Automating Docker Swarm: A Production-Ready GitOps Workflow Using Argo CD and HashiCorp Vault

Introduction: The GitOps Revolution in Container Orchestration

In the modern DevOps landscape, GitOps has emerged as the gold standard for infrastructure automation and continuous delivery. By treating Git repositories as the single source of truth, organizations can achieve unparalleled traceability, rapid disaster recovery, and consistent environments. While GitOps is natively associated with Kubernetes, a vast number of enterprises continue to rely on Docker Swarm for its simplicity, low overhead, and ease of operation.

However, implementing a robust GitOps pipeline on Docker Swarm presents unique challenges, particularly regarding automatic synchronization and secure secret management. This technical guide explores a production-ready architecture that pairs Argo CD (utilizing a lightweight agent model or controller abstraction) with HashiCorp Vault to achieve automated, zero-trust infrastructure synchronization on a Docker Swarm cluster.

The Architectural Blueprint

Before diving into the configuration, it is essential to understand how these disparate components interact. Because Argo CD is natively built for Kubernetes, our architecture employs a hybrid management layer or a specialized synchronization worker (such as an upstream runner or GitOps operator translated for Swarm mutation) that executes the declarative state defined in Git onto the Swarm manager nodes.

• The Git Repository: Holds the declarative state of the Docker Swarm infrastructure, including Swarm Stack files (Compose files) and environment configurations.
• Argo CD: Acts as the continuous delivery engine, monitoring the Git repository for changes and orchestrating the deployment workflow.
• HashiCorp Vault: Serves as the centralized, secure secrets manager, injecting sensitive data (like database credentials and API keys) dynamically at runtime.
• Docker Swarm Cluster: The target runtime environment executing the containerized workloads.

Architecture Note: By decoupling secret management from the Git repository, we ensure compliance with the strict security principle of never storing plaintext credentials in version control.

Step 1: Setting Up the Vault Secret Engine

Secure secret injection is the cornerstone of a production-grade GitOps pipeline. HashiCorp Vault provides a centralized KV (Key-Value) storage mechanism that our deployment worker will query during synchronization.

1.1 Initialize and Enable the KV Engine

First, ensure your Vault instance is initialized and unsealed. Enable the KV Secrets Engine version 2, which supports versioning and soft deletes:

vault secrets enable -path=secret/ kv-v2

1.2 Populate Production Secrets

Inject the sensitive parameters required by your Docker Swarm stacks. For example, let us store a secure database password:

vault kv put secret/data/swarm/database username="db_admin" password="SuperSecurePassword2026!"

1.3 Configure Access Policies

Create a strict, read-only policy that allows the GitOps synchronization agent to retrieve these secrets securely. Save the following configuration as swarm-policy.hcl:

path "secret/data/swarm/*" {
  capabilities = ["read"]
}

Apply the policy to Vault:

vault policy write swarm-reader swarm-policy.hcl

Step 2: Structuring the Git Repository

To enable Argo CD to manage the Docker Swarm state effectively, we must organize our Git repository using a structured, predictable layout. We will use a declarative directory structure separating application logic from environment configurations.

infra-gitops-repo/
├── apps/
│   └── web-stack/
│       ├── docker-compose.yml
│       └── tracking.env
└── config/
    └── argo-application.json

The docker-compose.yml file represents our target Swarm Stack state, utilizing environment variable placeholders that will be dynamically hydrated by our Vault-integrated synchronization loop:

version: '3.8'
services:
  app:
    image: [internal-registry.enterprise.com/web-app:v2.4.0](https://internal-registry.enterprise.com/web-app:v2.4.0)
    ports:
      - "8080:8080"
    environment:
      - DB_USER=${VAULT_DB_USER}
      - DB_PASS=${VAULT_DB_PASS}
    deploy:
      replicas: 3
      update_config:
        parallelism: 1
        delay: 10s
      restart_policy:
        condition: on-failure

Step 3: Configuring Argo CD for Non-Kubernetes Targets

Since Argo CD is designed to track Git and sync to Kubernetes APIs, we utilize an Argo CD Application targeting a control namespace or custom resource definitions (CRDs) that manage external execution. Alternatively, a specialized GitOps controller running within a minimal Kubernetes management control-plane handles the lifecycle of the Docker Swarm nodes via an SSH or TLS-secured Docker socket.

