace string, serverNamespace string, enabledNamespaces []string) bool { return namespace serverNamespace || glob.MatchStringInList(enabledNamespaces, namespace, glob.REGEXP) }从源码结构看列表中的条目按正则 glob 语义匹配glob.REGEXP因此apps-*、team-a这类写法都合法。该判断同时被 export 与 import 复用保证导得出的命名空间导得回两侧白名单语义对称。完整参数说明命令自身 Options以下为argocd admin export的完整选项继承自 argocd_admin_export.md 原文档--application-namespaces strings Comma-separated list of namespace globs to export applications from, in addition to the control plane namespace (Argo CD namespace). By default, all applications from the control plane namespace are always exported. If this flag is provided, applications from the specified namespaces are exported along with the control plane namespace. If not specified, the value from application.namespaces in argocd-cmd-params-cm is used (if defined in the ConfigMap). If the ConfigMap value is not set, only applications from the control plane namespace are exported. --applicationset-namespaces strings Comma-separated list of namespace globs to export ApplicationSets from, in addition to the control plane namespace (Argo CD namespace). By default, all ApplicationSets from the control plane namespace are always exported. If this flag is provided, ApplicationSets from the specified namespaces are exported along with the control plane namespace. If not specified, the value from applicationsetcontroller.namespaces in argocd-cmd-params-cm is used (if defined in the ConfigMap). If the ConfigMap value is not set, only ApplicationSets from the control plane namespace are exported. --as string Username to impersonate for the operation --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server -h, --help help for export --insecure-skip-tls-verify If true, the servers certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to a kube config. Only required if out-of-cluster -n, --namespace string If present, the namespace scope for this CLI request -o, --out string Output to the specified file instead of stdout (default -) --password string Password for basic authentication to the API server --proxy-url string If provided, this URL will be used to connect via proxy --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means dont timeout requests. (default 0) --server string The address and port of the Kubernetes API server --strip-status Strip status field from exported resources for a clean, re-creatable manifest set --tls-server-name string If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used. --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server其中几个核心参数值得单独强调参数默认值说明与影响-o, --out-stdout输出目标。值为-时写 stdout否则os.Create创建文件并使用bufio.Writer缓冲写入退出前统一 Flush见 backup.go#L55-L69--application-namespaces回退argocd-cmd-params-cm的application.namespaces控制额外导出的 Application 命名空间glob 语义逗号分隔--applicationset-namespaces回退argocd-cmd-params-cm的applicationsetcontroller.namespaces控制额外导出的 ApplicationSet 命名空间glob 语义--strip-statusfalse从导出资源中移除status字段得到干净、可重建的 manifest 集合-n, --namespacekubeconfig 当前命名空间指定控制面Argo CD命名空间ConfigMap/Secret 的读取以及 Application 的默认白名单都以它为基准其余--kubeconfig、--context、--server、--token、--as等为标准 kubectl 风格的连接参数由 cli.AddKubectlFlagsToCmd 统一注入用于选择直接访问 Kubernetes 的哪条通道。从父命令继承的 OptionsargocdCLI 的所有全局参数同样可用于argocd admin export--argocd-context string The name of the Argo-CD server context to use --auth-token string Authentication token; set this or the ARGOCD_AUTH_TOKEN environment variable --client-crt string Client certificate file --client-crt-key string Client certificate key file --config string Path to Argo CD config (default /home/user/.config/argocd/config) --controller-name string Name of the Argo CD Application controller; set this or the ARGOCD_APPLICATION_CONTROLLER_NAME environment variable when the controllers name label differs from the default, for example when installing via the Helm chart (default argocd-application-controller) --core If set to true then CLI talks directly to Kubernetes instead of talking to Argo CD API server --grpc-web Enables gRPC-web protocol. Useful if Argo CD server is behind proxy which does not support HTTP2. --grpc-web-root-path string Enables gRPC-web protocol. Useful if Argo CD server is behind proxy which does not support HTTP2. Set web root. -H, --header strings Sets additional header to all requests made by Argo CD CLI. (Can be repeated multiple times to add multiple headers, also supports comma separated headers) --http-retry-max int Maximum number of retries to establish http connection to Argo CD server --insecure Skip server certificate and domain verification --kube-context string Directs the command to the given kube-context --logformat string Set the