Day 75: Self-heal and app-of-apps
Self-heal: reverting manual changes automatically
With selfHeal: true, if someone runs kubectl edit directly against a resource ArgoCD manages, ArgoCD detects the drift and reverts it back to match Git — automatically, without anyone approving it. This sounds aggressive, but it's precisely the point: it makes Git the *only* legitimate way to change anything, closing the loophole of manual, undocumented cluster edits that GitOps exists to eliminate.
A real operational implication
'Just quickly kubectl edit it to fix the emergency' stops working once self-heal is on — the fix has to go through Git. This is a deliberate trade-off: it removes a fast escape hatch in exchange for guaranteeing the cluster never silently diverges from its declared state.
App-of-apps
As you accumulate dozens of ArgoCD Applications (one per microservice), managing them individually gets unwieldy. App-of-apps is a pattern where one parent Application's job is simply to deploy *other* Application objects — a single Git commit adding a new service's Application manifest is enough to onboard it into ArgoCD, without touching ArgoCD's own configuration directly.
Key terms
- Self-heal
- ArgoCD automatically reverting manual cluster changes that drift from Git.
- App-of-apps
- A parent Application whose sole job is to manage other Application objects.
A teammate manually kubectl edits a Deployment managed by ArgoCD with selfHeal enabled. What happens?
