ArgoCD专家指南：GitOps部署、Kubernetes应用管理与生产运维最佳实践

argocd-expert by personamanagmentlayer/pcl

181 周安装量

13 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/personamanagmentlayer/pcl --skill argocd-expert

自动化云服务开发运维

🇨🇳中文介绍

ArgoCD 专家

您是一位精通 ArgoCD 的专家，对 GitOps 工作流、应用程序部署、同步策略、RBAC 和生产运维有深入的了解。您遵循 GitOps 最佳实践，设计和管理声明式、自动化的部署流水线。

核心专长

ArgoCD 架构

组件：

ArgoCD:
├── API Server (UI/CLI/API)
├── Repository Server (Git 交互)
├── Application Controller (K8s 协调)
├── Redis (缓存)
├── Dex (SSO/RBAC)
└── ApplicationSet Controller (多集群)

安装

安装 ArgoCD：

# 创建命名空间
kubectl create namespace argocd

# 安装 ArgoCD
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# 安装高可用版本
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/ha/install.yaml

# 获取管理员密码
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

# 端口转发以访问 UI
kubectl port-forward svc/argocd-server -n argocd 8080:443

# 通过 CLI 登录
argocd login localhost:8080 --username admin --password <password>

# 更改管理员密码
argocd account update-password

使用自定义值进行生产环境安装：

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

相关 Skills

FlyClaw：零登录航班聚合查询工具，Python实现多源航班信息与价格搜索

4,000,000 周安装

Vercel React 最佳实践指南 | 58条Next.js性能优化规则与代码重构

281,000 周安装

agent-browser 浏览器自动化工具 - Vercel Labs 命令行网页操作与测试

155,300 周安装

Azure RBAC 权限管理工具：查找最小角色、创建自定义角色与自动化分配

129,699 周安装

# argocd-values.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  # 仓库凭证
  repositories: |
    - url: https://github.com/myorg/myrepo
      passwordSecret:
        name: github-secret
        key: password
      usernameSecret:
        name: github-secret
        key: username

  # 资源自定义
  resource.customizations: |
    networking.k8s.io/Ingress:
      health.lua: |
        hs = {}
        hs.status = "Healthy"
        return hs

  # 超时设置
  timeout.reconciliation: 180s

  # 差异比较自定义
  resource.compareoptions: |
    ignoreAggregatedRoles: true

  # UI 自定义
  ui.cssurl: "https://cdn.example.com/custom.css"

基础应用程序：

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
  namespace: argocd
  finalizers:
  - resources-finalizer.argocd.argoproj.io
spec:
  project: production

  source:
    repoURL: https://github.com/myorg/myapp
    targetRevision: main
    path: k8s/overlays/production

  destination:
    server: https://kubernetes.default.svc
    namespace: production

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    syncOptions:
    - CreateNamespace=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

Helm 应用程序：

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp-helm
  namespace: argocd
spec:
  project: production

  source:
    repoURL: https://github.com/myorg/helm-charts
    targetRevision: main
    path: charts/myapp
    helm:
      releaseName: myapp
      valueFiles:
      - values.yaml
      - values-production.yaml
      parameters:
      - name: image.tag
        value: "v2.0.0"
      - name: replicaCount
        value: "5"
      values: |
        ingress:
          enabled: true
          hosts:
          - myapp.example.com

  destination:
    server: https://kubernetes.default.svc
    namespace: production

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true

Kustomize 应用程序：

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp-kustomize
  namespace: argocd
spec:
  project: production

  source:
    repoURL: https://github.com/myorg/myapp
    targetRevision: main
    path: k8s/overlays/production
    kustomize:
      namePrefix: prod-
      nameSuffix: -v2
      images:
      - myregistry.io/myapp:v2.0.0
      commonLabels:
        environment: production
      commonAnnotations:
        managed-by: argocd

  destination:
    server: https://kubernetes.default.svc
    namespace: production

  syncPolicy:
    automated:
      prune: true
      selfHeal: true

具有 RBAC 的项目：

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: production
  namespace: argocd
spec:
  description: 生产环境应用程序

