Declarative GitOps continuous delivery for Kubernetes

Component Information

Property	Value
Chart Version	latest
Chart Type	application
Upstream Project	argocd
Maintainers	Platform Engineering Team (repo)

Why ArgoCD?

ArgoCD continuously reconciles what’s defined in Git with what’s running in the cluster. The platform uses it for several specific features:

• ApplicationSets: Generate Applications dynamically from templates, enabling patterns like “deploy to all namespaces matching this label” (see GitOps, Policy, and Eventing for the App‑of‑AppSets model)
• Sync Waves: Orchestrate deployment order (namespaces before CRDs, CRDs before applications); see the Sync Waves section in GitOps, Policy, and Eventing
• Prometheus Metrics: Observability into sync status, reconciliation loops, and resource health
• Multicluster Support: Can manage multiple clusters from a single control plane
• UI: Visual representation of application deployment status

ArgoCD handles single-cluster and multicluster setups with the same architecture. It exposes Prometheus metrics for integration with the observability stack, and works alongside other Argo ecosystem tools (Workflows, Events).

Alternatives like Flux exist and are viable. ArgoCD was chosen here primarily for its UI and ApplicationSet capabilities, which align well with the platform’s requirements.

Architecture Role

ArgoCD operates at Layer 2 of the platform, the Automation & Governance layer. It’s the brain that translates declarative manifests in Git into cluster state.

Key integration points:

• Git Provider: Pulls manifests and monitors for changes
• Kubernetes API: Applies resources and continuously reconciles desired state
• Kyverno: Works in tandem during admission control (Kyverno validates what ArgoCD deploys)
• External Secrets: ArgoCD deploys ExternalSecret resources, which trigger secret synchronization from Vault
• Prometheus: Exposes metrics on sync status, application health, and reconciliation performance

The configuration here uses resourceTrackingMethod: annotation for better performance (avoids label length limits) and excludes high-frequency resources like CiliumEndpoint and PolicyReport from reconciliation to reduce API server load.

ArgoCD has selfHeal: true enabled in ApplicationSets, meaning any manual changes to resources are automatically reverted to match Git. This enforces GitOps discipline and ensures the cluster state is always reproducible.

See GitOps Model for how ArgoCD orchestrates the entire platform.

Redis Cache

ArgoCD uses Redis as an internal cache to improve reconciliation performance. The application controller caches cluster state in Redis to reduce load on the Kubernetes API server during large-scale reconciliation loops.

Current Configuration:

• Single Redis instance (bundled with ArgoCD chart)
• Resources: 100m CPU / 128Mi RAM requests, 250m CPU / 256Mi RAM limits

How It Works:

When ArgoCD reconciles applications, it queries the Kubernetes API server for resource states. Redis caches these queries to:

• Reduce API server load during sync operations
• Speed up application health assessments
• Improve UI responsiveness when viewing application details

Production Considerations:

• For high-availability setups, use external Redis with persistence
• Consider Redis Sentinel or Redis Cluster for multi-replica deployments
• Monitor cache hit rates via ArgoCD controller metrics

See the Configuration Values section below for Redis resource tuning.

---

Configuration Values