Argo CDargocd admin import深度指南从备份文件恢复 Argo CD 控制面数据【免费下载链接】argo-cdDeclarative Continuous Deployment for Kubernetes项目地址: https://gitcode.com/GitHub_Trending/ar/argo-cdargocd admin import是 Argo CD 管理员命令集中负责“恢复”的一侧它把argocd admin export导出的多文档 YAML 备份重新写回集群涵盖 Argo CD 核心 ConfigMap、Secret、AppProject、Application 与 ApplicationSet 等控制面资源。本文基于命令参考文档 argocd_admin_import.md 整理完整的命令语法与全部选项说明并结合 NewImportCommand 的源码实现逐段讲解导入、更新、冲突处理与 prune清理流程帮助你构建可验证、可回滚的灾备恢复方案。命令定位admin 命令族中的恢复入口argocd admin是一组面向 Argo CD 管理员、需要直接 Kubernetes 集群访问权限而非通过 Argo CD API Server 认证的命令集合详见 argocd_admin.md。import子命令在 admin.go 中通过command.AddCommand(NewImportCommand())注册其定义为Import Argo CD data from stdin (specify-) or a file从源码看backup.go#L159-L177该命令要求恰好一个位置参数SOURCE传入-时从 stdin 读取备份内容否则读取指定文件。它与同文件中的NewExportCommandbackup.go#L33-L157互为镜像共同构成 Argo CD 官方灾难恢复流程的基石。典型用法与 export 配对完成灾备恢复在 disaster_recovery.md 中官方推荐的“导出-导入”流程是通过 Argo CD 官方容器在本地执行避免依赖本地安装的 CLI# 导出将 Argo CD 数据写入 backup.yaml docker run -v ~/.kube:/home/argocd/.kube --rm quay.io/argoproj/argocd:$VERSION argocd admin export backup.yaml # 导入将 backup.yaml 恢复到集群 docker run -i -v ~/.kube:/home/argocd/.kube --rm quay.io/argocd/argocd:$VERSION argocd admin import - backup.yaml两点必须牢记的使用前提命名空间要正确。官方文档特别提示如果 Argo CD 安装在非默认命名空间必须给 export/import 传-n namespaceargocd admin export在错误的命名空间下执行不会报错会静默产出空/不完整的备份见 disaster_recovery.md#L28。status 字段的处理。默认情况下export会保留资源的status例如 Application 的同步历史与健康状态便于温备/灾备场景保留最后已知状态若希望得到干净可重建的清单可加--strip-status导出。对应地import在更新时只有当备份清单中确实包含 status 字段时才会覆盖线上资源的 statusdisaster_recovery.md#L32-L42这一行为在源码updateLive中可直接印证见下文。命令语法与完整选项参考argocd admin import SOURCE [flags]以下是命令参考文档中列出的全部选项argocd_admin_import.md按“本命令专属选项”与“从父命令继承的选项”分组本命令选项--application-namespaces strings Comma separated list of namespace globs to which import of applications is allowed. If not provided, value from application.namespaces in argocd-cmd-params-cm will be used. If its not defined, only applications without an explicit namespace will be imported to the Argo CD namespace --applicationset-namespaces strings Comma separated list of namespace globs which import of applicationsets is allowed. If not provided, value from applicationsetcontroller.namespaces in argocd-cmd-params-cm will be used. If its not defined, only applicationsets without an explicit namespace will be imported to the Argo CD namespace --as string Username to impersonate for the operation --as-group stringArray Group to impersonate for the operation, this flag can be repeated to specify multiple groups. --as-uid string UID to impersonate for the operation --certificate-authority string Path to a cert file for the certificate authority --client-certificate string Path to a client certificate file for TLS --client-key string Path to a client key file for TLS --cluster string The name of the kubeconfig cluster to use --context string The name of the kubeconfig context to use --disable-compression If true, opt-out of response compression for all requests to the server --dry-run Print what will be performed -h, --help help for import --ignore-tracking Do not update the tracking annotation if the resource is already tracked --insecure-skip-tls-verify If true, the servers certificate will not