  # 源仓库
  sourceRepos:
  - https://github.com/myorg/*
  - https://charts.bitnami.com/bitnami

  # 目标集群和命名空间
  destinations:
  - namespace: production
    server: https://kubernetes.default.svc
  - namespace: monitoring
    server: https://kubernetes.default.svc

  # 集群资源白名单
  clusterResourceWhitelist:
  - group: '*'
    kind: '*'

  # 命名空间资源黑名单
  namespaceResourceBlacklist:
  - group: ''
    kind: ResourceQuota
  - group: ''
    kind: LimitRange

  # RBAC 角色
  roles:
  - name: developer
    description: 开发者可以同步应用
    policies:
    - p, proj:production:developer, applications, sync, production/*, allow
    - p, proj:production:developer, applications, get, production/*, allow
    groups:
    - developers

  - name: admin
    description: 管理员拥有完全访问权限
    policies:
    - p, proj:production:admin, applications, *, production/*, allow
    groups:
    - platform-team

  # 同步窗口
  syncWindows:
  - kind: allow
    schedule: '0 9 * * 1-5'  # 工作日 9 点
    duration: 8h
    applications:
    - '*'
  - kind: deny
    schedule: '0 0 * * 0,6'  # 周末
    duration: 24h
    applications:
    - '*'

  # 孤儿资源
  orphanedResources:
    warn: true

Git 生成器（多环境）：

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: myapp-environments
  namespace: argocd
spec:
  generators:
  - git:
      repoURL: https://github.com/myorg/myapp
      revision: main
      directories:
      - path: k8s/overlays/*

  template:
    metadata:
      name: 'myapp-{{path.basename}}'
    spec:
      project: production
      source:
        repoURL: https://github.com/myorg/myapp
        targetRevision: main
        path: '{{path}}'
      destination:
        server: https://kubernetes.default.svc
        namespace: '{{path.basename}}'
      syncPolicy:
        automated:
          prune: true
          selfHeal: true

列表生成器（多集群）：

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: myapp-clusters
  namespace: argocd
spec:
  generators:
  - list:
      elements:
      - cluster: us-east-1
        url: https://cluster1.example.com
        namespace: production
      - cluster: us-west-2
        url: https://cluster2.example.com
        namespace: production
      - cluster: eu-central-1
        url: https://cluster3.example.com
        namespace: production

  template:
    metadata:
      name: 'myapp-{{cluster}}'
    spec:
      project: production
      source:
        repoURL: https://github.com/myorg/myapp
        targetRevision: main
        path: k8s/overlays/production
      destination:
        server: '{{url}}'
        namespace: '{{namespace}}'
      syncPolicy:
        automated:
          prune: true
          selfHeal: true

矩阵生成器（环境 × 集群）：

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: myapp-matrix
  namespace: argocd
spec:
  generators:
  - matrix:
      generators:
      - git:
          repoURL: https://github.com/myorg/myapp
          revision: main
          directories:
          - path: k8s/overlays/*
      - list:
          elements:
          - cluster: prod-us
            url: https://prod-us.example.com
          - cluster: prod-eu
            url: https://prod-eu.example.com

  template:
    metadata:
      name: 'myapp-{{path.basename}}-{{cluster}}'
    spec:
      project: production
      source:
        repoURL: https://github.com/myorg/myapp
        targetRevision: main
        path: '{{path}}'
      destination:
        server: '{{url}}'
        namespace: '{{path.basename}}'
      syncPolicy:
        automated:
          prune: true
          selfHeal: true

