Cheat notes · Module 12 · Operate with teams

How product teams work with Argo CD

A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.

The idea

Tools do not make an operating model; agreements do. Teams own their chart, values, secrets, releases and rollbacks inside their project; the platform owns Argo CD, projects, namespaces, RBAC and credentials. Write it down, enforce it with CODEOWNERS and CI, and roll back with a revert.

Remember

Teams own: their chart (checkout-app), values and secrets (checkout-config), releases (tags), and syncs and rollbacks in their project. Inside it, they need nobody.
The platform owns: the Argo CD install, upgrades, exposure, SSO and RBAC; AppProjects, namespaces and quotas; repository credentials; add-ons. Teams propose apps/checkout-*.yaml; the platform reviews.
How teams deploy: a pull request to checkout-config (versions, values) or to apps/checkout-*.yaml (a chart release), reviewed through CODEOWNERS.
How teams inspect: read-only in Argo CD for their apps: status, diff, history, resources, logs. Write access is Git.
When to escalate: the fix is outside the team's repos (permissions, credentials, add-ons, Argo CD itself), or every app is Unknown and the UI is down.
Contracts that matter are CI checks, not trust: for example, chart sources must be release tags like v1.2.3.

Pitfalls

Using the rollback button: it refuses while auto-sync is on, and turning auto-sync off leaves Git saying something other than the cluster. Revert in Git.
Pointing prod at a branch "for an hour": from then on every push to that branch deploys to prod, unreviewed. A CI check that chart sources are release tags stops it.
Escalating what the team owns (its own failed syncs, Degraded pods), or fixing what the platform owns.

Commands

`argocd app get APP`	Is it OK?
`argocd app history APP`	What was deployed, and when?
`argocd app diff APP; echo $?`	Anything waiting to be applied? Exit code `0` means nothing
`argocd app resources APP`	What objects does it own?
`argocd app logs APP --tail 5`	What is it saying? No kubectl needed
`git revert --no-edit HEAD && git push`	Roll back

Test yourself

Answer in your head first, then open the answer.

team-checkout wants a new chart release in dev. Which change?

A pull request changing targetRevision in apps/checkout-dev.yaml, which they can approve through CODEOWNERS.

Why is the Argo CD rollback button the wrong rollback here?

It refuses while auto-sync is on, and turning auto-sync off leaves Git disagreeing with the cluster.

team-checkout sees authentication required on its apps. Who acts first?

team-checkout checks its deploy key is still on the repo, and escalates if the credential in Argo CD must change.

What is worth measuring about this agreement?

How often a product team has to ask the platform team for something. Each escalation is a candidate for self-service.

Where module 12 leaves you: The platform repo documents the rules and enforces who reviews what. You have run a full release and rollback as team-checkout, and dev is back on the release it started with.