be checked for validity. This will make your HTTPS connections insecure --kubeconfig string Path to a kube config. Only required if out-of-cluster -n, --namespace string If present, the namespace scope for this CLI request --override-on-conflict Override the resource on conflict when updating resources --password string Password for basic authentication to the API server --prompts-enabled Force optional interactive prompts to be enabled or disabled, overriding local configuration. If not specified, the local configuration value will be used, which is false by default. --proxy-url string If provided, this URL will be used to connect via proxy --prune Prune secrets, applications and projects which do not appear in the backup --request-timeout string The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means dont timeout requests. (default 0) --server string The address and port of the Kubernetes API server --skip-resources-with-label string Skip importing resources based on the label e.g. --skip-resources-with-label my-label/example.iotrue --stop-operation Stop any existing operations --tls-server-name string If provided, this name will be used to validate server certificate. If this is not provided, hostname used to contact the server is used. --token string Bearer token for authentication to the API server --user string The name of the kubeconfig user to use --username string Username for basic authentication to the API server --verbose Verbose output (versus only changed output)其中--as/--context/--kubeconfig/--server等 kubectl 风格选项由cli.AddKubectlFlagsToCmdbackup.go#L431统一注入决定了命令连接到哪个集群、哪个命名空间。真正控制导入行为的是--dry-run、--prune、--stop-operation、--ignore-tracking、--override-on-conflict、--skip-resources-with-label、--application-namespaces、--applicationset-namespaces、--prompts-enabled与--verbose这组选项它们在源码中的注册位置见 backup.go#L432-L441。从父命令继承的选项--argocd-context string The name of the Argo-CD server context to use --auth-token string Authentication token; set this or the ARGOCD_AUTH_TOKEN environment variable --client-crt string Client certificate file --client-crt-key string Client certificate key file --config string Path to Argo CD config (default /home/user/.config/argocd/config) --controller-name string Name of the Argo CD Application controller; set this or the ARGOCD_APPLICATION_CONTROLLER_NAME environment variable when the controllers name label differs from the default, for example when installing via the Helm chart (default argocd-application-controller) --core If set to true then CLI talks directly to Kubernetes instead of talking to Argo CD API server --grpc-web Enables gRPC-web protocol. Useful if Argo CD server is behind proxy which does not support HTTP2. --grpc-web-root-path string Enables gRPC-web protocol. Useful if Argo CD server is behind proxy which does not support HTTP2. Set web root. -H, --header strings Sets additional header to all requests made by Argo CD CLI. (Can be repeated multiple times to add multiple headers, also supports comma separated headers) --http-retry-max int Maximum number of retries to establish http connection to Argo CD server --insecure Skip server certificate and domain verification --kube-context string Directs