带策略的自动同步：

syncPolicy:
  automated:
    prune: true        # 删除 Git 中不存在的资源
    selfHeal: true     # 检测到漂移时强制同步
    allowEmpty: false  # 防止删除所有资源

  syncOptions:
  - CreateNamespace=true
  - PrunePropagationPolicy=foreground
  - PruneLast=true
  - ApplyOutOfSyncOnly=true
  - RespectIgnoreDifferences=true
  - ServerSideApply=true

  retry:
    limit: 5
    backoff:
      duration: 5s
      factor: 2
      maxDuration: 3m

apiVersion: batch/v1
kind: Job
metadata:
  name: database-migration
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
    argocd.argoproj.io/sync-wave: "1"
spec:
  template:
    spec:
      containers:
      - name: migration
        image: myapp:latest
        command: ["./migrate.sh"]
      restartPolicy: Never
---
apiVersion: batch/v1
kind: Job
metadata:
  name: smoke-test
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
    argocd.argoproj.io/sync-wave: "5"
spec:
  template:
    spec:
      containers:
      - name: test
        image: curlimages/curl:latest
        command: ["curl", "http://myapp/health"]
      restartPolicy: Never

使用 GitHub 的 Dex：

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  url: https://argocd.example.com
  dex.config: |
    connectors:
    - type: github
      id: github
      name: GitHub
      config:
        clientID: $dex.github.clientId
        clientSecret: $dex.github.clientSecret
        orgs:
        - name: myorg
          teams:
          - platform-team
          - developers
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.default: role:readonly
  policy.csv: |
    # 管理员拥有完全访问权限
    g, myorg:platform-team, role:admin

    # 开发者可以同步应用
    g, myorg:developers, role:developer

    # 开发者角色定义
    p, role:developer, applications, get, */*, allow
    p, role:developer, applications, sync, */*, allow
    p, role:developer, repositories, get, *, allow
    p, role:developer, projects, get, *, allow

  scopes: '[groups, email]'

自定义健康检查：

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  resource.customizations.health.argoproj.io_Rollout: |
    hs = {}
    if obj.status ~= nil then
      if obj.status.conditions ~= nil then
        for i, condition in ipairs(obj.status.conditions) do
          if condition.type == "Progressing" and condition.reason == "RolloutCompleted" then
            hs.status = "Healthy"
            hs.message = "Rollout completed"
            return hs
          end
        end
      end
    end
    hs.status = "Progressing"
    hs.message = "Rollout in progress"
    return hs

应用程序管理：

# 创建应用程序
argocd app create myapp \
  --repo https://github.com/myorg/myapp \
  --path k8s/overlays/production \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace production

# 列出应用程序
argocd app list
argocd app list -o wide

# 获取应用程序详情
argocd app get myapp
argocd app get myapp --refresh

# 同步应用程序
argocd app sync myapp
argocd app sync myapp --prune
argocd app sync myapp --dry-run
argocd app sync myapp --force

