How a change reaches the cluster

The lab runs on GitOps. The repository is the source of truth, and Argo CD is the only thing that writes application state to the cluster. There is no kubectl apply step: a commit lands in the repository, and the cluster catches up to it.

flowchart LR
  commit["Commit to Git"] --> gh["GitHub repository"]
  gh --> argo["Argo CD"]
  argo --> cluster["Cluster state"]
  argo -. corrects drift .-> cluster
  ren["Renovate"] -. opens update PRs .-> gh

Argo CD reconciles to match Git

Argo CD watches the repository and compares it against what is actually running. When the two differ, it brings the cluster back in line with Git. That comparison runs continuously, so the answer to “what is deployed” is always “whatever is in the repo”.

Drift is corrected the same way. If something in the cluster is changed out of band, Argo CD spots the difference from Git and undoes it on the next sync.

ApplicationSets generate the apps

Apps are not registered with Argo CD one by one. An ApplicationSet watches the directory tree and turns every overlay it finds into an Argo CD Application, so committing a new app directory is enough for it to be picked up and synced. The mechanics of that layout are covered in Add a new application.

Renovate keeps dependencies moving

The versions in the repo are pinned: Helm chart versions, container image tags, OpenTofu providers, and more. Renovate watches those pins and opens pull requests to bump them when new releases appear, so the lab does not drift years behind on its dependencies.

A merged Renovate pull request is just another commit. Once it lands, it travels the same path as any other change: Argo CD sees the new version in Git and rolls it out. Reviewing and merging those updates in practice, including the Dependency Dashboard and the in-cluster runner, is its own how-to: Update applications.

Rolling back

Because the running state is whatever Git says, undoing a change is a git revert. Argo CD reconciles the cluster back to the previous commit the same way it applied the change in the first place. There is no separate rollback procedure, and no cluster snapshot to restore from.

For the wider picture, see the architecture overview.