The app of apps pattern

A root Application points at a folder of Application manifests, so one sync creates and manages every other app — and the Argo CD setup itself lives in Git.

Creating Applications one by one with the CLI does not scale and is not GitOps: the Application objects themselves are not in Git. The app of apps pattern fixes that with one root Application whose source is a folder of other Application manifests.

platform-config/
  root/
    root-app.yaml              # applied once by hand (or by the bootstrap script)
  apps/
    ingress-nginx.yaml         # kind: Application
    cert-manager.yaml
    monitoring.yaml
    shop-api-dev.yaml
    shop-api-prod.yaml

# root-app.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: root
  namespace: argocd
  finalizers: [resources-finalizer.argocd.argoproj.io]
spec:
  project: default
  source:
    repoURL: https://github.com/example-org/platform-config.git
    targetRevision: main
    path: apps
  destination:
    server: https://kubernetes.default.svc
    namespace: argocd                 # child Applications are created in argocd
  syncPolicy:
    automated: { prune: true, selfHeal: true }

flowchart TB
  R["root"] --> I["ingress-nginx"]
  R --> C["cert-manager"]
  R --> M["monitoring"]
  R --> S["shop-api-dev / prod"]

What you get

Bootstrap a cluster with one kubectl apply -f root/root-app.yaml; everything else follows from Git.
Adding an app = adding a file through a pull request. Removing the file (with prune) removes the app.
Order with sync waves on the child Applications, for example cert-manager in wave -1 before apps that need certificates. (Argo CD waits for a child Application to become healthy before the next wave.)

Things to watch

Watch out for	Why
Deleting the root with cascade	It deletes every child Application — and their workloads if they carry the finalizer
Children in the wrong namespace	Applications must be created in the Argo CD namespace (or one allowed by "apps in any namespace")
Too much power in the root	Anyone who can merge to `apps/` can create any Application; protect the folder and use AppProjects
A hand-made change to a child	The root's self-heal reverts edits to child Application specs

Manage Argo CD with Argo CD

The same trick installs Argo CD's own config: an Application for the argo-cd Helm chart (or the install manifests plus your argocd-cm, argocd-rbac-cm) lets you upgrade Argo CD with a pull request. Keep a documented manual bootstrap path in case the controller is broken.

When it gets repetitive — twenty near-identical Application files that differ only in a name or a cluster — move to ApplicationSets (next lesson).