Git as the single source of truth

The problem

Manifests were applied by hand with kubectl apply. Nothing guaranteed the cluster still matched the repository: a change made by hand simply stayed.

What I built

• Argo CD v3.5.5 installed with Helm (chart 10.10.5), versioned values. A light setup: no SSO, no notifications, no ApplicationSet, about 300 MiB of memory.
• Automated sync: an object removed from the repository is deleted (prune), an object changed by hand is put back as in the repository (self-heal).
• An AppProject that limits the application to one repository, one namespace and six kinds of objects: a manifest aiming at anything else is refused.
• Interface restricted to the administrator, HTTPS terminated by the ingress.

Choices and reasons

• The pipeline keeps the choice of image, after the Trivy scan. Argo CD ignores that one field (ignoreDifferences with RespectIgnoreDifferences): the two never fight.
• Start with a single, public application. The others will follow later: their repositories are private, and the lab's sandbox is changed live by visitors.

Checked

• The application, scaled to 3 replicas by hand, was back to 2 within 5 seconds.
• A real pipeline then deployed a new version: the application stayed "Synced" and "Healthy", with the new image.

Limits and next steps

One application tracked, one environment. Next: an environments repository (staging, then production through a merge request) and progressive delivery with Argo Rollouts.