GitOps with Argo CD · Module 04

Argo CD Security and Operations

Run Argo CD safely in production: SSO and RBAC, secrets that never land in Git and read-only repo credentials, notifications and Prometheus metrics, and a troubleshooting runbook for the problems teams hit most.

Practice interactively →

What you will learn

• Set up SSO, disable the shared admin and write least-privilege RBAC policies
• Keep secrets out of Git with Sealed Secrets or External Secrets, and add repositories with read-only credentials
• Send notifications on sync and health events and monitor Argo CD with Prometheus
• Troubleshoot endless OutOfSync, stuck syncs, failed deletes and render errors

Lessons

1. Users, SSO and RBAC

   Turn on single sign-on, disable the shared admin user, and give each group only the actions it needs with policies in argocd-rbac-cm.

2. Secrets and repository credentials

   Never commit plain Kubernetes Secrets; use Sealed Secrets, External Secrets or SOPS. Give Argo CD read-only repo access with deploy keys stored as labelled Secrets.

3. Notifications and monitoring

   Argo CD Notifications sends messages on sync and health events, and Prometheus metrics such as argocd_app_info feed dashboards and alerts.

4. Troubleshooting Argo CD

   Most problems are one of a few: endless OutOfSync from fields other controllers own, stuck syncs, apps that will not delete, or repo and render errors. Each has a standard fix.