> ## Documentation Index
> Fetch the complete documentation index at: https://docs.changeguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# ArgoCD Integration

> Score and gate ArgoCD deploys fleet-wide

## Gate Every Sync

Add a [PreSync hook](/gate-your-pipeline#argocd-presync-hook) and every ArgoCD sync checks the cluster's CSC score before it applies — a sync into a degraded cluster fails instead of becoming an incident.

## What the score catches for ArgoCD operators

* **Controller trouble before the outage** — an ArgoCD controller trending toward its memory limit degrades the runtime score while apps are still healthy, not after the OOMKill takes them all to `Unknown`.
* **Upgrades with history** — the score's history dimension remembers how the last controller upgrade went on this cluster.
* **Fleet-wide blast radius** — the same bad image or sync failure appearing across clusters is correlated automatically.

## Auto-Discovery

When ArgoCD discovery is enabled (`gitops.argoCD.enabled`), the in-cluster agent reads ArgoCD `Application` resources directly from the Kubernetes API and pushes them to ChangeGuard. No ArgoCD API token, admin secret, or server URL is required — and because the read happens inside the cluster, it works even when the ChangeGuard control plane has no network path to your ArgoCD server.

The agent:

1. Reads `Application` custom resources across all namespaces over the Kubernetes API
2. Pushes each application's name, health, sync status, and drift count to the backend
3. Re-reads on a short interval so the fleet view stays current

Discovered applications are persisted server-side, so the fleet view survives backend restarts and stays consistent across replicas.

## ArgoCD Fleet View

The dashboard shows all ArgoCD instances across all your clusters:

* **Application health** — Healthy, Degraded, Progressing, Missing
* **Sync status** — Synced, OutOfSync
* **Drift detection** — tracks configuration drift count
* **Controller health** — ArgoCD controller component status per instance

## Cross-Cluster Correlation

ChangeGuard correlates ArgoCD data across clusters to detect fleet-wide issues:

* Same image failing across multiple clusters
* Sync failures spreading across the fleet
* Degraded applications correlated with recent deployments

## No tokens to manage

Because discovery reads `Application` resources directly, there is no ArgoCD token or admin secret to create, store, or rotate. If applications don't appear, confirm that `gitops.argoCD.enabled` is set and that the collector's ClusterRole can read `argoproj.io` resources — the Helm chart grants this by default.