Documentation
In-depth docs pages:
| Page | What's in it |
|---|---|
| Cluster login | The clusters, their ArgoCD UIs, login commands, and kubeconfigs. |
| Secrets & encryption | Your personal age key, .sops.yaml, editing encrypted files, using secrets in manifests. |
| Storage | Persistent volumes (PVCs), storage classes, S3 buckets, and backups. |
| Resource quotas | Your namespace's CPU/memory/storage limits, checking usage, requesting more. |
| Cluster policies | Which resource kinds you can create, and the workload hardening every pod must comply with. |
| Network policies | Namespace isolation, what's reachable out of the box, and requesting exceptions. |
| Ingress & routing | Publishing your app: hostnames, allowed annotations, Middlewares, Gateway API. |
| Availability | Surviving node reboots and drains: replicas, spread, graceful stop, the safe PDB shape. |
| Logs | Where your pods' usage data and logs go (Grafana), how to search them, tips. |
How it works
You never deploy by hand. Instead:
you edit + push ArgoCD detects + syncs
your laptop ─────────────▶ your Git repo ─────────────▶ your namespace
(kubectl / git) (source of truth) (running app)
- You edit Kubernetes manifests in your repo and
git push. - ArgoCD notices the change and applies it into your namespace - and only your namespace.
- If you change something by hand in the cluster, ArgoCD restores it to match Git. Git always wins, so your repo is always an accurate picture of what's running.
Who manages what
The split follows one simple rule:
- You own everything inside your namespace that defines your app - commit it to your repo and ArgoCD syncs it. No tickets, no waiting.
- The platform owns the namespace boundary and everything cluster-wide - you request these by opening a ticket.
| Resource / concern | Who | Notes |
|---|---|---|
| Workloads - Deployment, StatefulSet, DaemonSet, ReplicaSet, Job, CronJob | You | The pods that run your app. |
| Service (ClusterIP) | You | In-cluster address for your pods. |
| Ingress, or Gateway + HTTPRoute | You | Public hostname + HTTPS. Consumes platform DNS, the TLS issuer, and the ingress controller. See Ingress & routing. |
| Middleware (Traefik) | You | Redirects, headers, basic auth, IP allow-lists, rate limits for your own routes. See Ingress & routing. |
| ConfigMap | You | Non-secret configuration. |
| Secret (SOPS-encrypted) | You | Encrypt with SOPS before committing - never commit plaintext. See Secrets & encryption. |
| PersistentVolumeClaim | You | Durable storage. See Storage. |
| ServiceAccount | You | The account is yours; its RBAC (Role/RoleBinding) is platform-managed. |
| HorizontalPodAutoscaler | You | Autoscale your workload. |
| PodDisruptionBudget | You | Protect availability during disruptions. |
| Namespace + resource quotas | Platform | Created when you're onboarded. See Resource quotas. |
| RBAC - Roles, RoleBindings, anything cluster-scoped | Platform | You can't create RBAC yourself, even namespace-scoped. See Cluster policies. |
| Deploy access (who may push to the cluster) | Platform | Tied to your access group. Add/remove people via ticket. |
| NetworkPolicies, cross-namespace or external-ingress exceptions | Platform | Namespaces are isolated and deny-by-default. See Network policies. |
| External / LoadBalancer IPs, custom L2 address pools | Platform | For traffic that bypasses the shared ingress. See Network policies. |
| DNS names, TLS issuers, ingress controller | Platform | You consume these from your Ingress; the platform operates them. |
| StorageClasses | Platform | Two are available - pick one in your PVC. See Storage. |
| Any cluster-scoped resource or platform add-on | Platform | Namespaces, CRDs, controllers, operators, etc. |