3.1 Creating the Declarative Application

Define the Argo CD Application manifest to monitor our infrastructure repository. When a change is merged into the main branch, Argo CD detects the divergence (Out-Of-Sync) and triggers the sync plugin hook.

Here is the declarative representation of our Argo CD Application:

{
  "apiVersion": "argoproj.io/v1alpha1",
  "kind": "Application",
  "metadata": {     "name": "swarm-infrastructure-sync",
    "namespace": "argocd"
  },
  "spec": {     "project": "default",
    "source": {       "repoURL": "[https://github.com/enterprise/infra-gitops-repo.git](https://github.com/enterprise/infra-gitops-repo.git)",
      "targetRevision": "HEAD",
      "path": "apps/web-stack"
    },
    "destination": {       "server": "[https://kubernetes.default.svc](https://kubernetes.default.svc)",
      "namespace": "swarm-management"
    },
    "syncPolicy": {       "automated": {         "prune": true,
        "selfHeal": true
      }
    }
  } }

Step 4: Executing Automated Synchronization with Vault Secret Hydration

When Argo CD triggers a synchronization event, a customized Configuration Management Plugin (CMP) or webhook workflow executes. This workflow fetches secrets from HashiCorp Vault, replaces the environment placeholders, and applies the stack directly to the Swarm manager.

4.1 The Synchronization Script Workflow

The synchronization runner performs the following steps sequentially:

1. Authenticate with Vault: Utilizing a secure token or AppRole credential provisioned to the runner.
2. Fetch Credentials: Query the secret/data/swarm/database endpoint.
3. Export Variables: Inject the secrets into the local shell context as environment variables.
4. Deploy Stack: Execute the deployment natively targeting the Swarm cluster engine.

Let us look at the automation script executing inside the synchronization worker:

#!/usr/bin/env bash
set -euo pipefail

# 1. Fetch secrets dynamically from Vault
VAULT_RESPONSE=$(curl --header "X-Vault-Token: ${VAULT_TOKEN}" \   --request GET \   "${VAULT_ADDR}/v1/secret/data/swarm/database")

# 2. Extract values using jq
export VAULT_DB_USER=$(echo "$VAULT_RESPONSE" | jq -r '.data.data.username')
export VAULT_DB_PASS=$(echo "$VAULT_RESPONSE" | jq -r '.data.data.password')

# 3. Securely deploy or update the Docker Swarm Stack
docker stack deploy --with-registry-auth --compose-file apps/web-stack/docker-compose.yml production_web_app

By executing docker stack deploy with the --with-registry-auth flag, the cluster safely distributes image registry credentials across all Swarm worker nodes, enabling automated, zero-downtime rolling updates as orchestrated by Argo CD.

Best Practices for Production Environments

Transitioning this pipeline into production requires strict adherence to operational guidelines to ensure stability, scalability, and security.

Continuous State Auditing

Configure Argo CD's reconciliation timeout loop to run at brief intervals (e.g., every 3 to 5 minutes). This ensures that if an operator manually alters a service configuration on a Swarm node via the command line, Argo CD will instantly detect the drift and override it with the state declared in Git, enforcing immutable infrastructure principles.

Vault Token Lifecycle Management

Never hardcode Vault tokens within your infrastructure code. Utilize short-lived tokens or employ Vault's AppRole authentication mechanism. This allows the synchronization worker to exchange a unique RoleID and SecretID for a temporary token that expires immediately after the deployment phase completes.

Handling State Rollbacks

Because the configuration is stored entirely in Git, rolling back a deployment does not involve manual server remediation. Simply execute a git revert on the commit that introduced the breaking change. Argo CD will recognize the older commit state as the desired configuration and instantly restore your Swarm services to their last-known stable configuration.

Conclusion

Integrating Docker Swarm into a modern GitOps pipeline using Argo CD and HashiCorp Vault proves that you do not need the full complexity of Kubernetes to achieve automated, secure, and declarative infrastructure management. By centralizing configurations in Git, managing execution states via Argo CD, and securing sensitive data within Vault, you build an efficient, enterprise-grade continuous delivery pipeline that keeps your infrastructure synchronized, audit-ready, and resilient against configuration drift.