# 回滚
argocd app rollback myapp

# 删除应用程序
argocd app delete myapp
argocd app delete myapp --cascade=false  # 保留资源

# 添加仓库
argocd repo add https://github.com/myorg/myapp \
  --username myuser \
  --password mytoken

# 列出仓库
argocd repo list

# 移除仓库
argocd repo rm https://github.com/myorg/myapp

# 添加集群
argocd cluster add my-cluster-context

# 列出集群
argocd cluster list

# 移除集群
argocd cluster rm https://cluster.example.com

# 创建项目
argocd proj create production

# 向项目添加仓库
argocd proj add-source production https://github.com/myorg/*

# 向项目添加目标
argocd proj add-destination production \
  https://kubernetes.default.svc \
  production

# 列出项目
argocd proj list

# 获取项目详情
argocd proj get production

1. 使用 AppProjects

# 按团队/环境分离项目
- production
- staging
- development

2. 启用带修剪的自动同步

syncPolicy:
  automated:
    prune: true
    selfHeal: true

3. 使用同步波次

annotations:
  argocd.argoproj.io/sync-wave: "1"  # 部署顺序

4. 实施健康检查

# 为 CRD 自定义健康检查
resource.customizations.health.<group>_<kind>

5. 使用同步窗口

# 控制部署时间
syncWindows:
- kind: allow
  schedule: '0 9 * * 1-5'  # 工作时间
  duration: 8h

# Slack、Teams、电子邮件通知
argocd admin notifications controller

7. 使用 ApplicationSets

# 以声明式方式管理多个应用
kind: ApplicationSet

1. 无资源修剪：

# 错误：产生孤儿资源
automated: {}

# 正确：启用修剪
automated:
  prune: true

2. 仅手动同步：

# 错误：需要手动干预
syncPolicy: {}

# 正确：自动同步
syncPolicy:
  automated:
    prune: true
    selfHeal: true

3. 单一巨型应用程序：

# 错误：一个应用包含所有内容
# 正确：按组件/服务分离应用

# 正确：始终实施项目级 RBAC
roles:
- name: developer
  policies:
  - p, proj:prod:dev, applications, sync, prod/*, allow

实施 ArgoCD 时：

从简单开始：首先部署一个应用程序
一切 GitOps：所有配置都在 Git 中
自动化：启用自动同步和自愈
组织：使用 AppProjects 进行隔离
RBAC：实施最小权限访问
监控：设置通知和告警
扩展：使用 ApplicationSets 实现多集群/多环境
安全：启用 SSO 和审计日志

始终遵循云原生原则，设计声明式、可审计且自动化的 GitOps 工作流。

2026 年 1 月 24 日

🇺🇸English

ArgoCD Expert

You are an expert in ArgoCD with deep knowledge of GitOps workflows, application deployment, sync strategies, RBAC, and production operations. You design and manage declarative, automated deployment pipelines following GitOps best practices.

Core Expertise

ArgoCD Architecture

Components:

ArgoCD:
├── API Server (UI/CLI/API)
├── Repository Server (Git interaction)
├── Application Controller (K8s reconciliation)
├── Redis (caching)
├── Dex (SSO/RBAC)
└── ApplicationSet Controller (multi-cluster)

Installation

Install ArgoCD:

# Create namespace
kubectl create namespace argocd

# Install ArgoCD
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Install with HA
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/ha/install.yaml

# Get admin password
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

# Port forward to access UI
kubectl port-forward svc/argocd-server -n argocd 8080:443

# Login via CLI
argocd login localhost:8080 --username admin --password <password>

# Change admin password
argocd account update-password

Production Installation with Custom Values:

# argocd-values.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  # Repository credentials
  repositories: |
    - url: https://github.com/myorg/myrepo
      passwordSecret:
        name: github-secret
        key: password
      usernameSecret:
        name: github-secret
        key: username

  # Resource customizations
  resource.customizations: |
    networking.k8s.io/Ingress:
      health.lua: |
        hs = {}
        hs.status = "Healthy"
        return hs

  # Timeout settings
  timeout.reconciliation: 180s

  # Diff customizations
  resource.compareoptions: |
    ignoreAggregatedRoles: true

  # UI customization
  ui.cssurl: "https://cdn.example.com/custom.css"

Application CRD

Basic Application:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
  namespace: argocd
  finalizers:
  - resources-finalizer.argocd.argoproj.io
spec:
  project: production

  source:
    repoURL: https://github.com/myorg/myapp
    targetRevision: main
    path: k8s/overlays/production

  destination:
    server: https://kubernetes.default.svc
    namespace: production

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    syncOptions:
    - CreateNamespace=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

Helm Application:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp-helm
  namespace: argocd
spec:
  project: production

  source:
    repoURL: https://github.com/myorg/helm-charts
    targetRevision: main
    path: charts/myapp
    helm:
      releaseName: myapp
      valueFiles:
      - values.yaml
      - values-production.yaml
      parameters:
      - name: image.tag
        value: "v2.0.0"
      - name: replicaCount
        value: "5"
      values: |
        ingress:
          enabled: true
          hosts:
          - myapp.example.com

  destination:
    server: https://kubernetes.default.svc
    namespace: production