the command to the given kube-context --logformat string Set the logging format. One of: json|text (default json) --loglevel string Set the logging level. One of: debug|info|warn|error (default info) --plaintext Disable TLS --port-forward Connect to a random argocd-server port using port forwarding --port-forward-namespace string Namespace name which should be used for port forwarding --redis-compress string Enable this if the application controller is configured with redis compression enabled. (possible values: gzip, none) (default gzip) --redis-haproxy-name string Name of the Redis HA Proxy; set this or the ARGOCD_REDIS_HAPROXY_NAME environment variable when the HA Proxys name label differs from the default, for example when installing via the Helm chart (default argocd-redis-ha-haproxy) --redis-name string Name of the Redis deployment; set this or the ARGOCD_REDIS_NAME environment variable when the Rediss name label differs from the default, for example when installing via the Helm chart (default argocd-redis) --repo-server-name string Name of the Argo CD Repo server; set this or the ARGOCD_REPO_SERVER_NAME environment variable when the servers name label differs from the default, for example when installing via the Helm chart (default argocd-repo-server) --server-crt string Server certificate file --server-name string Name of the Argo CD API server; set this or the ARGOCD_SERVER_NAME environment variable when the servers name label differs from the default, for example when installing via the Helm chart (default argocd-server)源码深潜import 的完整执行流程下面按 backup.go#L177-L428 中Run函数的实际执行顺序拆解。1. 建立客户端并读取输入命令首先解析 kubeconfig 得到*rest.Config并显式抬高限流阈值config.QPS 100、config.Burst 50backup.go#L184-L187——这说明官方预期导入大批量对象时不能受默认 QPS 限制拖慢也解释了为什么恢复过程通常较快。随后按SOURCE参数决定输入来源backup.go#L196-L200if in : args[0]; in - { input, err io.ReadAll(os.Stdin) } else { input, err os.ReadFile(in) }命名空间则取自 kubeconfig 上下文-n覆盖并在控制台打印import process started namespace。2. 先收集“线上存量”构建 prune 候选集在读取备份内容之前命令先列出目标命名空间内的全部 Argo CD 资源装入pruneObjects映射backup.go#L224-L268所有 Argo CD ConfigMapisArgoCDConfigMap判定所有 Argo CD SecretisArgoCDSecret判定所有位于允许命名空间内的 Application所有 AppProject所有位于允许命名空间内的 ApplicationSet对IsForbidden/IsNotFound仅告警容忍集群未启用 ApplicationSet。源码注释解释了这个设计的意图“pruneObjects 追踪线上对象及其当前资源版本遍历备份后仍留在映射中的项即表示该资源不再出现在备份里应被 prune”。3. 解析备份文件并逐对象处理备份文件通过kube.SplitYAML切分为多组unstructured.Unstructured对象backup.go#L270。对每个备份对象命名空间归一化若对象没有显式命名空间则默认归入 Argo CD 控制面命名空间backup.go#L276-L278匹配与摘除按Group/Kind/Name/Namespace计算kube.ResourceKey命中pruneObjects即从候选集移除backup.go#L279-L281保证“出现在备份里”的资源绝不会被 prune标签跳过若对象携带--skip-resources-with-label指定的标签如my-label/example.iotrue打印跳过信息并continuebackup.go#L283-L287判定逻辑见isSkipLabelMatchesbackup.go#L544-L557仅支持keyvalue单对格式按 Kind 选择 dynamic client并对 Application / ApplicationSet 再次做命名空间白名单校验不在--application-namespaces/--applicationset-namespaces或argocd-cmd-params-cm中application.namespaces/applicationsetcontroller.namespaces配置的 glob内的对象直接不导入backup.go#L289-L309。4. 创建 / 保持不变 / 更新三分支核心决策在 backup.go#L317-L366线上不存在直接Createspec 相等且无需停止操作specsEqual(*bakObj, liveObj) checkAppHasNoNeedToStopOperation(...)成立时仅在--verbose下打印unchanged其余情况调用updateLive生成新对象后Update。