🤖 Learn ArgoCD the school way — with & without GitOps

The sister course to Learn Kubernetes School: that one teaches what runs your app — this one teaches what deploys it and keeps it honest. You deploy the same demo app three ways — by hand, with a CI/CD push pipeline, and with ArgoCD — and feel exactly why each step up exists.

🎒 by hand📮 CI/CD push 📖 GitOps🤖 ArgoCD pull 🪑↩️ self-heal⏪ git-revert rollbacks

🚪 Part 1 — WITHOUT ArgoCD

  • deploy by hand — and forget what you deployed
  • meet configuration drift, the silent killer
  • automate with a push pipeline (courier robot 📮)
  • …and discover what push still can't fix

📖 Part 2 — WITH ArgoCD

  • git becomes the single source of truth
  • the caretaker robot 🤖 lives inside the cluster
  • drift gets reverted; deploys = commits
  • rollback = git revert · audit = git log

🗺️ The big picture — one diagram, both worlds

The whole course on one canvas: the PUSH world (red, lessons 1–4) with its four gaps, and the PULL world (green, lessons 5–12) with its six wins. Click it for the 4K version — great as a wallpaper-sized reference.

The big picture: deploying without ArgoCD (push model, with its gaps) vs with ArgoCD (GitOps pull model, with its wins)

🚪 Part 1 — WITHOUT ArgoCD (lessons 1–4)

Feel the pain first: hand deploys, invisible drift, then a courier robot (CI/CD push) — and the four gaps it can never close. One git branch = one idea; branch 07 contains lessons 01–07.

1

🎒 Deploy by hand

Carrying homework to school yourself — fine once, awful daily.lesson-01-deploy-by-handRead lesson →See the diagram ↗
2

🪑 The drift problem

No master seating chart — nobody knows how the room should look.lesson-02-drift-problemRead lesson →See the diagram ↗
3

📮 CI/CD push pipeline

The courier robot — tests, builds, delivers with a master key.lesson-03-cicd-pushRead lesson →See the diagram ↗
4

🚪 Limits of push

The courier delivers… and leaves. Nobody watches the room after.lesson-04-limits-of-pushRead lesson →See the diagram ↗

📖 Part 2 — WITH ArgoCD (lessons 5–12)

The cure: git becomes the master plan book, and ArgoCD — the caretaker robot living INSIDE the cluster — keeps reality matching it, forever.

5

📖 The GitOps idea

The master plan book — reality must match the book, always.lesson-05-gitops-ideaRead lesson →See the diagram ↗
6

🤖 Install ArgoCD

Hiring the caretaker robot — it moves into the school itself.lesson-06-install-argocdRead lesson →See the diagram ↗
7

📄 First Application

One page of the plan book: which repo, which folder, which room.lesson-07-first-applicationRead lesson →See the diagram ↗
8

📏 Sync policies

House rules for the robot — ask first, or act on its own?lesson-08-sync-policiesRead lesson →See the diagram ↗
9

🪑↩️ Self-heal & drift

A kid moves the chairs; the robot puts them back. Live demo.lesson-09-self-heal-driftRead lesson →See the diagram ↗
10

⏪ Rollback & history

Flip the book to yesterday's page — git revert IS the rollback.lesson-10-rollback-historyRead lesson →See the diagram ↗
11

📚 Helm, Kustomize & envs

Fill-in-the-blank recipe books — one recipe, many classrooms.lesson-11-helm-kustomize-envsRead lesson →See the diagram ↗
12

🔑 Secrets + the scorecard

Never glue the locker key into the book — and the final verdict.lesson-12-secrets-and-compareRead lesson →See the diagram ↗
# take the course locally (any local cluster — Docker Desktop, minikube, kind):
git clone https://github.com/BaluRaut/learn-argocd-school.git
cd learn-argocd-school
git checkout lesson-01-deploy-by-hand   # then open lessons/01-deploy-by-hand/README.md
🎓 The school series: 0️⃣ AWS foundations (IAM & EC2) → 1️⃣ Learn Docker School packs & ships the images → 2️⃣ Learn Kubernetes School runs them (do its lessons 01–11 before this course) → 3️⃣ this course deploys them automatically, forever.

📐 The lesson diagrams — follow the numbers

Every lesson as one numbered box-and-arrow diagram, one after another — readable right here (red = without ArgoCD, green = with). Also on a standalone page with jump navigation.

1 🎒 Deploy by hand — you ARE the deploy system

kubectl apply from your laptop works… and quietly makes you the single point of failure.

🧑‍💻 Your laptop YAML files + kubeconfig 🔑 🏫 Cluster 🪑🪑 hello-school pods 1 kubectl apply -f k8s/ 2 works! 🎉 …today 📅 one week later ❓ which version is live? ❓ who changed it? ❓ teammate deploys too? 😱 only your memory knows 3

Read full lesson 01 →

2 🪑 Drift — when reality stops matching the files

Every hand-edit that never lands back in git widens a silent, dangerous gap.

📄 YAML in git says replicas: 2 image: v1 memory limit: 64Mi 🏫 Cluster actually runs replicas: 5 (Friday panic) image: v2-hotfix-final-REAL limit: 512Mi (kubectl edit) ≠ 1 hotfix by hand, "just this once" 2 …and nobody writes it back to git 3 the gap = DRIFT: next "clean" deploy from git silently undoes the hotfix 💥

Read full lesson 02 →

3 📮 CI/CD push — the courier robot deploys for you

Every push is tested, built and delivered — the human is out of the loop (mostly).

