ArgoCD.

Where ArgoCD fits on a long engagement.

The pull model changes the security posture as much as the workflow. Nothing outside the cluster needs deployment credentials, because the controller inside pulls from Git rather than a pipeline pushing in. On estates where CI holding cluster admin was the standing risk, that alone justifies the change.

Continuous reconciliation makes the repository genuinely authoritative. A resource edited by hand is reverted rather than merely flagged, which means "what is running" and "what is in Git" stop being two different questions — provided nobody creates escape hatches for urgent changes, which is where the discipline usually breaks.

What an assigned team does with ArgoCD.

GitOps changes who can deploy and how, which is an organisational change rather than a tooling one. Teams used to pushing from a pipeline need the emergency path defined explicitly, or they will invent one that bypasses the model entirely.

Defining that path, and the review standards around it, is part of how delivery is agreed under devops managed services.

What we use ArgoCD for.

• No deployment credentials outside the cluster A pull model, so CI compromise does not mean cluster compromise.
• Manual changes reverted automatically Reconciliation that keeps the repository authoritative rather than aspirational.
• An emergency path that is designed A defined break-glass procedure, so urgency does not produce an undocumented bypass.

How ArgoCD capacity is assigned.

GitOps delivery is agreed with the emergency path defined at the same time as the happy path, as part of how the monthly fee is built.