Amazon EKS — ArgoCD & GitOps

1 minute read

ArgoCD & GitOps

GitOps = Git is the single source of truth. ArgoCD watches your Git repo and automatically syncs your cluster to match.

How ArgoCD Works

GitOps Flow
┌─────────────────────────────────────────────────────┐
│                                                     │
│  Developer                                          │
│     │ git push (update manifests)                   │
│     ▼                                               │
│  Git Repo ──────────────────────┐                   │
│  (single source of truth)       │                   │
│                                 │ watch/poll         │
│                                 ▼                   │
│                           ┌──────────┐              │
│                           │ ArgoCD   │              │
│                           │ (detect  │              │
│                           │  diff)   │              │
│                           └────┬─────┘              │
│                                │ sync               │
│                                ▼                    │
│                           ┌──────────┐              │
│                           │ EKS      │              │
│                           │ Cluster  │              │
│                           └──────────┘              │
│                                                     │
│  No kubectl apply. No CI pipeline pushing to K8s.   │
│  ArgoCD pulls from Git and applies.                 │
└─────────────────────────────────────────────────────┘

Install ArgoCD

$ kubectl create namespace argocd
$ kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Get admin password
$ kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

# Port forward to UI
$ kubectl port-forward svc/argocd-server -n argocd 8080:443
# Visit https://localhost:8080

Create an Application

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/myorg/k8s-manifests.git
    targetRevision: main
    path: apps/my-app/overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true       # Delete resources removed from Git
      selfHeal: true    # Revert manual cluster changes
    syncOptions:
      - CreateNamespace=true

Key Features

Feature Description
Auto Sync Automatically apply changes from Git
Self Heal Revert manual cluster changes
Prune Delete resources removed from Git
Diff Visual diff of Git vs cluster
Rollback One-click rollback in UI
Multi-cluster Manage multiple clusters from one ArgoCD

Common Mistakes

Mistake Impact
Storing secrets in Git (plain text) Security breach
Not enabling self-heal Manual changes drift from Git
Not using ApplicationSets Repetitive app definitions
Giving ArgoCD cluster-admin to all projects Over-privileged

What’s Next?

Full pipeline: CI/CD Pipelines.

You may also enjoy