GitOps with ArgoCD — first login to first app

GitOps flips deployment around: instead of pushing changes to the cluster, you describe the desired state in Git and a controller continuously reconciles the cluster to match. On OpenShift that controller is ArgoCD, shipped as the OpenShift GitOps operator.

Watch on YouTube ↗

Install and find your way in

1. Install the Red Hat OpenShift GitOps operator from OperatorHub. It creates an openshift-gitops namespace with a ready-to-use ArgoCD instance.

2. Get the console URL from the route:

   oc get route openshift-gitops-server -n openshift-gitops \
     -o jsonpath='{.spec.host}'

3. Get the initial admin password (stored in a secret):

   oc get secret openshift-gitops-cluster -n openshift-gitops \
     -o jsonpath='{.data.admin\.password}' | base64 -d

Tip

You can also log in with your OpenShift credentials via the “Log in via OpenShift” button — the operator wires up SSO by default, so the admin account is really just a fallback.

Your first Application

An ArgoCD Application says: take source X from Git, and keep destination Y in sync with it. Here’s one pointing at a Helm chart in a repo:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: demo
  namespace: openshift-gitops
spec:
  project: default
  source:
    repoURL: https://github.com/your-org/your-charts.git
    targetRevision: main
    path: charts/demo
    helm:
      valueFiles:
        - values.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: demo
  syncPolicy:
    automated:
      prune: true          # delete resources removed from Git
      selfHeal: true       # revert manual drift back to Git
    syncOptions:
      - CreateNamespace=true

Apply it, and ArgoCD renders the chart and creates the resources:

oc apply -f demo-application.yaml
oc get application demo -n openshift-gitops

The two settings that define GitOps

The syncPolicy block is where the philosophy lives:

• selfHeal: true — if someone edits a live resource by hand, ArgoCD reverts it to match Git. Git becomes the single source of truth, not a suggestion.
• prune: true — delete something from Git and ArgoCD deletes it from the cluster. Without prune, removals in Git leave orphans behind.

Caution

selfHeal plus a restricted-v2 SCC surprise is a common early snag: if your chart deploys but pods won’t start, ArgoCD will happily report “Synced” while the pods CrashLoopBackOff — because ArgoCD’s job is resource reconciliation, not pod health interpretation. When “Synced but not working,” go check the pod’s SCC annotation, per the troubleshooting guide.

Next: pointing ArgoCD at a private Helm repository, which is where real enterprise setups spend their debugging time.