PlatformEngr® Argo CD course

Argo CD: printable course notes

Install Argo CD on a real cluster and run it from Git: Applications, sync and drift, app of apps, Helm and Kustomize, safe exposure and upgrades, three repositories with multiple sources, private repos and sealed secrets, projects and RBAC, hooks and waves, seven debugging labs, the operating model, and a capstone.

These pages are the same content as the interactive course, on one page per module, for reading and printing.

Four pieces

PieceWhat it is
See the end resultNot the first step: a 30-minute preview of the core loop (install, deploy from Git, break it, watch it heal) with few explanations. Useful to know where you are heading, or to demo Argo CD to your team.
Full course14 modules from install to a team-ready setup: Helm, Kustomize, three repos, secrets, projects, hooks, seven debugging labs and a capstone.
Reference repoThe finished implementation: the three repos side by side, plus the kind cluster, the labs and the docs. You copy from it.
Your three reposargocd-platform (platform team), checkout-app and checkout-config (team-checkout). You create them in modules 01, 07 and 02.

Your setup

Commands in these notes use these values (shared with the interactive course, stored only in this browser).

Outline

ModulePartTimeYou areYou will
00 Orientation: what Argo CD is and where it fitsOrientation20 minPlatform and productKnow what Argo CD does, why platform teams use it, where it sits between Git and Kubernetes, and the three repositories you will build. Tell the course who you are so every command is yours.
01 Install Argo CD the reviewable wayFoundations45 minPlatform teamCreate your platform repo and a cluster, install a pinned Argo CD with Helm using values from Git, and find your way around the UI and the CLI.
02 Your first Application, from GitFoundations45 minPlatform and productAs team-checkout, put manifests in Git; as the platform team, declare an Application for them; sync it from the UI and the CLI and follow one commit all the way to a running pod.
03 Reconciliation: auto-sync, prune and self-healFoundations45 minPlatform and productWatch drift appear, turn on automated sync, and see Argo CD prune what Git deleted and undo what someone changed by hand. Know which sync options matter and when.
04 App of apps: everything declarative, Argo CD includedFoundations45 minPlatform teamReplace every kubectl apply with one root Application that reads a folder of Applications, let Argo CD manage its own installation, and make pull requests the only way in.
05 Helm and Kustomize in practiceReal-world delivery55 minPlatform and productDeploy a platform add-on from a public Helm chart, move checkout to Kustomize overlays for dev and prod, and know exactly what Argo CD renders and why parameter overrides do not belong in the UI.
06 Expose Argo CD safely, and upgrade itReal-world delivery50 minPlatform teamServe the UI and API through an ingress with TLS, replace the shared admin account with personal accounts, and upgrade Argo CD with a pull request.
07 Three repositories and multiple sourcesReal-world delivery55 minPlatform and productSplit checkout into an application repository that releases a Helm chart by tag and an environment repository that holds values per environment, and combine them in one Application with multiple sources.
08 Private repositories and secretsReal-world delivery55 minPlatform and productMake the environment repo private, give Argo CD a read-only deploy key without putting the key in Git, and ship an application secret the same way: sealed, committed, decrypted only in the cluster.
09 AppProjects and RBAC: team boundariesOperate with teams50 minPlatform teamGive team-checkout a project that only allows its repos, its namespaces and namespaced kinds the platform does not own; give it an account that can see and sync only its apps; and prove both fences hold.
10 Deployment ordering: hooks, phases and wavesOperate with teams45 minProduct teamRun a database migration before a release, a smoke test after it, and a notice when it fails; order resources with sync waves; and see a failed migration stop a release before it touches the running version.
11 Debugging labs: seven ways Argo CD goes wrongOperate with teams90 minPlatform and productBreak the setup in seven realistic ways and, for each, find the cause from what Argo CD shows, fix it through Git, and answer the five questions: what failed, how was it detected, who responds, how is it corrected, how is it prevented.
12 How product teams work with Argo CDOperate with teams35 minPlatform and productWrite down and practise the contract between the platform team and product teams: what each owns, which repos each changes, how a team deploys and rolls back, how it inspects failures, and when it escalates.
13 Capstone: onboard and operate catalogOperate with teams75 minPlatform and productOnboard a second product team, team-catalog, with its own private environment repo, project, account and secrets, ship it to dev and prod, and handle an incident: all without step-by-step commands.

The GitOps loop

  1. Committed: A change in one of the three repos
  2. Reviewed: Pull request, CODEOWNERS
  3. Detected: Argo CD polls Git (or a webhook)
  4. Rendered: repo-server: Helm, Kustomize, YAML
  5. Compared: Desired vs live: Synced or OutOfSync
  6. Synced: Applied in phases and waves
  7. Healthy: Every resource reports Healthy
  8. Observed: History, diff, logs, events

Where the cluster runs

kind on your laptop is the default for every module. On an existing cluster, only modules 01 (no cluster to create), 05 (use your own ingress controller) and 06 (your hostname and TLS) differ.

Between you and production