GitOps and Argo CD: Declarative Kubernetes Continuous Delivery

GitOps is an operational framework where Git serves as the single source of truth for declarative infrastructure and application state. Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes that continuously reconciles cluster state against desired configurations committed in Git.

⚡ Quick Dive

The 4 Core Principles of OpenGitOps

  1. Declarative: System state is described declaratively (YAML/Helm/Kustomize).
  2. Versioned & Immutable: Desired state is stored in Git, creating a complete audit trail.
  3. Pulled Automatically: Software agents in the cluster pull state changes (no inbound firewall ports).
  4. Continuously Reconciled: Agents continuously monitor and correct cluster drift.

Argo CD Application CRD (application.yaml)

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: payment-api
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default
  source:
    repoURL: https://github.com/company/gitops-manifests.git
    targetRevision: HEAD
    path: environments/production/payment-api
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true     # Automatically delete resources removed from Git
      selfHeal: true  # Automatically revert manual kubectl changes (Drift correction)
    syncOptions:
      - CreateNamespace=true

📖 Extended Guide

1. Push-Based CI/CD vs. Pull-Based GitOps

Traditional Push-Based CI/CD (Security Risk):
[ CI Runner (GitHub/Jenkins) ] ── (Cluster Admin Kubeconfig) ──► [ Kubernetes API Server ]
(If CI runner is compromised, attacker has root access to production cluster)

Pull-Based GitOps Architecture (Zero Trust / Secure):
[ Git Repository (Desired State) ]
                ▲
                │ (Outbound HTTPS Poll)
┌───────────────┴──────────────────────────────────────────┐
│ Kubernetes Cluster                                       │
│   [ Argo CD Controller ] ── (Reconciles) ──► [ Live Pods ]│
└──────────────────────────────────────────────────────────┘
  • In GitOps, no cluster credentials leave the Kubernetes cluster. CI pipelines only build containers and update Git manifest tags; the in-cluster ArgoCD agent handles deployment.

2. Synchronization Waves & Resource Ordering

When deploying complex stacks (e.g., Database $\to$ Schema Migration $\to$ API Service), use Sync Waves to control provisioning order:

metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "1" # Wave 1: Deploy Database
---
metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "2" # Wave 2: Run DB Migration Job
---
metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "3" # Wave 3: Deploy Web Application

3. The "App of Apps" Pattern for Multi-Cluster Management

Instead of managing dozens of individual ArgoCD Applications manually, define a single root application that manages all child applications:

[ Root Application (app-of-apps.yaml) ]
                 │
  ┌──────────────┼──────────────┬──────────────┐
  ▼              ▼              ▼              ▼
[ Ingress ] [ CertManager ] [ Vault ] [ Microservices ]
⌂ All Guides