GitOps means Git is the single source of truth for what runs in your cluster. Instead of running kubectl apply or helm upgrade from laptops and CI jobs, an agent inside the cluster continuously compares the cluster with a Git repository and applies the differences. Argo CD is the most popular GitOps tool for Kubernetes.

Benefits:

  • Every change is a reviewed commit — full audit trail, easy rollback (git revert).
  • Drift is detected and optionally corrected automatically.
  • CI no longer needs cluster credentials; it only commits to Git.
  • Rebuilding a cluster = point Argo CD at the repository.

1. Install Argo CD

On any cluster — kubeadm, managed, or a single-node k3s:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
kubectl -n argocd get pods

Argo CD needs roughly 1 GB RAM. Get the initial admin password:

kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d; echo

Access the UI without exposing it publicly:

kubectl -n argocd port-forward svc/argocd-server 8080:443

Open https://localhost:8080, log in as admin, and change the password. Install the CLI too (argocd login localhost:8080). Later you can expose it via an Ingress with TLS and SSO.

2. Prepare a Git repository

A simple layout:

k8s-config/
└── apps/
    └── whoami/
        ├── deployment.yaml
        ├── service.yaml
        └── ingress.yaml

Plain manifests, Kustomize overlays and Helm charts are all supported. For private repositories, add credentials (an SSH deploy key or token) under Settings → Repositories, or with argocd repo add.

3. Create an Application

# whoami-app.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: whoami
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/you/k8s-config.git
    targetRevision: main
    path: apps/whoami
  destination:
    server: https://kubernetes.default.svc
    namespace: whoami
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
kubectl apply -f whoami-app.yaml
  • automated — sync when Git changes (Argo CD polls every ~3 minutes; add a webhook for instant syncs).
  • prune — delete resources removed from Git.
  • selfHeal — revert manual changes made directly in the cluster.

The UI shows each resource’s sync and health status.

4. Helm charts as Applications

Install a chart with values from Git:

spec:
  source:
    repoURL: https://kubernetes.github.io/ingress-nginx
    chart: ingress-nginx
    targetRevision: 4.11.2
    helm:
      valuesObject:
        controller:
          replicaCount: 2

Or point at a chart in your own repository with path: and helm.valueFiles. See the Helm tutorial.

5. App of apps

Manage many Applications by putting their manifests in Git too, and creating one “root” Application that points to that directory. Adding a new app = adding a YAML file. ApplicationSets go further, generating Applications from templates (per cluster, per directory, per environment).

6. The CI side

With GitOps, CI builds and pushes the image, then updates the image tag in the config repository:

# in CI after pushing ghcr.io/org/api:${SHA}
git clone [email protected]:org/k8s-config.git && cd k8s-config
yq -i '.spec.template.spec.containers[0].image = "ghcr.io/org/api:'"$SHA"'"' apps/api/deployment.yaml
git commit -am "api: deploy $SHA" && git push

Argo CD Image Updater can automate this step by watching the registry.

7. Secrets

Don’t commit plain Kubernetes Secrets to Git. Options:

  • Sealed Secrets — encrypt secrets with a cluster key; safe to commit.
  • SOPS with age or GPG (via a plugin).
  • External Secrets Operator — sync from Vault, a cloud secret manager or a password manager.

See Kubernetes ConfigMaps and Secrets.

Rollback

git revert <commit>   # preferred: Git stays the source of truth
git push

The UI also offers “History and Rollback”, but with auto-sync enabled the next sync would reapply Git’s state — revert in Git.

Argo CD vs Flux

Flux is the other major GitOps tool: lighter, CLI-driven, no built-in UI. Argo CD’s web interface makes cluster state very visible, which many teams appreciate. Both are CNCF graduated projects.

Related: CI/CD pipelines explained and kubectl cheat sheet.

  • Argo CD
  • GitOps
  • Kubernetes