GitOps / ArgoCD
Overview
Deploy through git, not through kubectl. The git repository is the source of truth; ArgoCD reconciles it. Prefer the ArgoCD MCP server (argocd preset) or the argocd CLI when available; fall back to reading Application CRs with kubectl.
Common commands
argocd app list
argocd app get <app>
argocd app diff <app>
argocd app history <app>
argocd app sync <app> --dry-run
kubectl get applications.argoproj.io -n argocd
kubectl describe application <app> -n argocd
Workflow
- Locate the Application: repo URL, path, target revision, destination cluster/namespace, sync policy.
- To change what is deployed: edit the manifests/kustomize/Helm values in the git repo, commit on a branch, open a PR/MR, and let review + ArgoCD do the rest. Do not patch live resources.
- After merge: watch sync status and health (
argocd app get,app wait), then verify the workload itself (rollout status, logs). - For drift:
argocd app difffirst, then decide - sync (git wins) or port the live change back into git.
Rules
argocd app syncon prod apps, rollbacks, andapp deleterequirehuman-approval.- Never disable auto-sync or prune without saying so in the report.
- Never commit secrets to the GitOps repo; use sealed-secrets/external-secrets references.