其中updateLivebackup.go#L489-L512的合并策略值得注意它只用备份对象覆盖线上的specSecret/ConfigMap 覆盖data、annotations、labels、finalizers其余字段如 status、resourceVersion保持线上原值对 Application 额外地——当且仅当备份中带有 status 字段时才覆盖 status并在--stop-operation时把operation置空。这正是灾难恢复文档中“import 只覆盖备份里存在的 status”这一行为的源码依据。5. 冲突处理--override-on-conflictUpdate若返回 ConflictresourceVersion 冲突默认只打印失败信息加上--override-on-conflict后进入retry.RetryOnConflict重试循环重新Get线上对象、把备份对象对齐到最新resourceVersion再提交backup.go#L341-L354。在恢复窗口内其他控制器可能仍在变更资源这个选项能让导入“赢”下竞争但代价是覆盖线上并发修改需在有明确恢复意图时使用。6. --stop-operation 与 --ignore-tracking--stop-operation若线上 Application 带有进行中的operation同步/删除默认会视为“spec 不一致”而触发更新checkAppHasNoNeedToStopOperationbackup.go#L446-L454负责该判定更新时则把operation字段清空等效于停止在途操作、让恢复后的 spec 从头重新收敛。--ignore-tracking当 Argo CD 自身被另一个 Application 以 GitOps 方式管理时线上对象带有 tracking 注解/标签。updateTrackingbackup.go#L516-L541会把线上对象的argocd.argoproj.io/instance注解与标签值回填到备份对象上避免导入的 tracking 标记与现有管理关系冲突。7. 清理阶段--prune 与交互式确认遍历备份后pruneObjects中剩余的即“备份里没有、线上还存在”的资源backup.go#L371-L425未加--prune仅逐条打印... needs pruning不做任何变更加--prune对 Secret/AppProject/Application/ApplicationSet 逐条通过promptUtil.Confirm(Are you sure you want to prune ... ? [y/n])交互确认后删除携带跳过标签的资源永不 prune删除 Application 前会先清空其finalizersbackup.go#L388-L397避免删除被 finalizer 卡住--prompts-enabled控制交互确认开关默认取本地配置默认 false即非交互环境下 prune 确认会自动通过backup.go#L441。流程结束后打印汇总Import process completed successfully in namespace ns at RFC3339 时间, duration: 耗时backup.go#L426-L427便于在恢复记录中留痕。关键选项详解选项行为要点源码依据--dry-run所有 Create/Update/Delete 只打印动作、不真正执行输出带(dry run)后缀backup.go#L202-L205建议每次恢复前先跑一遍--prune删除备份中不存在的 Argo CD Secret、Application、AppProject、ApplicationSet删除前逐条确认--stop-operation恢复 Application 时清空线上在途operation让恢复后的 spec 重新驱动同步--ignore-tracking保留线上对象已有的 tracking 注解/标签适用于 Argo CD 被 GitOps 管理的场景--override-on-conflict更新遇 resourceVersion 冲突时自动重取并重试--skip-resources-with-label kv备份与清理两侧同时按标签跳过资源导入侧 backup.go#L284-L287、清理侧 backup.go#L373-L377--application-namespaces/--applicationset-namespaces命名空间 glob 白名单缺省时回落到argocd-cmd-params-cm的application.namespaces/applicationsetcontroller.namespaces再缺省时只有不带显式命名空间的对象会被导入到 Argo CD 命名空间--verbose额外打印unchanged的不变对象否则仅输出发生变更的行--prompts-enabled覆盖本地配置强制开/关 prune 的交互确认实践建议与常见陷阱先--dry-run再正式导入dry-run 输出会精确列出将 created/updated/pruned 的对象是恢复前的核对清单。--prune是破坏性操作它会删除当前集群中存在而备份中不存在的 Argo CD 资源。若目标集群是全新环境无残留资源prune 无实际影响若向已有环境导入务必确认备份是“全量”的否则可能误删后建的对象。命名空间错误不会报错与 export 相同import 对错误命名空间只会在needs pruning/created 列表上体现异常-n与--kubeconfig/--context选择务必二次确认。RBAC 需要足够命令直接走 Kubernetes APIdynamic client执行账号需要对目标命名空间的 ConfigMap、Secret、applications.argoproj.io、appprojects.argoproj.io、applicationsets.argoproj.io 具有完整读写权限权限不足时命令会打 warning 并跳过该 Kind 而非整体失败。备份来源要匹配import只处理 Secret/ConfigMap/AppProject/Application/ApplicationSet 这五类对象其余 Kind 会被 dynamic client 选择逻辑自然忽略因此它恢复的是 Argo CD 控制面而非应用集群中由 Argo CD 管理的业务资源——后者随 Application 恢复后由控制器重新收敛。相关命令argocd admin exportimport 的对偶命令定义于同一文件 backup.go#L33-L157支持--out、--application-namespaces、--applicationset-namespaces与--strip-status产出本文所描述的备份文件格式argocd admin包含 import/export 在内的管理员命令族命令总览见 argocd_admin.md灾难恢复全貌导出、导入、Redis 状态与注意事项见 disaster_recovery.md。【免费下载链接】argo-cdDeclarative Continuous Deployment for Kubernetes项目地址: https://gitcode.com/GitHub_Trending/ar/argo-cd创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考
