Bill Gernert
CI/CD & GitOps

Argo CD

GitOps comparison across eight review-gated application directories, plus one bounded credential-lifecycle path that self-heals. Pruning remains disabled.

What it is and whyHow I use it inArchitectureLessons learned and gotchasImpactFurther reading

What it is & why I use it

Argo CD is the GitOps engine for its registered cluster scope. It continuously compares what is declared in git against what is running. It reports differences for review-gated applications and reconciles the bounded credential-lifecycle application automatically. The repo is the control input, not a record written after the fact.

I use it because it makes its registered scope auditable and reproducible: a durable change is a commit, a rollback is a revert, and "what is supposed to be running?" has one answer that lives in version control rather than in someone's memory of what they last applied by hand.

How I use it in the lab

  • General applications are review-gated. Eight registered directories are defined in git. Argo CD watches the repo and cluster, reports where they differ, and waits for an operator to review the object-level diff and start the sync.
  • One bounded path self-heals. The credential-lifecycle application is already live and changes frequently as rotators are proved, so Argo CD restores that path to its reviewed main-branch definition automatically.
  • Pruning is disabled. Automated reconciliation for credential lifecycle can repair changed resources but cannot remove resources that disappear from git.
  • Visible drift and health. The sync/health view makes it obvious when something has diverged or a rollout is unhealthy, so problems surface instead of hiding.

Architecture

Argo CD architecture: General application review loop For eight general application directories, Argo CD compares Git with the cluster, reports drift, and waits for a reviewed sync. ARCHITECTURE FLOW GENERAL APPLICATION REVIEW LOOP Git desired state: Reviewed manifests and values GIT DESIRED STATE Reviewed manifests and values Argo CD diff: Compare Git with the cluster ARGO CD DIFF Compare Git with the cluster Sync: Apply the declared change SYNC Apply the declared change Cluster: Run the reconciled workloads CLUSTER Run the reconciled workloads Drift detected: A live object no longer matches DRIFT DETECTED A live object no longer matches Reviewed sync: Apply the approved definition REVIEWED SYNC Apply the approved definition Cyan. Automated step or path. Green. Recorded or healthy outcome. Dashed box. Stored state or record. Rounded box. Actor or process. Arrow. Direction of work or data.
This diagram shows the review-gated path used by eight general application directories. A separate credential-lifecycle application self-heals within its bounded scope; pruning is disabled for both modes. Cluster addresses and hostnames are omitted.

Lessons learned & gotchas

Gotcha - self-heal can turn adoption into deployment Several general application directories had not been applied through Argo CD when the comparison path was introduced. Enabling self-heal at the same time could have applied unresolved values as a side effect of adoption. Those eight paths therefore ship detection first and keep mutation behind a reviewed sync. Self-heal is enabled only for the separate, bounded credential-lifecycle path.
  • Treat self-heal and prune as separate decisions. The credential-lifecycle path can repair drift but cannot delete resources absent from git. That keeps automated correction bounded without granting automated removal.
  • Argo syncs manifests, not everything. It reconciles what is declared as Kubernetes state; out-of-band concerns it does not own (for example, a database schema behind an app) still need their own apply step. Do not assume a green sync means the whole world is in the desired state.
  • Investigate repeated drift. A resource that keeps drifting often points to an out-of-band change. Investigate that cause before re-syncing the symptom.

Impact

8
registered app directories
1
bounded self-heal app
Off
automated pruning

Argo CD makes divergence visible across its registered scope. Eight general application directories remain behind an object-level review and manual sync; one credential-lifecycle application corrects drift automatically. Neither mode permits automated pruning.

Further reading

Argo CD docs