How does ArgoCD manage multiple clusters and what are the methods for registering them?

ArgoCD is designed to manage applications across multiple Kubernetes clusters from a single control plane. Each cluster is registered with the ArgoCD API server and stored as a Secret in the argocd namespace with the label argocd.argoproj.io/secret-type: cluster.

Two Methods for Registering Clusters

1. CLI (argocd cluster add) — The most common method. The CLI reads your local kubeconfig, creates a ServiceAccount and ClusterRoleBinding in the target cluster, then stores the credentials as a Secret in ArgoCD:

kubectl config use-context my-prod-cluster
argocd cluster add my-prod-cluster --name production

2. Declarative (Secret manifest) — For GitOps-managed ArgoCD deployments, you can commit a cluster Secret directly:

apiVersion: v1
kind: Secret
metadata:
  name: prod-cluster-secret
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: cluster
type: Opaque
stringData:
  name: production
  server: https://prod-k8s-api.example.com
  config: |
    {
      "bearerToken": "<token>",
      "tlsClientConfig": { "insecure": false, "caData": "<base64-ca>" }
    }

The in-cluster cluster (https://kubernetes.default.svc) is always available without registration — ArgoCD uses its own service account to access it. For external clusters, the ArgoCD application controller makes API calls to the registered cluster endpoint using the stored credentials.

In practice, tools like the ArgoCD Cluster Generator (part of ApplicationSets) can dynamically register and manage Applications across all clusters registered as Secrets.