Cheat notes · Module 04 · Foundations

App of apps: everything declarative, Argo CD included

A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.

The idea

One root Application, applied by hand once, turns every file in apps/ into an Application, including one for Argo CD itself. After that, everything, upgrading Argo CD included, is a reviewed file in Git.

Remember

App of apps: root's source is the apps/ folder. Add a file, get an Application; delete it, the Application goes.
The one manual step, ever: kubectl apply -f bootstrap/root.yaml. Root lives in bootstrap/, outside apps/, so a bad commit cannot delete it.
Argo CD manages itself: the argocd Application points at the same chart version and values you installed with, and adopts what Helm created. Never helm upgrade that release again; helm list still shows the old record, harmlessly.
Guardrails first: a validate CI check plus branch protection (require a pull request and the check) make pull requests the only way into main.
The resources finalizer resources-finalizer.argocd.argoproj.io: deleting the Application deletes what it deployed. Without it the workload keeps running, unmanaged.
Adopt, then upgrade: keep the chart at the installed version when Argo CD takes over. Upgrading is a separate pull request.

Pitfalls

Deleting a file in apps/ is an uninstall. Without the finalizer, the workload keeps running with nothing managing it: no self-heal, and the next real change never arrives.
Running helm upgrade on the original release after Argo CD adopted it: two owners for one install.
Requiring approvals on a repo you work on alone blocks you, because you cannot approve your own pull request. Require the check instead.

Commands

`kubectl apply -n argocd -f bootstrap/root.yaml`	The last `kubectl apply` for Applications
`argocd app list`	Root and its children
`argocd app resources root`	Everything root owns
`scripts/validate.sh`	Run the CI check locally before you push
`gh pr create --fill`	Propose the change
`gh pr checks --watch`	Wait for `validate`
`gh pr merge --squash --delete-branch`	Merge it

Test yourself

Answer in your head first, then open the answer.

How do you add a new Application after this module?

A pull request that adds its manifest to apps/.

Why does root.yaml live in bootstrap/ and not in apps/?

If root managed itself, a bad commit to its own file could delete it and everything below it.

How do you upgrade Argo CD from now on?

A pull request that changes targetRevision in apps/argocd.yaml.

What does the resources finalizer change about deleting an Application?

With it, deleting the Application also deletes its workload. Without it, the workload stays, unmanaged.

Where module 04 leaves you: One root Application owns argocd and checkout-dev. Adding or removing a file in apps/ adds or removes an Application. main accepts changes only through a pull request that passes validate. kubectl apply for Applications is over.