ArgoCD Cheat Sheet
GitOps continuous delivery for Kubernetes: Application CRD syntax, sync policies, App of Apps pattern, and CLI commands.
3 PagesIntermediateJan 26, 2026
Application Custom Resource
Declares what Git source syncs to which cluster/namespace, with automated sync policy.
yaml
apiVersion: argoproj.io/v1alpha1kind: Applicationmetadata: name: guestbook namespace: argocdspec: project: default source: repoURL: https://github.com/org/guestbook.git targetRevision: main path: k8s/overlays/production destination: server: https://kubernetes.default.svc namespace: guestbook syncPolicy: automated: prune: true # delete resources removed from Git selfHeal: true # revert manual cluster drift syncOptions: - CreateNamespace=true
ArgoCD CLI Essentials
Login and manage applications from the terminal.
bash
argocd login argocd.example.com --ssoargocd app listargocd app get guestbookargocd app sync guestbookargocd app sync guestbook --pruneargocd app diff guestbook # show drift vs Gitargocd app rollback guestbook 4 # roll back to history ID 4argocd app set guestbook --sync-policy automated
App of Apps Pattern
A root Application that manages a set of child Applications, giving one Git source of truth for the whole cluster.
yaml
apiVersion: argoproj.io/v1alpha1kind: Applicationmetadata: name: root-app namespace: argocdspec: project: default source: repoURL: https://github.com/org/gitops-config.git targetRevision: main path: apps # directory containing one YAML per child Application destination: server: https://kubernetes.default.svc namespace: argocd syncPolicy: automated: prune: true selfHeal: true
AppProject for Multi-Tenancy
Restrict which repos/clusters/resource kinds a team's Applications can use.
yaml
apiVersion: argoproj.io/v1alpha1kind: AppProjectmetadata: name: team-payments namespace: argocdspec: sourceRepos: - 'https://github.com/org/payments-*' destinations: - namespace: 'payments-*' server: https://kubernetes.default.svc clusterResourceWhitelist: - group: '' kind: Namespace
Core Concepts & Sync States
Terms you'll see constantly in the UI/CLI.
- Application- the CRD tying a Git source to a cluster destination
- Synced / OutOfSync- whether live cluster state matches the Git-declared state
- Healthy / Degraded / Progressing- health status computed from resource-specific health checks
- prune- delete live resources no longer present in Git during sync
- selfHeal- automatically re-sync when someone manually edits a resource (drift correction)
- ApplicationSet- generates many Applications from a template (e.g. one per cluster or per Git directory)
Sync Waves & Lifecycle Hooks
Order resource application within a sync and run one-off jobs before/after it using annotations.
yaml
apiVersion: batch/v1kind: Jobmetadata: name: db-migrate annotations: argocd.argoproj.io/hook: PreSync argocd.argoproj.io/hook-delete-policy: HookSucceeded argocd.argoproj.io/sync-wave: "-1" # runs before wave 0 resourcesspec: template: spec: restartPolicy: Never containers: - name: migrate image: myorg/migrator:latest command: ["./migrate", "up"]---apiVersion: apps/v1kind: Deploymentmetadata: name: api annotations: argocd.argoproj.io/sync-wave: "0" # deploys after the migration Job succeeds
ApplicationSet with a Git Generator
Auto-create one Application per directory in a repo, e.g. one per microservice or per environment.
yaml
apiVersion: argoproj.io/v1alpha1kind: ApplicationSetmetadata: name: services namespace: argocdspec: generators: - git: repoURL: https://github.com/org/gitops-config.git revision: main directories: - path: services/* template: metadata: name: '{{path.basename}}' spec: project: default source: repoURL: https://github.com/org/gitops-config.git targetRevision: main path: '{{path}}' destination: server: https://kubernetes.default.svc namespace: '{{path.basename}}' syncPolicy: automated: { prune: true, selfHeal: true }
Custom Resource Health Check (Lua)
Teach ArgoCD how to compute Healthy/Degraded for a CRD it doesn't understand natively.
yaml
# argocd-cm ConfigMapdata: resource.customizations.health.certmanager.io_Certificate: | hs = {} if obj.status ~= nil and obj.status.conditions ~= nil then for i, condition in ipairs(obj.status.conditions) do if condition.type == "Ready" and condition.status == "True" then hs.status = "Healthy" hs.message = "Certificate is ready" return hs end end end hs.status = "Progressing" hs.message = "Waiting for certificate issuance" return hs
RBAC & Access Control Terms
Vocabulary for locking down who can sync/delete what.
- policy.csv- the argocd-rbac-cm ConfigMap entry mapping subjects to actions/resources, e.g. 'p, role:readonly, applications, get, */*, allow'
- role:admin / role:readonly- built-in default roles; custom roles are composed the same way with 'g, <group>, role:<name>' bindings
- AppProject roles- project-scoped RBAC roles that only grant permissions within that AppProject's Applications
- resource.exclusions- argocd-cm setting to hide noisy cluster-scoped resources (e.g. Endpoints) from diffing entirely
- orphaned resources- resources in the target namespace not managed by any tracked Application; can be surfaced per-AppProject
Notifications Controller: Slack on Sync Failure
Wire a trigger/template pair so the team gets alerted the moment a sync degrades.
yaml
# argocd-notifications-cm ConfigMapdata: service.slack: | token: $slack-token template.app-sync-failed: | message: | Application {{.app.metadata.name}} sync failed: {{.app.status.operationState.message}} trigger.on-sync-failed: | - when: app.status.operationState.phase in ['Error', 'Failed'] send: [app-sync-failed]---# on the Application itselfmetadata: annotations: notifications.argoproj.io/subscribe.on-sync-failed.slack: platform-alerts
Pro Tip
Turn on `selfHeal` only after you trust your Git source completely — in early adoption it's safer to run automated sync with `selfHeal: false` first so a bad manual hotfix doesn't get silently reverted mid-incident before the team has adjusted its habits.
Was this cheat sheet helpful?
Explore Topics
#ArgoCD#ArgoCDCheatSheet#DevOps#Intermediate#ApplicationCustomResource#ArgoCDCLIEssentials#AppOfAppsPattern#AppProjectForMultiTenancy#Kubernetes#CommandLine#CheatSheet#SkillVeris
