ArgoCD
Topics in this category
App of Apps Applications GitOps Principles Multi-cluster RBAC Sync & Health Sync Waves & Hooks
ArgoCD

Multi-cluster

29 question(s)

How does ArgoCD scale to hundreds of clusters and applications?

Advanced
Scale with sharding: the application controller can be sharded across replicas, each handling a subset of clusters, and repo-server/redis are scaled for throughput. Tune reconciliation intervals, use webhooks to reduce polling, and use ApplicationSets to manage app sprawl. Monitoring controller load and shard balance is key at large scale.
# Shard the application controller across replicas
env:
  - name: ARGOCD_CONTROLLER_REPLICAS
    value: "3"
Real-world example At 300 clusters, the application controller is sharded across replicas so each handles a portion of the fleet.

Common follow-ups: What is controller sharding? | Which components scale for throughput?

Applications App of Apps Multi-cluster

What is a management (hub) cluster in ArgoCD?

Beginner
The management or hub cluster is where the ArgoCD control plane runs and from which it deploys to other (spoke) clusters. It holds Application definitions and cluster credentials and pushes desired state outward, giving a single control point for the fleet.
Real-world example One hub cluster runs ArgoCD and deploys to five workload clusters across regions.

Common follow-ups: What runs on the hub? | What are spoke clusters?

Applications App of Apps Multi-cluster

How do you list registered clusters in ArgoCD?

Beginner
Use `argocd cluster list` to see registered clusters with their server URLs, names, and connection status, or view them in the UI settings. Each corresponds to a cluster Secret in the argocd namespace.
argocd cluster list
Real-world example An operator runs argocd cluster list to confirm the new prod cluster registered and is reachable.

Common follow-ups: Where are clusters stored? | How do you check connectivity?

Applications RBAC Multi-cluster

How do cluster labels help manage a fleet?

Intermediate
Cluster secrets can carry labels (env, region, tier) that ApplicationSet cluster generators select on, so you target subsets and auto-include new matching clusters. Labels turn the fleet into queryable groups for placement decisions.
metadata:
  labels: { env: prod, region: eu }
Real-world example Labeling clusters env=prod lets one ApplicationSet deploy only to production clusters automatically.

Common follow-ups: Where are cluster labels set? | How do generators use them?

Applications App of Apps Multi-cluster

What connectivity does the hub need to spoke clusters?

Intermediate
The hub's application controller must reach each spoke's Kubernetes API endpoint over the network with valid credentials. Firewalls, VPNs/peering, and private endpoints must permit this. If a spoke API is unreachable, its apps show Unknown and can't sync until connectivity is restored.
Real-world example A misconfigured security group blocks the hub from a spoke's API, so its apps go Unknown until the rule is fixed.

Common follow-ups: What happens if a spoke API is unreachable? | What network paths are needed?

Applications Sync & Health Multi-cluster

How do you handle credentials rotation for many clusters?

Advanced
Automate rotation of the service-account tokens/kubeconfigs stored in cluster Secrets, prefer short-lived credentials via cloud identity (IRSA, Workload Identity), and manage the Secrets through External Secrets so rotation happens centrally without manual edits. Monitor for expired credentials causing Unknown status.
Real-world example Cluster access uses workload identity so tokens are short-lived and rotate automatically without manual Secret edits.

Common follow-ups: Why prefer short-lived credentials? | How does External Secrets help rotation?

RBAC Applications Multi-cluster

How do you deploy region-specific configuration to clusters?

Intermediate
Drive configuration from cluster metadata: an ApplicationSet template can select values files or overlays by region label, injecting region-appropriate endpoints, sizes, and settings. One template plus per-region values yields correct config per cluster.
template:
  spec:
    source:
      helm: { valueFiles: [ 'values-{{metadata.labels.region}}.yaml' ] }
Real-world example EU clusters load values-eu.yaml (EU endpoints) while US clusters load values-us.yaml from the same template.

Common follow-ups: How is the region injected? | Where do region values live?

Applications App of Apps Multi-cluster

How do you achieve high availability for the ArgoCD control plane?

Advanced
Run ArgoCD in HA mode: multiple replicas of the API server, repo-server, and application controller (sharded), plus a redis HA/sentinel setup. Spread across nodes/zones. This ensures the control plane tolerates node failures and continues reconciling the fleet.
Real-world example The hub runs HA ArgoCD with redis-ha and multiple controller shards so a node failure doesn't stop deployments.

Common follow-ups: Which components run multiple replicas? | Why shard the controller in HA?

Applications RBAC Multi-cluster

What is the difference between targeting a cluster by server URL vs name?

Intermediate
destination.server uses the exact API server URL; destination.name uses the human-friendly cluster name from its Secret. Names are more portable and readable (URLs can change), so referencing clusters by name is often preferred in templates and manifests.
destination:
  name: prod-eu   # portable; vs server: https://...
Real-world example Apps reference clusters by name so a changed API endpoint doesn't require editing every Application.

Common follow-ups: Why is name more portable than URL? | Where is the name defined?

Applications App of Apps Multi-cluster

How do you isolate tenants across clusters?

Advanced
Use AppProjects to restrict which clusters/namespaces each tenant can target, RBAC to scope who can act, and possibly dedicated clusters per sensitive tenant. Network policies and separate credentials further isolate. This limits both accidental and malicious cross-tenant impact in a shared control plane.
Real-world example A regulated tenant is confined by its project to its own cluster and namespaces, unable to deploy elsewhere.

Common follow-ups: How do Projects restrict targets? | When give a tenant a dedicated cluster?

RBAC App of Apps Multi-cluster