GitOps with Argo CD & Flux Roadmap

Learn the operating model before selecting a controller. Practice describing intent, previewing changes, identifying ownership, and distinguishing actual state from authoritative desired state.

• Explain declarative, versioned and immutable, pulled automatically, and continuously reconciled
• Distinguish application source, build artifact, configuration source, controller state, and live state
• Use Kubernetes manifests with explicit selectors, probes, rollout strategy, resources, and ownership
• Preview changes with rendering, schema checks, server-side dry run, or controlled diff
• Define what drift should self-heal and what another controller legitimately owns
• Understand pruning as a deletion operation with inventory, scope, and data consequences
• Keep emergency live changes in a break-glass process and reconcile durable fixes back to Git
• Use immutable image digests and identify exact configuration revisions
• Separate CI artifact production from CD reconciliation and cluster authorization
• Create a failure matrix for source, rendering, apply, health, authorization, and recovery

Design desired state around ownership and promotion. Render the final output rather than assuming templates and overlays combine safely.

• Choose mono- or multi-repository boundaries based on ownership, access, scale, and blast radius
• Create explicit cluster and environment paths with protected production ownership
• Use Kustomize bases for common resources and small overlays for environment differences
• Use focused patches, image transformations, generators, and name references deliberately
• Use Helm for versioned reusable packages with documented values and values schemas
• Pin chart versions or OCI digests and review chart and CRD lifecycle
• Render every overlay and Helm configuration in pull-request CI
• Validate schemas, policy, namespaces, RBAC, probes, resources, and destructive diffs
• Minimize GitHub workflow permissions and pin reviewed actions to immutable commit SHAs
• Promote the same tested image digest through reviewed environment changes

Use Argo CD Applications as bounded delivery units, then add generation, ordering, health, and progressive rollout without turning the root application into an unrestricted control plane.

• Install a pinned supported Argo CD release and model bootstrap declaratively
• Define Application source, destination, project, sync policy, prune, and self-heal
• Use AppProjects to constrain repositories, clusters, namespaces, and resource kinds
• Map Argo CD roles and Kubernetes RBAC to distinct platform and tenant responsibilities
• Keep app-of-apps roots small, admin-owned, reviewed, and recoverable
• Generate repeated Applications with ApplicationSet and constrained templates
• Use sync phases, waves, hooks, and health checks for explicit ordering
• Make migrations idempotent or version-aware, bounded, and least privilege
• Integrate Argo Rollouts for a synthetic canary with declared analysis and abort
• Observe sync, health, operation, revision, controller, notification, and stale-state signals

Compose a fleet from Kubernetes-native APIs. Separate source acquisition from Kustomize and Helm reconciliation, then constrain each object with dependencies, service accounts, decryption authority, and version policy.

• Use GitRepository, OCIRepository, HelmRepository, and Bucket Sources according to origin needs
• Read Source artifact revision, digest, Ready condition, and acquisition errors
• Configure Kustomization path, interval, retry, prune, wait, timeout, inventory, and health
• Use dependsOn for CRDs, controllers, policy, identities, and workload prerequisites
• Operate HelmRelease chart references, values, tests, remediation, history, and drift detection
• Set serviceAccountName and namespace RBAC for tenant reconciliation
• Enforce default impersonation and restrict cross-namespace references where appropriate
• Commit no plaintext or base64-only secrets; use SOPS ciphertext and external decryption authority
• Rotate encryption recipients or KMS authority without printing decrypted content
• Use ImageRepository, ImagePolicy, and ImageUpdateAutomation with a production review branch

Operate GitOps as a delivery system. Verify artifacts and identities, alert on stale reconciliation, test controlled failures, preserve Git as authority during rollback, and prove what Git can and cannot restore.

• Apply admission policy to workload security, namespaces, trusted registries, and immutable images
• Verify Sigstore signatures or attestations against approved identity, issuer, digest, and provenance policy
• Understand SLSA provenance as build evidence that still requires an organizational verification policy
• Use Argo Rollouts or Flagger to increase exposure gradually and abort on failed analysis
• Track source freshness, last applied and attempted revisions, conditions, errors, duration, drift, and suspension
• Forward safe Events and alerts with cluster, object, revision, digest, and error category
• Diagnose from status and source through render, authorization, apply, health, and controller logs
• Rollback through a reviewed Git revert or forward change to a known-good immutable artifact
• Back up stateful data and external systems separately from declarative cluster configuration
• Rebuild a lost cluster, rehydrate secrets and identity, measure cost, and verify cleanup