Argo CD fundamentals: CAPA practice questions

Argo CD is a declarative GitOps delivery tool for Kubernetes. The desired state of each application lives in Git, and Argo CD compares it with the cluster and can bring the cluster in line. Its documentation defines a small vocabulary that the rest of the project uses. The target state is what the files in Git describe; the live state is what is actually deployed. Sync status says whether the two match. A sync is the process of moving the application to its target state, and the sync operation status says whether that process succeeded. A refresh compares the latest Git content with the live state. Health is a separate judgement of whether the application is running correctly.

Three components do the core work. The API server is a gRPC and REST service used by the web UI, the argocd CLI and automation: it manages applications, triggers operations such as sync and rollback, stores repository and cluster credentials, authenticates users, enforces RBAC and receives Git webhooks. The repository server keeps a local cache of Git repositories and generates manifests for a given repository, revision and path, running Helm or Kustomize when needed. The application controller continuously compares live and target state, flags differences as OutOfSync, can correct them and runs sync hooks. The installation also runs argocd-redis, a disposable cache, and argocd-dex-server for single sign-on, and the ApplicationSet controller has been bundled since Argo CD 2.3.

Configuration is stored in Kubernetes. General settings sit in the argocd-cm ConfigMap, RBAC policy in argocd-rbac-cm, and sensitive settings in argocd-secret. Repositories and clusters can be registered declaratively as Secrets labelled with argocd.argoproj.io/secret-type. The installing namespace, argocd by default, also holds Applications and AppProjects unless applications in other namespaces have been enabled.

Argo CD checks Git for changes every three minutes by default, a 120-second interval plus up to 60 seconds of jitter, and a webhook from GitHub, GitLab, Bitbucket and similar providers can make it refresh at once. The initial admin password is generated at install time and can be printed with argocd admin initial-password. RBAC policies use the p and g lines of a Casbin policy, and the built-in roles are role:readonly and role:admin.