The Argo CD control plane — the GitOps fleet

The Argo CD fleet is the GitOps control plane this course is written against: Application, ApplicationSet, cluster registry, sync windows, RBAC, and the per-cluster reconcilers the hub deploys. Treating Argo CD as a fleet - with a manifest repo, an SLA, and named application owners

• is what turns reconciliation from a tool feature into the admission-control plane for every cluster the rest of the system runs.

The four primitives

A production Argo CD fleet depends on four primitives. Forgetting any one of them turns the deploy plane into a loop that runs but cannot be trusted.

flowchart LR
    HUB["Hub controller"] -->|"deploys"| SPOKE["Per-cluster reconcilers"]
    AS["ApplicationSet"] -->|"templates"| APP["Application"]
    APP -->|"manifests from"| MAN["Manifest repository"]
    APP -->|"pull by digest"| REG["OCI registry"]
    APP -->|"reconcile to"| CLUS["Cluster"]
    APP -->|"stamp"| RCPT["Deployment receipt"]
    SW["Sync windows"] --> APP
    CR["Cluster registry"] --> AS
    RB["RBAC policies"] --> APP

• Application. The unit Argo CD reconciles: a manifest repository, a target cluster, a target namespace. One Application per (service, environment) pair; multiple Applications per cluster are normal.
• ApplicationSet. The templating layer. One generator produces many Applications from a list of clusters, a list of services, or a git directory generator. The primitive that lets a fleet of N clusters and M services be described by O(N+M) YAML rather than N*M.
• Cluster registry. A list of clusters the hub knows about, with credentials per cluster, so ApplicationSet generators can iterate over them.
• Sync windows. Time-of-day windows where syncs are allowed or blocked. The mechanism that makes “no production deploys during the trading day” a declarative policy rather than an out-of-band reminder.

The control plane is separate from the reconcilers

Argo CD has two deployment shapes: standalone (one Argo CD per cluster) and hub-and-spoke (one hub that deploys Argo CD into many clusters). The fleet decision is which shape to use for which environment.

• Standalone for production. Each cluster runs its own Argo CD, talks to its own manifest repo, pulls by digest from its own registry mirror. A production cluster does not depend on a control-plane cluster being reachable. The blast radius of a control-plane outage is zero.
• Hub-and-spoke for staging and dev. One hub deploys many clusters; the hub holds the cluster registry and ApplicationSet definitions. The blast radius of a hub outage is large, but the cost of running N independent controllers is not justified at non-production environments.

The split is not arbitrary: it is the same principle that keeps the production OIDC issuer separate from the staging one. Production has its own identity; non-production shares.

The load-bearing trust control is RBAC at the controller

The B5 boundary - deployer to cluster - is enforced by RBAC at the controller, not by trust in the controller’s humanness. A cluster whose Argo CD service account has cluster-admin cannot tell whether a change came through the controller or from some other party with the same privileges. The controller’s RBAC must be:

• Per-namespace. One Argo CD role per namespace, with only the verbs the controller needs (get, list, watch, update on the resources it manages).
• Per-cluster. A production cluster’s Argo CD SA does not have access to a staging cluster’s API server.
• Scoped by resource. Even within a namespace, Argo CD should not have delete on resources it does not own - particularly on CustomResourceDefinitions, whose deletion can cascade.

echo "Inspect Argo CD's view of the cluster:"
argocd cluster list --output json \
  | jq '.[] | {server: .server, name: .name, namespaces: .namespaces}'

The output is the fleet’s view of the cluster registry. A row that lists every namespace is a row whose RBAC needs to be narrowed.

Production discipline

1. One manifest repo per environment, owned by the cluster team. Service teams propose via PR.
2. Per-cluster Argo CD in production. A hub outage is not a production outage.
3. RBAC at the controller is the B5 boundary. Audit it quarterly the way you audit IAM.
4. Sync windows for high-blast-radius environments. “No production deploys in the trading window” is a declarative policy, not a calendar reminder.

Cross-course references

• This course, Part LIII (ApplicationSet) - the templating primitive this lesson scales.
• This course, Part LVII (SyncWindows) - the time-of-day policy primitive.
• Kubernetes for Production Sysadmins - Parts XII-XIV cover the per-namespace controller RBAC this lesson assumes.

Quiz