GitOps with ArgoCD: Declarative Continuous Delivery on Kubernetes
Implement declarative GitOps: automated drift detection, self-healing synchronizations, and progressive canary rollouts using ArgoCD and Argo Rollouts.
CloudPlatformLabs Engineering
Platform Architecture Team
1. The GitOps Paradigm Shift
In traditional push-based CI/CD pipelines, runner agents require high-privilege administrative access (`cluster-admin` kubeconfig) to the production Kubernetes API. If the CI runner is compromised, the entire cluster is vulnerable.
GitOps inverts this paradigm: an operator running inside the cluster (ArgoCD) continuously pulls the declarative state stored in Git. If someone manually changes a live deployment via `kubectl edit`, ArgoCD detects the configuration drift and immediately reconciles live state back to what is committed in Git.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: cloudplatformlabs-frontend
namespace: argocd
spec:
project: default
source:
repoURL: 'https://github.com/cloudplatformlabs/infrastructure-manifests.git'
targetRevision: HEAD
path: k8s/production
destination:
server: 'https://kubernetes.default.svc'
namespace: production
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true2. Progressive Delivery with Argo Rollouts
Standard Kubernetes rolling deployments do not support traffic splitting or automatic rollback based on real-time Prometheus error rates. Argo Rollouts introduces Canary step weighting and automated metric analysis.
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
name: billing-api
spec:
replicas: 10
strategy:
canary:
steps:
- setWeight: 10
- pause: {duration: 10m}
- setWeight: 25
- pause: {duration: 15m}
- setWeight: 50
- pause: {duration: 10m}Related Topics & Tags
Written by CloudPlatformLabs Engineering
Platform Architecture Team
CloudPlatformLabs publishes independent, peer-reviewed cloud and DevOps architecture blueprints, hands-on tutorials, and infrastructure case studies. Our mission is to make advanced infrastructure engineering transparent, resilient, and developer-friendly.