argocd-gitops-adoption

Export live resources with kubectl, strip cluster-specific fields like resourceVersion and clusterIP, then create an ArgoCD Application CRD pointing at the manifest repo path. Match the project field to an existing working app so the repo secret authenticates correctly.

Classify namespaces by comparing cluster namespaces against existing ArgoCD apps and manifest repo directories. Generate one Application YAML per namespace pointing at its top-level directory, apply them all with kubectl apply -f, then verify Synced and Healthy status.

ArgoCD repo credentials are project-scoped secrets. If your Application uses a project that does not match the repo secret's project scope, you get HTTP Basic access denied even with the correct repoURL. Use the same project as a working app referencing that repo.

Common causes include cluster-injected annotations from autoscalers, missing pod template labels, unquoted CronJob schedules, or a source path that does not match the repo structure. Add ignoreDifferences rules, fix the manifests, then force a hard refresh annotation.

Verify the ExternalSecret shows SecretSynced status, remove Infisical annotations and resources from manifests and the cluster, then force an ArgoCD refresh. For new secrets, create a ServiceAccount, Vault policy, and Kubernetes auth role before the SecretStore and ExternalSecret.

Do not create Applications for Istio waypoint deployments, which are managed by Gateway resources via ownerReferences. Helm-managed infrastructure namespaces and orphaned manifest directories without running namespaces should also stay outside ArgoCD app management.