ArgoCD

ArgoCD is the GitOps control plane. Every workload on the cluster is reconciled from the platform repository — a matrix ApplicationSet fans Helm charts across the cluster, and each Application surfaces its sync state, health, and a live Git-to-cluster diff.

The public route lands on a read-only viewonly account: inspect everything, but no sync, no app mutation, no exec. Operator changes happen behind MFA, and write-capable admin access stays on the local network only.