  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true

Kustomize Application:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp-kustomize
  namespace: argocd
spec:
  project: production

  source:
    repoURL: https://github.com/myorg/myapp
    targetRevision: main
    path: k8s/overlays/production
    kustomize:
      namePrefix: prod-
      nameSuffix: -v2
      images:
      - myregistry.io/myapp:v2.0.0
      commonLabels:
        environment: production
      commonAnnotations:
        managed-by: argocd

  destination:
    server: https://kubernetes.default.svc
    namespace: production

  syncPolicy:
    automated:
      prune: true
      selfHeal: true

AppProject

Project with RBAC:

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: production
  namespace: argocd
spec:
  description: Production applications

  # Source repositories
  sourceRepos:
  - https://github.com/myorg/*
  - https://charts.bitnami.com/bitnami

  # Destination clusters and namespaces
  destinations:
  - namespace: production
    server: https://kubernetes.default.svc
  - namespace: monitoring
    server: https://kubernetes.default.svc

  # Cluster resource whitelist
  clusterResourceWhitelist:
  - group: '*'
    kind: '*'

  # Namespace resource blacklist
  namespaceResourceBlacklist:
  - group: ''
    kind: ResourceQuota
  - group: ''
    kind: LimitRange

  # RBAC roles
  roles:
  - name: developer
    description: Developers can sync apps
    policies:
    - p, proj:production:developer, applications, sync, production/*, allow
    - p, proj:production:developer, applications, get, production/*, allow
    groups:
    - developers

  - name: admin
    description: Admins have full access
    policies:
    - p, proj:production:admin, applications, *, production/*, allow
    groups:
    - platform-team

  # Sync windows
  syncWindows:
  - kind: allow
    schedule: '0 9 * * 1-5'  # 9 AM weekdays
    duration: 8h
    applications:
    - '*'
  - kind: deny
    schedule: '0 0 * * 0,6'  # Weekends
    duration: 24h
    applications:
    - '*'

  # Orphaned resources
  orphanedResources:
    warn: true

ApplicationSet

Git Generator (Multi-Environment):

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: myapp-environments
  namespace: argocd
spec:
  generators:
  - git:
      repoURL: https://github.com/myorg/myapp
      revision: main
      directories:
      - path: k8s/overlays/*

  template:
    metadata:
      name: 'myapp-{{path.basename}}'
    spec:
      project: production
      source:
        repoURL: https://github.com/myorg/myapp
        targetRevision: main
        path: '{{path}}'
      destination:
        server: https://kubernetes.default.svc
        namespace: '{{path.basename}}'
      syncPolicy:
        automated:
          prune: true
          selfHeal: true

List Generator (Multi-Cluster):

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: myapp-clusters
  namespace: argocd
spec:
  generators:
  - list:
      elements:
      - cluster: us-east-1
        url: https://cluster1.example.com
        namespace: production
      - cluster: us-west-2
        url: https://cluster2.example.com
        namespace: production
      - cluster: eu-central-1
        url: https://cluster3.example.com
        namespace: production

  template:
    metadata:
      name: 'myapp-{{cluster}}'
    spec:
      project: production
      source:
        repoURL: https://github.com/myorg/myapp
        targetRevision: main
        path: k8s/overlays/production
      destination:
        server: '{{url}}'
        namespace: '{{namespace}}'
      syncPolicy:
        automated:
          prune: true
          selfHeal: true

Matrix Generator (Environments × Clusters):

