← Back to recent posts
GitOps

GitOps on AWS: Argo CD and EKS Best Practices

GitOps on EKS means the cluster is not the source of truth. Git is. Argo CD watches a repo, Helm values differ per environment, and a laptop kubectl apply in prod is an incident.

Bootstrap once, then never snowflake it

Install Argo CD with Terraform or a documented Helm chart pinned by digest. SSO can wait a week. An Argo that only you can log into with admin/admin cannot.

App of Apps

One root Application per environment (dev, qa, prod). That root points at a folder of child apps. Promoting qa to prod is a Git change to the prod overlay, not a “sync prod” button that someone clicks after standup.

# Helm values should only change what must change
# prod/values.yaml
replicaCount: 3
ingress:
  host: api.example.com
image:
  tag: "sha-a1b2c3d"  # digest or immutable tag, never :latest

What you refuse

  • Argo auto-sync to prod with no PR.
  • A values file that copies the entire chart defaults “just in case.”
  • Cluster-admin bound to the whole engineering Google/Okta group.

The matching lab is on the AWS projects page: GitOps on EKS with Argo CD and Helm (/projects/aws#gitops-eks-argocd).