Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Help improve this page

To contribute to this user guide, choose the Edit this page on GitHub link that is located in the right pane of every page.

Create an Argo CD capability using eksctl

Create an Argo CD capability on your Amazon EKS cluster using eksctl.

Prerequisites

Step 1: Create an IAM Capability Role

Create a trust policy file:

cat > argocd-trust-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "capabilities.eks.amazonaws.com"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession"
      ]
    }
  ]
}
EOF

Create the IAM role:

aws iam create-role \
  --role-name ArgoCDCapabilityRole \
  --assume-role-policy-document file://argocd-trust-policy.json

Step 2: Get your Amazon Identity Center configuration

Get your Identity Center instance ARN and user ID for RBAC configuration:

# Get your Identity Center instance ARN
aws sso-admin list-instances --query 'Instances[0].InstanceArn' --output text

# Get a user ID for admin access (replace 'your-username' with your Identity Center username)
aws identitystore list-users \
  --identity-store-id $(aws sso-admin list-instances --query 'Instances[0].IdentityStoreId' --output text) \
  --query 'Users[?UserName==`your-username`].UserId' --output text

Note these values - you’ll need them in the next step.

(Optional) Configure a private endpoint

By default, the Argo CD UI and API endpoint are publicly accessible over the internet. If you need to restrict access, you can configure a VPC endpoint. This is recommended for environments with strict network security requirements.

Create a VPC endpoint for EKS Capabilities

Create an interface VPC endpoint for the EKS Capabilities service in your VPC. Replace vpc-id, subnet-id-1, subnet-id-2, sg-id, and region-code with your own values:

aws ec2 create-vpc-endpoint \
  --vpc-endpoint-type Interface \
  --service-name com.amazonaws.region-code.eks-capabilities \
  --vpc-id vpc-xxxxxxxx \
  --subnet-ids subnet-xxxxxxxx
            subnet-yyyyyyyy \
  --security-group-ids sg-xxxxxxxx \
  --region region-code
         

Verify the VPC endpoint is available

aws ec2 describe-vpc-endpoints \
  --vpc-endpoint-ids vpce-xxxxxxxx \
  --query 'VpcEndpoints[0].State' \
  --output text \
  --region region-code
         

Wait until the state shows available before proceeding.

Step 3: Create an eksctl configuration file

Create a file named argocd-capability.yaml with the following content. Replace the placeholder values with your cluster’s name, cluster’s region, IAM role ARN, Identity Center instance ARN, Identity Center region, and user ID:

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: my-cluster
  region: cluster-region-code

capabilities:
  - name: my-argocd
    type: ARGOCD
    roleArn: arn:aws:iam::111122223333:role/ArgoCDCapabilityRole
    deletePropagationPolicy: RETAIN
    configuration:
      argocd:
        awsIdc:
          idcInstanceArn: arn:aws:sso:::instance/ssoins-123abc
          idcRegion: idc-region-code
        rbacRoleMappings:
          - role: ADMIN
            identities:
              - id: 38414300-1041-708a-01af-5422d6091e34
                type: SSO_USER

If you configured a VPC endpoint for private access, add the networkConfiguration section to the capability definition. Replace vpce-xxxxxxxx with your VPC endpoint ID:

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: my-cluster
  region: cluster-region-code

capabilities:
  - name: my-argocd
    type: ARGOCD
    roleArn: arn:aws:iam::[.replaceable]111122223333:role/ArgoCDCapabilityRole
    deletePropagationPolicy: RETAIN
    networkConfiguration:
      elasticNetworkInterfaces:
        vpcEndpointId: vpce-xxxxxxxx
    configuration:
      argocd:
        awsIdc:
          idcInstanceArn: arn:aws:sso:::instance/ssoins-123abc
          idcRegion: idc-region-code
        rbacRoleMappings:
          - role: ADMIN
            identities:
              - id: 38414300-1041-708a-01af-5422d6091e34
                type: SSO_USER

Step 4: Create the Argo CD capability

Apply the configuration file:

eksctl create capability -f argocd-capability.yaml

The command returns immediately, but the capability takes some time to become active.

Step 5: Verify the capability is active

Check the capability status. Replace region-code with the Amazon Region that your cluster is in and replace my-cluster with the name of your cluster.

eksctl get capability \
  --region region-code \
  --cluster my-cluster \
  --name my-argocd

The capability is ready when the status shows ACTIVE.

Step 6: Verify custom resources are available

After the capability is active, verify that Argo CD custom resources are available in your cluster:

kubectl api-resources | grep argoproj.io

You should see Application and ApplicationSet resource types listed.

Next steps