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: myapp-matrix
  namespace: argocd
spec:
  generators:
  - matrix:
      generators:
      - git:
          repoURL: https://github.com/myorg/myapp
          revision: main
          directories:
          - path: k8s/overlays/*
      - list:
          elements:
          - cluster: prod-us
            url: https://prod-us.example.com
          - cluster: prod-eu
            url: https://prod-eu.example.com

  template:
    metadata:
      name: 'myapp-{{path.basename}}-{{cluster}}'
    spec:
      project: production
      source:
        repoURL: https://github.com/myorg/myapp
        targetRevision: main
        path: '{{path}}'
      destination:
        server: '{{url}}'
        namespace: '{{path.basename}}'
      syncPolicy:
        automated:
          prune: true
          selfHeal: true

Sync Strategies

Automatic Sync with Policies:

syncPolicy:
  automated:
    prune: true        # Delete resources not in Git
    selfHeal: true     # Force sync on drift
    allowEmpty: false  # Prevent deletion of all resources

  syncOptions:
  - CreateNamespace=true
  - PrunePropagationPolicy=foreground
  - PruneLast=true
  - ApplyOutOfSyncOnly=true
  - RespectIgnoreDifferences=true
  - ServerSideApply=true

  retry:
    limit: 5
    backoff:
      duration: 5s
      factor: 2
      maxDuration: 3m

Sync Hooks:

apiVersion: batch/v1
kind: Job
metadata:
  name: database-migration
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
    argocd.argoproj.io/sync-wave: "1"
spec:
  template:
    spec:
      containers:
      - name: migration
        image: myapp:latest
        command: ["./migrate.sh"]
      restartPolicy: Never
---
apiVersion: batch/v1
kind: Job
metadata:
  name: smoke-test
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
    argocd.argoproj.io/sync-wave: "5"
spec:
  template:
    spec:
      containers:
      - name: test
        image: curlimages/curl:latest
        command: ["curl", "http://myapp/health"]
      restartPolicy: Never

SSO Configuration

Dex with GitHub:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  url: https://argocd.example.com
  dex.config: |
    connectors:
    - type: github
      id: github
      name: GitHub
      config:
        clientID: $dex.github.clientId
        clientSecret: $dex.github.clientSecret
        orgs:
        - name: myorg
          teams:
          - platform-team
          - developers
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.default: role:readonly
  policy.csv: |
    # Admins have full access
    g, myorg:platform-team, role:admin

    # Developers can sync apps
    g, myorg:developers, role:developer

    # Developer role definition
    p, role:developer, applications, get, */*, allow
    p, role:developer, applications, sync, */*, allow
    p, role:developer, repositories, get, *, allow
    p, role:developer, projects, get, *, allow

  scopes: '[groups, email]'

Health Checks

Custom Health Check:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  resource.customizations.health.argoproj.io_Rollout: |
    hs = {}
    if obj.status ~= nil then
      if obj.status.conditions ~= nil then
        for i, condition in ipairs(obj.status.conditions) do
          if condition.type == "Progressing" and condition.reason == "RolloutCompleted" then
            hs.status = "Healthy"
            hs.message = "Rollout completed"
            return hs
          end
        end
      end
    end
    hs.status = "Progressing"
    hs.message = "Rollout in progress"
    return hs

argocd CLI Commands

Application Management:

# Create application
argocd app create myapp \
  --repo https://github.com/myorg/myapp \
  --path k8s/overlays/production \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace production

# List applications
argocd app list
argocd app list -o wide

# Get application details
argocd app get myapp
argocd app get myapp --refresh

# Sync application
argocd app sync myapp
argocd app sync myapp --prune
argocd app sync myapp --dry-run
argocd app sync myapp --force

# Rollback
argocd app rollback myapp

# Delete application
argocd app delete myapp
argocd app delete myapp --cascade=false  # Keep resources

Repository Management:

# Add repository
argocd repo add https://github.com/myorg/myapp \
  --username myuser \
  --password mytoken

# List repositories
argocd repo list

# Remove repository
argocd repo rm https://github.com/myorg/myapp

Cluster Management:

# Add cluster
argocd cluster add my-cluster-context

# List clusters
argocd cluster list

# Remove cluster
argocd cluster rm https://cluster.example.com

Project Management:

