Modules · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
GitOps principles (OpenGitOps)
Declarative | The desired state is described, not scripted |
Versioned and immutable | Stored in Git: history, review, rollback |
Pulled automatically | Agents in the cluster fetch the desired state |
Continuously reconciled | Agents keep correcting drift |
Argo CD components
argocd-server | API, web UI, CLI and SSO endpoint |
argocd-repo-server | Clones repos and renders manifests (plain YAML, Helm, Kustomize, plugins) |
argocd-application-controller | Compares live vs desired, syncs, reports health |
argocd-applicationset-controller | Generates Applications from templates |
argocd-redis / argocd-dex-server | Cache / optional SSO connector |
Install & log in
kubectl create namespace argocd | Namespace for Argo CD |
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml | Install (non-HA; check the docs for your version) |
argocd admin initial-password -n argocd | Initial admin password |
kubectl port-forward svc/argocd-server -n argocd 8080:443 | Reach the UI/API locally |
argocd login localhost:8080 --insecure | CLI login (lab only: self-signed cert) |
Applications
argocd app list / argocd app get guestbook | Status of apps |
argocd app diff guestbook | Live vs Git |
argocd app sync guestbook | Sync now |
argocd app history guestbook | Deployed revisions |
kubectl get applications -n argocd | Applications are just custom resources |
Pattern
root Application → path: apps/ | The directory holds child Application manifests |
kubectl apply -f root-app.yaml | The only manual step when bootstrapping |
resources-finalizer.argocd.argoproj.io | Finalizer: deleting the Application deletes its resources |
Projects
spec.sourceRepos | Which repos a project's apps may use |
spec.destinations | Which clusters/namespaces they may deploy to |
spec.clusterResourceWhitelist | Which cluster-scoped kinds are allowed (none by default for new projects) |
argocd proj list / argocd proj get platform | Inspect projects |
Helm source
source.chart + targetRevision | A chart from a Helm repo, pinned |
source.helm.valueFiles: [ values-prod.yaml ] | Values files from the same source |
source.helm.valuesObject: {…} | Inline values |
sources: [ {chart…}, {repoURL…, ref: values} ] + $values/… | Chart from one repo, values from another |
Kustomize source
path: overlays/prod | Point the Application at an overlay |
kustomize build overlays/prod | Preview locally what Argo CD will render |
kustomize edit set image shop=registry.example.com/shop:1.4.2 | Bump an image tag in an overlay |
Clusters
argocd cluster add <kube-context> --name edge-01 | Register a cluster (creates a ServiceAccount in it and a cluster Secret in argocd) |
argocd.argoproj.io/secret-type: cluster | Label on declarative cluster Secrets |
argocd cluster list | Registered clusters and their status |
ApplicationSets
generators: - clusters: { selector: { matchLabels: { env: prod } } } | One app per matching cluster |
generators: - git: { directories: [ { path: apps/* } ] } | One app per folder |
generators: - matrix: { generators: [ … , … ] } | Every combination of two generators |
goTemplate: true → '{{.name}}', '{{index .metadata.labels "env"}}' | Go template syntax |
argocd appset list / kubectl get applicationsets -n argocd | Inspect ApplicationSets |
Ordering
argocd.argoproj.io/sync-wave: "-1" | Lower waves apply first (default 0); each wave must be healthy before the next |
argocd.argoproj.io/hook: PreSync | Sync | PostSync | SyncFail | PostDelete | Run a resource (usually a Job) as a hook |
argocd.argoproj.io/hook-delete-policy: HookSucceeded | HookFailed | BeforeHookCreation | When to delete hook resources |
Safety
argocd.argoproj.io/sync-options: Prune=false | Never prune this resource |
argocd.argoproj.io/sync-options: Delete=false | Keep it even when the app is deleted |
syncOptions: [ ServerSideApply=true, PruneLast=true, RespectIgnoreDifferences=true ] | Common app-level options |
spec.ignoreDifferences (e.g. /spec/replicas with an HPA) | Don't fight other controllers |
AppProject spec.syncWindows | Allow/deny syncs by schedule |
Access
argocd-cm: oidc.config (or dex.config) | SSO with your identity provider |
argocd-cm: admin.enabled: "false" | Disable the local admin after SSO works |
argocd-rbac-cm: policy.default: role:readonly | Default role for logged-in users |
p, role:shop-dev, applications, sync, shop/*, allow | Allow syncing apps in project shop |
g, shop-devs, role:shop-dev | Map an IdP group to a role |
argocd admin settings rbac can role:shop-dev sync applications 'shop/cart' --policy-file policy.csv | Test a policy offline |
Operations
notifications.argoproj.io/subscribe.on-sync-failed.slack: platform-alerts | Subscribe an app to a notification trigger |
argocd_app_info{sync_status,health_status} | Metric for alerting on OutOfSync/Degraded apps |
manifests/ha/install.yaml or the Helm chart with HA values | Highly available install |
