Argo CD Applications

Application, Service, and Pod

The cards shown in Argo CD are Application resources, not necessarily one running service or process. An Application describes a set of desired Kubernetes resources from Git and continuously compares that desired state with the cluster.

For example, sens-platform-test owns the API, web console, documentation, database, migration Jobs, Services, Ingresses, and persistent storage for the complete test environment. The separate Applications around it install shared controllers or keep security permissions isolated.

The active layout also contains OpenBao, the value-free secret catalog, and namespace-scoped ESO instances for Argo CD and monitoring:

sens-platform-root
├── operations
│   ├── openbao
│   ├── sens-platform-secret-catalog
│   ├── external-secrets-argocd
│   ├── external-secrets-monitoring
│   └── external-secrets-crds
├── test
│   ├── sens-platform-test
│   ├── external-secrets-test
│   ├── reloader-test
│   └── sens-platform-test-secrets
└── production
    ├── sens-platform-production
    ├── external-secrets-production
    ├── reloader-production
    └── sens-platform-production-secrets

This separation is deliberate. It keeps cluster-wide definitions, operational infrastructure, test permissions, and production permissions from being owned by one broadly privileged Application.

Operations Applications

sens-platform-root

The root Application is the app-of-apps entry point. It reads the managed cluster directory from the infrastructure repository and creates or updates:

• child Applications;
• Argo CD Projects and their environment boundaries;
• platform namespaces;
• narrowly scoped access and authentication bindings.

It is automated and self-healing. A root sync updates the definitions of the production Applications but does not bypass their manual sync policy. Deleting the root Application is not a dashboard cleanup operation; it can orphan or cascade into the complete managed GitOps hierarchy.

openbao

This Application operates the self-hosted secret-management control plane in the openbao namespace. It owns:

• the OpenBao UI/API and integrated Raft storage;
• retained data and audit volumes;
• ingress, internal/public TLS, metrics, probes, and NetworkPolicies;
• the pinned snapshot agent.

Application workloads do not read values directly from this Pod. External Secrets Operator copies values into namespace-local Kubernetes Secrets. If OpenBao is briefly unavailable, existing Pods continue using their last synchronized values, but new secret synchronization pauses.

external-secrets-crds

This Application installs the cluster-wide External Secrets custom resource definitions once. CRDs teach Kubernetes the resource types SecretStore and ExternalSecret; this Application does not run the test or production controller Pods.

Keeping CRDs separate allows the two namespace-scoped controller Applications to run without cluster-wide installation permissions.

Test Applications

All test Applications are automated and self-healing.

sens-platform-test

This is the complete test release of the SENS Platform in sens-test. It owns:

• platform-api, web-console, and documentation Deployments;
• TimescaleDB;
• database migration Jobs;
• Services, Ingresses, certificates, configuration, and persistent volumes.

The release workflow updates this Application to immutable product revisions and image tags. Argo CD applies database migrations before rolling out the application Deployments. A failed migration prevents the later rollout.

external-secrets-test

This Application runs one External Secrets Operator controller restricted to the sens-test namespace. It authenticates to OpenBao as external-secrets-test through Kubernetes Auth and may reconcile only the test secret resources assigned to its controller class.

It is separate from the production controller so a compromised or misconfigured test controller cannot read or update production Kubernetes Secrets.

reloader-test

This Application runs the test-only Reloader controller. External Secrets Operator updates Kubernetes Secrets, but Kubernetes does not automatically restart Pods whose envFrom source changed. Reloader watches the explicitly referenced Secret names and rolls only the affected test Deployment.

Reloader does not copy or store the authoritative value and does not restart completed database migration Jobs.

sens-platform-test-secrets

This Application contains the GitOps contract between OpenBao and test:

• the internal CA reference and Kubernetes Auth audience;
• the test SecretStore connection definition;
• one ExternalSecret for each service folder;
• the target Kubernetes Secret names.

It contains no application secret values. Those values are managed through the Ops portal in the sens-test KV-v2 mount. A healthy Application means the mapping resources were applied; the SecretStore and each ExternalSecret must also show Ready=True to prove end-to-end synchronization.