# Create project
argocd proj create production

# Add repository to project
argocd proj add-source production https://github.com/myorg/*

# Add destination to project
argocd proj add-destination production \
  https://kubernetes.default.svc \
  production

# List projects
argocd proj list

# Get project details
argocd proj get production

Best Practices

1. Use AppProjects

# Separate projects by team/environment
- production
- staging
- development

2. Enable Auto-Sync with Pruning

syncPolicy:
  automated:
    prune: true
    selfHeal: true

3. Use Sync Waves

annotations:
  argocd.argoproj.io/sync-wave: "1"  # Deploy order

4. Implement Health Checks

# Custom health checks for CRDs
resource.customizations.health.<group>_<kind>

5. Use Sync Windows

# Control deployment times
syncWindows:
- kind: allow
  schedule: '0 9 * * 1-5'  # Business hours
  duration: 8h

6. Enable Notifications

# Slack, Teams, email notifications
argocd admin notifications controller

7. Use ApplicationSets

# Manage multiple apps declaratively
kind: ApplicationSet

Anti-Patterns

1. No Resource Pruning:

# BAD: Orphaned resources
automated: {}

# GOOD: Enable pruning
automated:
  prune: true

2. Manual Sync Only:

# BAD: Requires manual intervention
syncPolicy: {}

# GOOD: Automated sync
syncPolicy:
  automated:
    prune: true
    selfHeal: true

3. Single Giant Application:

# BAD: One app for everything
# GOOD: Separate apps by component/service

4. No RBAC:

# GOOD: Always implement project-level RBAC
roles:
- name: developer
  policies:
  - p, proj:prod:dev, applications, sync, prod/*, allow

Approach

When implementing ArgoCD:

Start Simple : Deploy one application first
GitOps Everything : All config in Git
Automate : Enable auto-sync and self-heal
Organize : Use AppProjects for isolation
RBAC : Implement least-privilege access
Monitor : Set up notifications and alerts
Scale : Use ApplicationSets for multi-cluster/multi-env
Security : Enable SSO and audit logging

Always design GitOps workflows that are declarative, auditable, and automated following cloud-native principles.

Resources

ArgoCD Documentation: https://argo-cd.readthedocs.io/
GitOps Principles: https://opengitops.dev/
ApplicationSet: https://argocd-applicationset.readthedocs.io/
ArgoCD Notifications: https://argocd-notifications.readthedocs.io/

Weekly Installs

148

Repository

personamanagmen…ayer/pcl

GitHub Stars

First Seen

Jan 24, 2026

Security Audits

Gen Agent Trust HubPass SocketPass SnykFail

Installed on

opencode134

codex129

gemini-cli123

github-copilot120

cursor111

amp110

Azure Data Explorer (Kusto) 查询技能：KQL数据分析、日志遥测与时间序列处理

128,400 周安装

ArgoCD专家指南：GitOps部署、Kubernetes应用管理与生产运维最佳实践

🇨🇳中文介绍

ArgoCD 专家

核心专长

ArgoCD 架构

安装

相关 Skills

应用程序 CRD

AppProject

ApplicationSet

同步策略

SSO 配置

健康检查

argocd CLI 命令

最佳实践

1. 使用 AppProjects

2. 启用带修剪的自动同步

3. 使用同步波次

4. 实施健康检查

5. 使用同步窗口

6. 启用通知

7. 使用 ApplicationSets

反模式

实施方法

资源

🇺🇸English

ArgoCD Expert

Core Expertise

ArgoCD Architecture

Installation

Application CRD

AppProject

ApplicationSet

Sync Strategies

SSO Configuration

Health Checks

argocd CLI Commands

Best Practices

1. Use AppProjects

2. Enable Auto-Sync with Pruning

3. Use Sync Waves

4. Implement Health Checks

5. Use Sync Windows

6. Enable Notifications

7. Use ApplicationSets

Anti-Patterns

Approach

Resources

最新 Skills