Learn GitOps with ArgoCD - Production Deployment Checklist

#Introduction

In episode 33 costs were under control. Now the final question before this series' journey ends: are we production-ready? Many teams deploy ArgoCD to production without a checklist, then discover the gaps in the middle of an incident — when RBAC isn't set up, the backup hasn't been tested, or monitoring isn't installed. This episode is a complete checklist that condenses the whole series into one document you can print and follow.

Consider this a pre-flight checklist: not a list of "nice to haves", but the minimum conditions for ArgoCD to be worthy of being the delivery backbone of your organization.

#Pre-Production Checklist

#HA Validation

• HA configuration installed and running: replicas > 1, Redis with Sentinel or cluster, controller using leader election (episode 26).
• Failure tests done: kill random pods, kill the leader, verify recovery within SLO.

#RBAC Configured

• SSO/OIDC authentication connected (episode 23) — the default admin isn't used.
• ArgoCD RBAC mapped to real roles: admin, developer, viewer (episode 10).
• Projects locked down: each team gets its own project with allowed sources, destinations, and resources (episode 28).

#Tested Backup

• ArgoCD backup (configuration, repo credentials, secrets) runs on a schedule (episode 21).
• Important: restore has been tested — a backup without a tested restore isn't a backup.

#Monitoring and Alerting

• ArgoCD metrics in Prometheus, Grafana dashboard installed (episode 22).
• Alerts for: sync failure, prolonged out-of-sync, degraded, components down.

#Complete Documentation

• Runbooks, architecture diagrams, onboarding, and troubleshooting guides in the repo (episode 32).
• Who's on-call, and how to reach them, is documented.

#Documented DR

• DR procedures written and tested (episodes 21, 31). RTO and RPO recorded.

#Security Audit

• No secrets in Git; everything uses encrypted mechanisms (episode 12).
• Credentials rotated; images verified; policy engine active (episode 30).

#Performance Baseline

• Baseline recorded: reconcile duration, controller memory, API latency (episode 25). Without a baseline, you can't detect degradation.

#Operational Best Practices

#Regular Backup Validation

Schedule a monthly (or quarterly) restore test. DR drills should become a habit, not a panicky annual project.

#Capacity Planning

Monitor growth: how many applications, how many reconciles per minute, how much controller memory. When metrics approach limits (episode 25), add resources or shard before it becomes an incident — not after.

#Patch Management and Upgrades

Upgrading ArgoCD follows the same path as any other application: a PR to the manifest repo, staging first, prod after staging is healthy. Watch the changelog for behavior-changing upgrades (e.g. new RBAC or CRDs).

#Incident Response and On-Call Runbook

An incident runbook must be followable by someone who joined a week ago: symptom → steps → escalation. Practice with regular game days. MTTR improves dramatically when runbooks are tested.

#Common Pitfalls

#Day 2 Operations

Production doesn't end when ArgoCD is alive. Day-2 operations are a rhythm that must be maintained:

• Application lifecycle — application onboarding and offboarding follow a standard process, not improvisation.
• Certificate rotation — certificates (ArgoCD TLS, Dex, registries) have scheduled rotation, automated (e.g. cert-manager).
• Secret rotation — credentials rotated on schedule; test that rotation doesn't break sync (episode 12).
• Access review — periodic audit of who has what access; remove unused access.
• Compliance audits — collect evidence from Git history and ArgoCD logs (episode 24) as required by regulators. Start an audit with argocd app list: make sure every application is recorded and owned by a clear team.
• Performance tuning — compare metrics against the baseline; tune when they drift (episode 25).
• Capacity planning — continue from above; make it monthly, not seasonal.

argocd app list
argocd account list
kubectl get certs -n argocd
kubectl get secret -n argocd argocd-secret -o jsonpath='{.data.argocd\.yaml}'

#Closing

This episode is the complete checklist: the pre-production checklist (HA, RBAC, tested backup, monitoring, documentation, DR, security audit, performance baseline), operational practices (backup validation, capacity planning, patching, incident response, on-call runbooks), the common pitfalls that most often take teams down, and the day-2 operations rhythm (lifecycle, certificate and secret rotation, access review, compliance audit, tuning).

The points you should take with you:

• The pre-production checklist is run as a PR, not a document you nod along to.
• A backup without a tested restore isn't a backup.
• The most common pitfalls are RBAC, monitoring, DR, and secrets not handled from the start.
• Day-2 operations are a scheduled rhythm, not a reaction to incidents.

With this checklist, you've prepared a production system worth running. One episode remains to close the series. In the next episode 35 we discuss the future of GitOps & ArgoCD — the five-level GitOps maturity model, emerging trends, the ArgoCD roadmap, platform engineering, and a recap of the series' best practices. See you in episode 35!