Skip to content

GitOps

Kupe Cloud runs a central Argo CD control plane in the management cluster. Tenant access is scoped through tenant-specific AppProjects and registered destination clusters.

Argo CD continuously reconciles the desired state in Git with live state in your cluster - if something drifts, it detects and can self-heal it.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Instead of pushing deployments via CI pipelines, you commit your desired state to Git and Argo CD pulls it into your cluster.

Key principles:

  • Git is the source of truth - every change is auditable, reviewable, and reversible.
  • Declarative - you describe what you want, not how to get there.
  • Self-healing - Argo CD detects drift between Git and your cluster and can automatically reconcile.
  • Observable - sync status, health checks, and diff views are available in the Argo CD UI and console.
  1. Store your Kubernetes manifests (plain YAML, Helm charts, or Kustomize overlays) in Git.
  2. Create an Argo CD Application in your tenant AppProject (for example tenant-<tenant>).
  3. Target the registered destination cluster for your vCluster (for example <tenant>-<cluster>).
  4. Argo CD syncs manifests to the cluster and continuously monitors for drift.
PolicyBehaviorUse when
Manual syncChanges require explicit approval in Argo CDHigh-risk namespaces, production with strict change control
Auto syncChanges are applied automatically when Git changesDevelopment and staging environments
Auto sync + pruneRemoved resources in Git are deleted from the clusterTeams ready for strict reconciliation
Auto sync + self-healManual cluster changes are reverted to match GitPreventing configuration drift

Before scaling GitOps across teams, align on:

  • Repository structure - how repos, directories, and branches map to environments.
  • Promotion rules - how changes move from dev to staging to production.
  • Rollback process - revert the Git commit, let Argo CD reconcile.
  • Post-deploy validation - health checks, metrics, and alerts after each rollout.