Production GitOps with deliberate change control
ArgoCD delivery across Azure Government AKS: versioned chart inputs, deliberate production syncs, and checks that go beyond a green Synced status.
Kelmavory · Azure Government AKS · GitOps operationsThe Azure Kubernetes estate uses a platform hub to manage workload spokes through ArgoCD. Platform and application repositories keep chart versions and environment configuration reviewable. Production changes require an explicit decision to sync. The on-premises MKE estate has a different operating model: manual Helm upgrades, with its own change checks.
I operate the Azure ArgoCD delivery system, maintain multi-source Helm applications and repository structure, review Renovate version updates, and promote tested changes into production. I also investigate controller failures and document the difference between desired configuration, reconciliation state, and a working service.
Open each stage for the action and its supporting result. This is a conceptual sequence; internal topology and procedures are omitted.
Use multi-source Helm applications to combine upstream charts with a separate values repository. Review chart revisions and environment values in merge requests.
What was established
The chart and its configuration are both explicit, reviewable inputs to the deployment.
Render charts locally to check that intended values reach the generated manifests. Investigate cases where Helm accepts unknown keys and ArgoCD still reports Synced.
What was established
Caught ignored registry-mirror and monitoring-label settings; documented local rendering as a pre-merge check.
Keep production auto-sync disabled, inspect the ArgoCD or Kubernetes diff, validate development first, then perform the reviewed production sync. Apply the same sequence to monthly Renovate chart updates.
What was established
Production maintenance follows a repeatable review and promotion discipline rather than an unexamined version bump.
Investigate self-heal conflicts and a stalled Keycloak application after a node rebuild. Check the operator API watch and authentication separately from the application workload.
What was established
Resolved reconciliation conflicts and the stuck Progressing application without treating every symptom as a workload restart problem.
Make persistent fixes in Git; treat live patches in controller-managed resources as temporary and subject to reconciliation.
The tradeoffGit review adds a step during an incident, but makes the eventual fix reproducible.
Retain human diff review and development-first validation before applying production changes.
The tradeoffThe operator owns promotion timing and pending changes; ArgoCD still supplies desired-state visibility.
Use ArgoCD for the Azure clusters and manual Helm procedures for on-premises MKE.
The tradeoffTwo delivery models need distinct runbooks. A single blanket GitOps claim would obscure that boundary.
Maintained hub-and-spoke ArgoCD delivery with pinned chart and values inputs across the Azure Government AKS estate.
Resolved reconciliation conflicts and silent values misconfiguration through controller diagnosis and rendered-manifest checks.
Established a documented diff-review, development-first, and manual-production-sync discipline.
Synced tells you that ArgoCD applied its desired manifests. It does not tell you that every values key was recognized or that the service behaves as intended. Render, compare, and verify the runtime outcome.
Based on the owner-provided work account and ArgoCD clarification reviewed on 12 October 2026. This public account describes operating practices and reported outcomes; private repositories, configurations, service addresses, and incident artifacts are not reproduced.
This repository demonstrates related engineering skills. It contains personal project work, not employer code or a reproduction of the private environment.
GitOps Supply Chain