🧑‍💻 dev git push 📮 CI/CD — the courier robot ✅ test 🍱 build 🗄️ registry holds the cluster's master key 🔑 🏫 Cluster kubectl apply, from outside 1 2 same steps every time — no "oops, forgot the tests" 3 PUSH deploy

Read full lesson 03 →

4 🚪 Limits of push — the courier delivers and LEAVES

A push pipeline deploys moments; nobody guards the state in between.

📮 pipeline run deploys at 14:03… then exits 🏫 Cluster at 14:04+ unguarded until next push 1 🪑 drift creeps back in — who would even notice? 2 🔑 cluster keys live OUTSIDE, in the CI system 3 🏫🏫🏫 10 clusters = 10 keys + 10 pipeline configs 4 the fix isn't a better courier — it's a guard who LIVES in the school → Part 2

Read full lesson 04 →

5 📖 The GitOps idea — reality must match the book

Declare the desired state in git; an agent inside the cluster converges reality toward it, forever.

📖 git repo DESIRED state — the book k8s/ manifests, reviewed PRs 🏫 cluster ACTUAL state — the rooms pods, services, configs 🔄 agent compare → converge 1 reads the book 2 looks at the rooms 3 fixes any difference 4 repeat every ~3 minutes, forever — same reconcile loop as lesson 03 of the k8s course, one level up

Read full lesson 05 →

6 🤖 Install ArgoCD — the robot moves into the school

One kubectl apply installs the whole robot; the UI is your window into its head.

🧑‍💻 you one kubectl apply 🏫 your cluster 🚪 namespace: argocd — the robot's room 🖥️ api-server + the web UI 📖 repo-server clones git repos 🔄 app-controller the reconcile loop 1 install manifest 2 port-forward the UI → https://localhost:8080 · login admin + initial secret · 3: the robot waits for its first plan page

Read full lesson 06 →

7 📄 The first Application — one page of the plan book

An Application says: THIS repo, THIS folder, THIS destination. The robot does the rest.

📄 Application repoURL: learn-argocd-school path: k8s/ destination: gitops-school syncPolicy: automated 🤖 ArgoCD clones the repo, renders the manifests 📖 git: k8s/ folder deployment + service + ns 🚪 gitops-school 🪑🪑 hello-school pods live! 1 kubectl apply -f argocd/ 2 3 creates everything from now on you never kubectl-apply the app again — you edit the repo instead

Read full lesson 07 →

8 📏 Sync policies — how strictly the robot follows the book

Manual = it asks first. Automated = it acts. Prune and selfHeal turn the strictness up.

📖 change lands in git app becomes OutOfSync 🟡 ✋ manual sync robot ASKS — you click Sync ⚡ automated sync robot ACTS on its own 1 2 🗑️ prune: true deleted in git → deleted live ↩️ selfHeal: true hand-edits get reverted 3 4 start manual while learning → automated + prune + selfHeal in production (the strict-but-fair caretaker)

Read full lesson 08 →

9 🪑↩️ Self-heal — the chairs go back where the book says

Hand-made drift survives seconds, not months. Change the book, not the room.

😈 you, by hand kubectl scale --replicas=5 🏫 cluster: 5 pods but the book 📖 says 2! status: OutOfSync + drift 🤖 ArgoCD self-heal re-applies the book → back to 2 pods ✅ 1 2 noticed in seconds 3 the book wins — every time 4 want 5 replicas for real? edit the BOOK: change git, PR, merge → robot scales up happily

Read full lesson 09 →

10 ⏪ Rollback — flip the book to yesterday's page

In GitOps, git history IS deploy history — so undoing a commit undoes the deploy.

commit A image: v1 ✅ commit B image: v2 💥 bad! commit C = revert B image: v1 again ✅ 1 bad version ships (via git, at least!) 2 git revert — 10 seconds 🤖 ArgoCD syncs C cluster back on v1 3 🧾 git log = deploy log: who, what, when — audit free 4

Read full lesson 10 →

11 📚 Helm, Kustomize & environments — one recipe, many classrooms

Templates + per-environment values; one Application per room, and a master page listing them all.

📚 one recipe Helm chart / Kustomize base replicas: ___ image: ___ 📝 values-dev.yaml replicas: 1 📝 values-staging.yaml replicas: 2 📝 values-prod.yaml replicas: 5 + HPA 1 🚪 dev room 🚪 staging room 🚪 prod room 2 one Application each 📖 app of apps 3 one page lists all the pages

Read full lesson 11 →

12 🔑 Secrets in GitOps + the final scorecard

Everything lives in git… except plaintext secrets. Encrypt them in, or reference them out.

❌ password in the book plaintext secret in git = leaked 1 🔐 Sealed Secrets: encrypted IN git, only the cluster can decrypt 2 🗝️ External Secrets: git holds only a POINTER to a vault / AWS SM 3 🏁 the scorecard 📮 push 🤖 pull drift watched?❌ between deploys✅ every ~3 min cluster keys❌ outside, in CI✅ stay inside deploy log⚠️ CI history✅ git log itself rollback⚠️ re-run pipeline✅ git revert many clusters❌ keys × N✅ one agent each CI still needed?yes: tests + builds✅ Argo deploys 4 real teams use BOTH: the courier builds, the caretaker deploys

Read full lesson 12 →

Start Lesson 01 → 📐 All 12 lesson diagrams 🧪 Quiz 🗓️ Study plan ⏮️ Before & trade-offs ☸️ The Kubernetes course