PlatformEngr® Argo CD course

Cheat notes · Module 00 · Orientation

Orientation: what Argo CD is and where it fits

A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.

The idea

Argo CD is a controller inside the cluster that pulls the desired state from Git and keeps the cluster equal to it. CI builds and tests; it never touches the cluster.

Remember

  • Pull, not push: Argo CD reads Git with read-only access. No pipeline holds cluster credentials, and every running object has a commit behind it.
  • Reconcile, not apply once: a CI job running kubectl apply deploys and forgets. Argo CD keeps comparing, shows drift and can correct it.
  • Three repos, three jobs: argocd-platform (platform team: Argo CD, Applications, projects), checkout-app (team-checkout: chart and code, released as tags), checkout-config (team-checkout: what runs in each environment).
  • The environment repo decides what runs where. The app repo produces releases; a change in checkout-config is a deploy.
  • The layers: code and build (product team), desired state in Git, delivery (Argo CD), guardrails (AppProjects, RBAC, platform-owned namespaces), runtime (Kubernetes).
  • The stand-in product: checkout runs the public podinfo image, so the course needs no code and no CI.

Pitfalls

  • Fixing things with kubectl edit "just this once". Argo CD undoes it and nobody knows it happened. Changing Git, even when kubectl is quicker, is the habit the course builds.
  • Treating checkout-config as the product's code. It holds only the Kubernetes files that say how the product runs.

Test yourself

Answer in your head first, then open the answer.

What does Argo CD do that a CI job running kubectl apply does not?

It keeps comparing the cluster with Git after the deploy, shows drift and can correct it.

Why is pull-based delivery safer?

The credentials that can change production stay inside the cluster. Argo CD only needs read access to Git.

Which repository says which version runs in prod?

The environment repository, checkout-config. The app repo only produces releases.

Where module 00 leaves you: Nothing is installed in a cluster yet. You have your details saved in the course, every tool checked, a local copy of the reference repo to copy from, and a clear picture of what you will build.