Declarative, Git-centric deployments with Argo CD. Directory layout, sync policies, and security.

On this page

GitOps with Argo CD: Best Practices for 2025

Auditability: Every change is a commit with history and PR review.
Disaster recovery: Recreate state from Git.
Consistency: Same process for dev and prod.

GitOps keeps desired state in Git and uses a controller (e.g. Argo CD) to reconcile the cluster. Here’s how to do it well.

Why GitOps #

code

repo/
  apps/
    myapp/
      base/
      overlays/
        dev/
        staging/
        prod/

Use Kustomize or Helm; keep secrets out of Git (e.g. Sealed Secrets, SOPS, or external secret operators).

Sync policy: Prefer automated sync with self-heal and prune only where safe.
Sync waves: Order resources (e.g. CRDs then apps) so dependencies apply first.
RBAC: Limit who can approve prod; use ApplicationSets for multi-cluster.
Notifications: Slack/Teams on sync failures and drift.

Start with one app and one environment; add automation and more envs once the pattern is stable.