GitOps the Hard Way, with Argo CD

Build Real GitOps Pipelines From Empty Clusters to Automated Deploys

Most Argo CD tutorials hand you a cluster someone else built, a sample app, one argocd app sync, and a green checkmark. Then you try it at work and the checkmark turns out to have taught you nothing. You do not know why the repo-server rendered that manifest, what a sync wave orders, how an RBAC rule locks a teammate out of the wrong project, or what happens to your running pods when you delete an Application.

This book takes the other route. You start from empty servers and finish with an automated GitOps pipeline you built yourself, end to end. You provision the infrastructure, bootstrap the cluster, install Argo CD from raw manifests, register the repository, and watch the first sync fire because you wired it. Nothing is pre-baked, you'll run every command, apply every manifest, and read every error, because the friction is exactly where the learning lives.

The "hard way" is not difficulty for its own sake. It is doing the work yourself instead of letting a script or a one-click installer hide it, so the knowledge holds up on a cluster you have never seen before. It is the long path that turns out to be the short one, because you never have to come back and learn what the shortcut skipped.

What you will build

You begin with bare servers and end with a pipeline that deploys on every Git push. Along the way you will:

• Provision real infrastructure with Terraform, bootstrap a Kubernetes cluster, and deploy an application onto it, so Argo CD has something real to manage.
• Trace a change from a Git commit through Argo CD's reconciliation loop to a running resource, and learn what each component does and what breaks when it fails.
• Install Argo CD, choose deliberately between the full, core, and custom installs, log in from the CLI, and add more clusters.
• Create your first Application from the argocd CLI, then redefine the same setup as declarative manifests you keep in Git.
• Configure sync policy on purpose: automated sync, self-healing, pruning, retries and backoff, ignoreDifferences, namespace creation, and the sync options that change how resources get applied.
• Run your own code around a sync with resource hooks and sync phases, and order resources with sync waves.
• Understand the best practices of using hooks and more importantly, when to use them and the bad practices of using hooks.
• Create a local user and scope one teammate to exactly one project with RBAC, then verify the grant actually resolved.
• Package your application as a Helm chart and have Argo CD manage it as a versioned release.
• Generate many Applications from one definition with ApplicationSets.
• Build a multi-branch pipeline that gives every Git branch its own live environment.

Who this is for

Engineers who already know Kubernetes and Git and now want to run Argo CD for real, not click through a demo. Platform and DevOps engineers running it as a service, SREs who care what happens when state drifts, developers shipping through a platform, security engineers fencing what deploys where, consultants standing up GitOps for clients, and anyone who inherited an Argo CD install and needs the black box to open.

This book assumes you can read a Deployment, run kubectl, and open a pull request without looking it up. If you are still learning what a Pod is, start there first and come back.

The Approach of This Book

This book teaches by building. You do not read about Argo CD reconciling a cluster, you stand up the cluster, install Argo CD, commit a change, and watch it reconcile. Every chapter ends with something running that did not exist when the chapter started, and each one builds on the cluster and the Applications you set up in the chapter before it. Read it in order, run every command, and by the last page you have a full pipeline you assembled yourself, not a folder of notes about one you read about.

The work happens in your terminal, on real infrastructure. You provision the servers, bootstrap the cluster, and install Argo CD from manifests you can read, so nothing in your setup is a black box you have to trust. When a command fails, you read the error and fix it, because that is where the understanding comes from. The friction is not in the way of the lesson, it is the lesson.

Every concept is anchored to something you do, run, or decide. Theory shows up only when it changes a choice in front of you: the reconciliation loop appears next to the sync command it explains, the component split appears next to the failure it causes when one part is unhealthy.

Versions are pinned and called out, because Argo CD changes behavior between releases. A field gets deprecated, a flag gets renamed, a default flips, and prose written against an old version quietly stops being true. When you run these steps against a newer release and something differs, check it against the version you actually installed rather than trusting the page.

Every code listing, full-color diagram, and screenshot lives in the companion kit. Copy and run from there, not from your reader, where wrapped lines and smart quotes break the moment you paste them into a terminal.