DevOps Practitioner · Module 8: GitOps and incident response
GitOps with Argo CD: App of Apps Without the Magic
Argo CD turns git directories into supervised deployments. Applications declare where config comes from and where it goes; sync status tells you whether reality matches, and health tells you whether it works.
10 min reading
Objectives
- Explain what an Application object declares: source, destination, sync policy
- Read sync status and health to know what is live and what disagrees
- Structure many apps with App of Apps or sets without losing review
- Choose manual versus automated sync deliberately per environment
Why this matters
Fifty microservices each need deploying to three environments, and the pipeline-per-service sprawl means nobody can answer what runs where. One Application object per deployable, grouped under a parent pattern, gives a single screen: this source commit, this destination, in sync or not, healthy or not. The fleet becomes legible without a spreadsheet, and the spreadsheet was always out of date anyway.
Concepts
An Application names a source (repo, path, revision) and a destination (cluster, namespace) plus the sync policy. Manual sync means a human presses the button after review: right for production, where judgment matters. Automated sync with prune and self-heal means git is law: right for dev and staging, dangerous where a bad merge meets no human. The policy per environment is a written decision, not an accident of who clicked last.
Sync status compares git against live (Synced or OutOfSync with the diff); health evaluates the live objects (Healthy, Degraded, Progressing). The two axes answer different questions: OutOfSync plus Healthy means drift that still works (investigate calmly); Synced plus Degraded means git's own state is broken (fix forward in git). Reading both before acting is the whole operator skill.
App of Apps scales the pattern: one parent Application holds the directory of child Application manifests, so adding a service means merging a file, reviewed like any change. The L47 lab's conflict exercise runs inside this structure: manual change versus git state, diagnosed from the sync diff. Keep the tree shallow and generated from a list where possible; hand-maintained forests rot.
Worked example
A demo parent with two child apps runs on a local cluster. The learner merges a values change to one child, watches manual sync apply it in staging with automated sync in dev, and reads both statuses. Then a manual live edit on one child shows OutOfSync with the exact diff, and the fix is a git commit (or a deliberate sync-back), never a silent reapply.
Common wrong move
Enabling automated sync with prune and self-heal everywhere including production on day one. The first bad merge deletes and reverts at machine speed with no human in the path. Earn automation per environment: manual first, automated after the review habit proves itself.
Quick check
An optional 4-question self-check. Answers never leave your device, are not stored, and never count toward any assessment.
Lesson feedback
No published feedback yet.
Log in and complete the lesson to leave feedback.
Exercise
On a local setup, run one staging app on manual sync and one dev app on automated sync, merge a change to both, and quote the two different sync behaviors.
Pass criteria
The record shows the dev app converging automatically, the staging app waiting for manual sync, and both statuses quoted.