GitOps & what Argo CD is

Git as the source of truth.

Advanced12 min · lesson 1 of 12

Argo CD is a GitOps continuous-delivery tool for Kubernetes. GitOps means Git is the single source of truth for what should run in your cluster: you commit the desired state as manifests, and an in-cluster controller continuously pulls from Git and reconciles the cluster to match. Nobody runs kubectl apply against production; you change Git, and Argo CD makes the cluster follow. Deploys become pull requests, and the cluster self-corrects toward whatever Git says.

This inverts the usual push pipeline. In a traditional CD pipeline, CI has cluster credentials and pushes changes in. In GitOps (pull), the credentials live inside the cluster with Argo CD, which pulls from Git — so CI never touches the cluster, and the desired state is always the declarative content of a Git repo, auditable and revertible by commit. Argo CD adds a UI and CLI that show, per app, whether the live cluster matches Git (synced) and whether the workloads are healthy.

The GitOps pull loop

1commit

desired state to Git

2Argo CD

pulls + diffs

3sync

apply to the cluster

4reconcile

keep matching Git

Git is the source of truth; the controller pulls and reconciles. Credentials stay in the cluster, not in CI.

Why teams adopt it

The benefits are concrete: every change is a reviewed, audited Git commit; rollback is git revert; the cluster self-heals toward Git so out-of-band drift is corrected; and CI no longer needs standing cluster credentials. For platform teams it scales to many apps and clusters from one control plane. The trade is that Argo CD itself becomes a highly privileged component — it can deploy anything to anywhere it syncs — which is why the advanced lessons focus on hardening it.

Argo CD can deploy anything, anywhere it syncs

To reconcile clusters, Argo CD holds credentials for every cluster it manages and applies whatever Git tells it — so a compromise of Argo CD, or of a Git repo it trusts, is a compromise of those clusters. Treat it as a top-tier security asset from the start: the convenience of “just change Git” means Git and Argo CD together are now your deployment authority.

The Application resource