GitOps with ArgoCD: Declarative Deployment Automation

GitOps is the practice of managing infrastructure and deployments from Git repositories, treating the repository as the single source of truth. ArgoCD is the leading tool for applying this pattern to Kubernetes] clusters, offering automatic synchronization, diff visualization, and full auditing.

Why adopt GitOps?

Consistency, the desired state is versioned in Git; any deviation can be reversed.
Audit, each change has a commit, author and review history.
Instant rollback, simply revert the commit and ArgoCD reconciles the cluster.
Collaboration, pull-requests allow review of infra changes before applying.

ArgoCD basic architecture

Repository Server, stores manifests (YAML, Helm, Kustomize).
Application Controller, compares the cluster state with the Git manifest and applies differences.
API Server, exposes UI and REST API for management.
Dex / SSO, integration with identity providers (GitHub, Okta).

The workflow is straightforward: ArgoCD Controller makes git pull from the repository, applies the manifests to the Kubernetes cluster via kubectl apply, and continuously reads the cluster status to compare it with the desired state. Users interact with the controller via the UI or API. Thus, the repository remains the single source of truth and the cluster is automatically kept synchronized.

Configuring the repository

The recommended structure separates a base/ layer, with shared resources as namespace.yaml and rbac.yaml, from a apps/ layer, in which each application (for example, frontend and backend) has its own kustomization.yaml and deployment.yaml. Kustomize allows you to override configurations per environment (dev, staging, prod) without duplicating manifests.

ArgoCD application manifest (YAML), 7 lines

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/yourorg/infra.git
    targetRevision: HEAD
    path: apps/frontend
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

syncPolicy.automated enables automatic synchronization and cleaning of obsolete resources.

Synchronization strategies

Automatic, ideal for staging environments where speed is critical.
Manual (PR-driven), for production, where each change is reviewed before being applied.
Hooks, scripts that run before or after synchronization (e.g.: DB migrations).

Observability and auditing

UI, shows diff between the desired and real state, with “Sync” button.
Webhooks, notifies Slack/Teams on sync or failure events.
Metrics, exposes Prometheus metrics (argocd_app_sync_total, argocd_app_health_status).
Logs, centralize with Loki or Elasticsearch to track actions.

Security

RBAC, define roles (admin, read-only, dev) in namespace argocd.
SSO, integrate with OAuth2/OIDC (GitHub, Google, Okta).
Mutual TLS, between ArgoCD and the Kubernetes API server.
Branch protection policy, require reviews and status checks before merging.

Implementation checklist

Create Git repository with structure base/ and apps/.
Install ArgoCD (kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml).
Configure SSO/Dex for corporate authentication.
Define Application CRDs for each micro-service.
Enable syncPolicy.automated in test environments.
Configure alerts in Prometheus/Alertmanager for sync failures.
Document PR flow → Merge → Sync.

Conclusion

GitOps with ArgoCD brings version control, auditability and automation to delivering Kubernetes applications. By following best practices for repository structure, security, and observability, your team can deploy changes confidently and quickly.

Already use ArgoCD? Share your tips and challenges in the comments!