Deployment · 07 of 07 · Multi-cluster

One dev control plane, and an ArgoCD in every cluster

A single ArgoCD holding credentials for every cluster is a path from dev into prod. So each cluster pulls for itself, and results travel back the other way as events.

One dev control plane, and an ArgoCD in every cluster Deployment topology. The dev cluster runs the release stage, the CDEvents broker, the DORA exporter, an outcome relay and its own ArgoCD, which syncs dev manifests only. The release stage opens a pull request against the gitops repo. Each upper cluster, one of many, runs its own ArgoCD that pulls the same repo and syncs the app namespaces. When a sync converges, PostSync or SyncFail hook Jobs post a CDEvent with a per-cluster secret to the outcome relay, which checks the claimed cluster and forwards it to the broker; DORA consumes it. No cluster holds a credential for another cluster. DEV CLUSTER · ONEGITUPPER CLUSTER · ONE OF Nrelease stageopens the PRCDEvents brokerTokenReviewDORA exportercluster-mappedOutcome relaychecks cluster idArgoCD · devdev manifests onlygitops-<app>PR · review · mergeArgoCD · this clusterwatches the same repoApp namespaces<type>-<app>-<env>Sync hooksPostSync · SyncFail JobsRELEASE PRPULLSYNCON CONVERGECDEVENT · PER-CLUSTER SECRETCONSUMESNO REMOTE-CLUSTER CREDENTIALEvery cluster runs its own ArgoCD. Outcomes come back as events, and only when a release really converges.LEGENDOutcome pathGitReleaseEvent backDenied

Principle honored

The only thing that crosses a cluster boundary is a reviewed, merged commit. Outcomes flow back as events, not API calls.

What changes

  • The relay rejects an event whose claimed cluster does not match the secret it authenticated with.
  • PostSync fires only once health converges, not just when manifests apply.

Found in use

ArgoCD Notifications was tried first and dropped: live testing showed it fired on drift correction too, reporting releases that never happened.

Hangar · Glidepath