Skip to main content

​
Gate Every Sync

Add a PreSync hook and every ArgoCD sync checks the cluster’s CSC score before it applies — a sync into a degraded cluster fails instead of becoming an incident.

​
What the score catches for ArgoCD operators

  • Controller trouble before the outage — an ArgoCD controller trending toward its memory limit degrades the runtime score while apps are still healthy, not after the OOMKill takes them all to Unknown.
  • Upgrades with history — the score’s history dimension remembers how the last controller upgrade went on this cluster.
  • Fleet-wide blast radius — the same bad image or sync failure appearing across clusters is correlated automatically.

​
Auto-Discovery

When ArgoCD discovery is enabled (gitops.argoCD.enabled), the in-cluster agent reads ArgoCD Application resources directly from the Kubernetes API and pushes them to ChangeGuard. No ArgoCD API token, admin secret, or server URL is required — and because the read happens inside the cluster, it works even when the ChangeGuard control plane has no network path to your ArgoCD server. The agent:
  1. Reads Application custom resources across all namespaces over the Kubernetes API
  2. Pushes each application’s name, health, sync status, and drift count to the backend
  3. Re-reads on a short interval so the fleet view stays current
Discovered applications are persisted server-side, so the fleet view survives backend restarts and stays consistent across replicas.

​
ArgoCD Fleet View

The dashboard shows all ArgoCD instances across all your clusters:
  • Application health — Healthy, Degraded, Progressing, Missing
  • Sync status — Synced, OutOfSync
  • Drift detection — tracks configuration drift count
  • Controller health — ArgoCD controller component status per instance

​
Cross-Cluster Correlation

ChangeGuard correlates ArgoCD data across clusters to detect fleet-wide issues:
  • Same image failing across multiple clusters
  • Sync failures spreading across the fleet
  • Degraded applications correlated with recent deployments

​
No tokens to manage

Because discovery reads Application resources directly, there is no ArgoCD token or admin secret to create, store, or rotate. If applications don’t appear, confirm that gitops.argoCD.enabled is set and that the collector’s ClusterRole can read argoproj.io resources — the Helm chart grants this by default.