logging format. One of: json|text (default json) --loglevel string Set the logging level. One of: debug|info|warn|error (default info) --plaintext Disable TLS --port-forward Connect to a random argocd-server port using port forwarding --port-forward-namespace string Namespace name which should be used for port forwarding --prompts-enabled Force optional interactive prompts to be enabled or disabled, overriding local configuration. If not specified, the local configuration value will be used, which is false by default. --redis-compress string Enable this if the application controller is configured with redis compression enabled. (possible values: gzip, none) (default gzip) --redis-haproxy-name string Name of the Redis HA Proxy; set this or the ARGOCD_REDIS_HAPROXY_NAME environment variable when the HA Proxys name label differs from the default, for example when installing via the Helm chart (default argocd-redis-ha-haproxy) --redis-name string Name of the Redis deployment; set this or the ARGOCD_REDIS_NAME environment variable when the Rediss name label differs from the default, for example when installing via the Helm chart (default argocd-redis) --repo-server-name string Name of the Argo CD Repo server; set this or the ARGOCD_REPO_SERVER_NAME environment variable when the servers name label differs from the default, for example when installing via the Helm chart (default argocd-repo-server) --server-crt string Server certificate file --server-name string Name of the Argo CD API server; set this or the ARGOCD_SERVER_NAME environment variable when the servers name label differs from the default, for example when installing via the Helm chart (default argocd-server)底层实现导出产物为什么是干净、可重建的理解 export() 函数 是理解备份文件格式的关键。它对每个待导出对象执行如下清理流程整体移除metadata子树unstructured.RemoveNestedField(un.Object, metadata)——这会一并抹掉uid、resourceVersion、creationTimestamp、generation、managedFields等运行时杂物保证导出文件不包含任何与具体集群实例绑定的标识按需重新写回有保留价值的元数据name、finalizers、labels、annotations、apiVersion、kind被逐一重新设置命名空间策略只有当资源命名空间不等于控制面命名空间时才显式写入namespace字段Explicitly add the namespace for appset and apps in any namespace见 backup.go#L475-L478。这意味着控制面内的资源在导出文件中不带 namespace恢复时由 import 侧统一落到 Argo CD namespace--strip-status开关为真时调用unstructured.RemoveNestedField(un.Object, status)把 Application 的 sync/health 状态、ApplicationSet 的 controller 状态等运行时字段全部剥离得到一个纯粹由 spec 定义的可重建 manifest 集合序列化与分隔对象被 marshal 成 YAML 写入 writer并在末尾追加---\n分隔符常量yamlSeparator定义于 admin.go#L25-L31。由此得到的备份文件是一个标准的多文档 YAML 流multi-document YAML stream每个文档之间以---分隔既可直接kubectl apply -f也可作为argocd admin import的输入。这一设计与 argocd admin import 的kube.SplitYAML(input)解析逻辑见 NewImportCommand严格对应import 侧对缺少 namespace 的对象默认回填 Argo CD namespaceFor objects without namespace, assume they belong in ArgoCD namespace。实战用法示例以下命令均可在当前仓库对应版本的 Argo CD CLI 上直接运行前提kubeconfig 已指向目标集群且具备 Argo CD 控制面命名空间内相关资源的访问权限。# 1. 全量导出到 stdout默认 -o 为 -可直接重定向到文件 argocd admin export backup.yaml # 2. 直接导出到指定文件内部走 bufio 缓冲写 Flush argocd admin export -o backup.yaml # 3. 指定控制面命名空间例如 Argo CD 安装在 argocd 之外 argocd admin export -n argocd -o backup.yaml # 4. 叠加导出其他命名空间中的 Application控制面内的始终包含在内 argocd admin export --application-namespaces apps-dev,apps-qa # 5. glob 写法批量覆盖某团队的命名空间前缀 argocd admin export --application-namespaces apps-* \ --applicationset-namespaces appsets-* # 6. 导出干净、可重建的 manifest 集去掉 status 字段 argocd admin export --strip-status -o backup.yaml # 7. 指定 kubeconfig 访问远端集群 argocd admin export --kubeconfig ~/.kube/prod-config -o prod-backup.yaml几个实践要点备份文件包含敏感信息argocd-secret管理员密码、服务端密钥、仓库凭据 Secret、集群凭据 Secret 都在导出范围内备份文件应按密钥级别管控与加密。ApplicationSet 不是硬性依赖即使集群未部署 ApplicationSet CRD 或缺少相应 RBACexport 也只会打印 warning 并跳过该部分其余资源照常导出。与 import 的语义对称性export 时用哪一套命名空间白名单导出的资源import 时默认也按同一套白名单flag →argocd-cmd-params-cm→ 仅控制面决定是否恢复判断逻辑同样走 IsNamespaceEnabled两侧不会导出了却恢复不了。验证与测试依据上述行为在仓库测试中均有对应覆盖admin_test.go 验证了getAdditionalNamespaces对argocd-cmd-params-cm中application.namespaces/applicationsetcontroller.namespaces的解析包括带空格的 foo , bar* 之类的取值清洗backup_test.go 则构造了argocd-cm、argocd-secret、AppProject、Application、ApplicationSet 等典型对象用于校验 export/import 两侧的清理、tracking 标签与状态处理逻辑。小结argocd admin export用一条命令即可完成 Argo CD 控制面的逻辑备份四个核心 ConfigMap、所有 Argo CD 凭据 Secret、全部 AppProject、以及按命名空间白名单过滤的 Application 与 ApplicationSet输出为以---分隔的干净多文档 YAML。通过--application-namespaces/--applicationset-namespaces或其argocd-cmd-params-cm中的对应键可以精确控制跨命名空间资源范围--strip-status则进一步剥离运行时状态产出可直接用于重建实例的 manifest 集。它与argocd admin import共同构成 Argo CD 官方推荐的迁移与灾备链路相关命令参考见 argocd_admin.md 与 argocd_admin_import.md。【免费下载链接】argo-cdDeclarative Continuous Deployment for Kubernetes项目地址: https://gitcode.com/GitHub_Trending/ar/argo-cd创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考