Home/Start here/Argo CD

Argo CD

Argo CD keeps a Kubernetes cluster matching a Git repository. It lives inside the cluster and checks constantly.

How it actually works

You point Argo CD at a repository and a folder inside it. From then on it compares what is in that folder against what is running in the cluster, every few minutes. When they differ, the cluster is marked out of sync, and Argo CD either waits for you to press sync or fixes it on its own, depending on how you set it up.

So the deployment process becomes: merge a change to the repository. That is the whole thing. Nobody runs a deploy command.

The important part: it pulls

Most deployment pipelines push. A build server finishes, then reaches into the cluster and applies the change. That means the build server holds credentials with real power over production, and anyone who compromises the build server has them too.

Argo CD works the other way round. It sits inside the cluster and reaches out to read Git. Nothing outside the cluster needs a way in.

Drift, and why anyone cares

Someone edits a setting directly on the cluster at two in the morning to get through an incident. It works, the incident ends, and nobody writes it down. Six weeks later the cluster is rebuilt and the fix disappears.

That gap between what is written down and what is running is called drift. Argo CD makes it visible within minutes, as a red badge next to the application, and can be told to undo it automatically. That is a security control as much as an operations one, because an attacker changing something on a cluster looks exactly like drift.

What drift looks like when you catch it

Two applications, one of them changed by hand:

$ argocd app list
NAME       PROJECT   SYNC STATUS   HEALTH STATUS
bootstrap  platform  Synced        Healthy
falco      platform  OutOfSync     Healthy

OutOfSync together with Healthy is the interesting combination. Something is running perfectly well and does not match what is written down. Ask what changed:

$ argocd app diff falco
===== /ConfigMap falco/falco-local-rules ======
24c24
<       priority: DEBUG
---
>       priority: WARNING

The line marked < is what is running now. The line marked > is what Git says. Someone lowered the priority on a rule so it stopped paging them. Reasonable at three in the morning, invisible forever after, and it would vanish on the next cluster rebuild unless someone remembered to write it down.

With self-heal switched on, Argo CD puts that back within a few minutes and the person has to make the case in a pull request instead. That is the difference between a deployment tool and a control.

The words you will hear

What Argo CD is good at

• Deploying to Kubernetes without handing out cluster credentials
• Showing you, at a glance, whether the cluster matches what is written down
• Rolling the same thing out to many clusters from one definition
• Giving an auditor a straight answer about what is running and who approved it

What to use something else for

Creating the cluster itself, the network around it, and the permissions it uses. That is Terraform. Argo CD starts once there is a cluster to talk to.