ArgoCD Image Updater ignoring new ECR tags — missing annotation + credentials | Today I Fixed

Pushed a new Docker image tag to ECR, but ArgoCD Image Updater was not detecting it. The Application stayed on the old image tag. Logs from the image-updater pod showed no activity for the affected app.

Root cause: Two issues: the ArgoCD Application was missing the required argocd-image-updater.argoproj.io/image-list annotation, so the updater had no idea which image to watch. On top of that, the ECR credentials secret (argocd-image-updater-secret) wasn't created in the argocd namespace, so even after adding the annotation, ECR pulls were failing silently.

Fix:

Step 1 — add the annotation to your ArgoCD Application:

yaml

metadata:
  name: my-app
  namespace: argocd
  annotations:
    argocd-image-updater.argoproj.io/image-list: my-app=123456789012.dkr.ecr.ap-south-1.amazonaws.com/my-app
    argocd-image-updater.argoproj.io/my-app.update-strategy: semver
    argocd-image-updater.argoproj.io/my-app.allow-tags: regexp:^v[0-9]+\.[0-9]+\.[0-9]+$

Step 2 — create the ECR credentials secret in the argocd namespace:

bash

kubectl create secret docker-registry argocd-image-updater-secret \
  --docker-server=123456789012.dkr.ecr.ap-south-1.amazonaws.com \
  --docker-username=AWS \
  --docker-password=$(aws ecr get-login-password --region ap-south-1) \
  -n argocd

Step 3 — verify the updater picks it up:

bash

kubectl logs -n argocd -l app.kubernetes.io/name=argocd-image-updater --tail=50

Lesson: ArgoCD Image Updater is opt-in per Application — the annotation is mandatory, and ECR needs a fresh token secret since ECR tokens expire every 12 hours.