Production Applications

Production Applications use manual sync. A Git change or root reconciliation may update their desired state in Argo CD, but it must not deploy that change automatically.

sens-platform-production

This Application owns the running production platform, including the API, web-console and documentation Deployments, TimescaleDB, migration Jobs, Ingresses, certificates, and persistent volumes. The approved web-console host is app.iot-sens.schlossers.at; an older live revision can remain without that Deployment until its reviewed promotion is synchronized manually. The Application is not a placeholder and must not be deleted to reduce dashboard noise.

Only an approved production promotion should be synchronized. Review the revision, image tags, migration, diff, and rollback plan before selecting Sync.

external-secrets-production

This is the production-only External Secrets Operator. It has the same technical responsibility as the test controller but is restricted to sens-production and uses a separate Production OpenBao role.

The separate controller prevents test and production from sharing Secret permissions or authentication state.

reloader-production

This controller restarts production Deployments after their synchronized Kubernetes Secret changes. A value saved in the Production OpenBao mount can therefore cause a production rollout without a product release.

Treat production secret changes with the same review and monitoring discipline as a normal production deployment.

sens-platform-production-secrets

This Application defines the production SecretStore and service-folder mappings. It must use the separate sens-production mount and exact Kubernetes-Auth role.

It may intentionally remain OutOfSync before production secret management is initialized. Do not copy the test identity or test values to make the status green. Activate and synchronize it only through the documented production secret-management procedure.

Dependency Flow

The secret and workload Applications cooperate as follows:

external-secrets-crds
  -> external-secrets-test
     -> sens-platform-test-secrets
        -> OpenBao
        -> namespace-local Kubernetes Secrets
           -> reloader-test
              -> sens-platform-test Deployments

Production has the same flow with production-specific Applications, namespaces, and identities. The root Application manages the definitions and boundaries around both flows.

Reading Argo CD Status

Argo CD displays different status dimensions:

Status	Meaning
Synced	The live Kubernetes resources match the desired Git revision.
OutOfSync	Git and the cluster differ. This can be expected for an intentionally unsynchronized production change.
Healthy	The known live resources report a healthy runtime state. It does not prove every external dependency is available.
Progressing	A rollout, migration, startup, or readiness transition is still running.
Degraded	At least one managed resource reports a runtime failure.
operation Failed	The last sync attempt failed. Inspect its timestamp and resource message; it can describe historical state even after another controller has recovered.

Always read Sync Status, Health Status, Last Operation, revision, and the individual resource tree together. For secret synchronization, additionally inspect SecretStore and ExternalSecret readiness without printing Secret values.

Which Application Should I Open?

Question	Application
Did the test release and migration deploy?	sens-platform-test
Can test authenticate to OpenBao?	sens-platform-test-secrets, then external-secrets-test
Why did a test Pod restart after a secret change?	reloader-test, then the affected Deployment in sens-platform-test
Is OpenBao itself healthy?	openbao
Are the External Secrets resource types installed?	external-secrets-crds
Which GitOps children and boundaries exist?	sens-platform-root
Is a production release pending?	sens-platform-production
Is production secret synchronization initialized?	sens-platform-production-secrets

Use the Argo CD project filters sens-operations, sens-test, and sens-production to reduce dashboard noise without deleting Applications.

Safe Operator Actions

• Refresh is read-only and safe when the displayed Git or cluster state is stale.
• Test is normally reconciled by automation. A manual test sync is an incident recovery action, not the standard deployment workflow.
• Review the diff before every manual production sync.
• Enable Prune only when removal of the listed obsolete resources is intended. Pruning can delete workloads or other managed resources.
• Never use Delete merely to clear a red or unused-looking card. Determine ownership of workloads and persistent volumes first.
• Change application secret values through the Ops portal, not through Argo parameters or generated Kubernetes Secrets.
• Do not synchronize a production secret Application using test identity metadata or test project paths.

See Kubernetes Test and Production Deployment for release and access procedures and Secret Management for the complete secret workflow.