Skip to main content

GitOps (per region)

Once Terraform's root Application exists and points at argocd/apps/{cluster}, ArgoCD reconciles everything automatically — no further manual steps. Full detail: cogrion-gitops Region Deployment docs, specifically:

  • Prerequisites — what must exist in AWS before these Applications can sync (RDS secrets, IRSA roles, ACM cert ARN, etc.)
  • Adding a Cluster — the actual copy/repoint/verify steps
  • App Catalog & Sync Order — every app deployed today, its sync-wave, and why that ordering (external-secrets-config first at wave -5, then cluster-autoscaler/openbao at 2/5, keycloak/temporal in parallel at 10, cplane last at 15)
  • Troubleshooting — every real incident hit standing up dev-sgp and prod-sgp, split per service: cplane (the pino-pretty/NODE_ENV crash loop, the port-5001-vs-3000 mismatch, TEMPORAL_ADDRESS gaps), Temporal (default-namespace-never-created, the ArgoCD Job-immutability problem needing both Replace=true and Force=true, the stale-connection-pool-needs-a-restart issue on first-ever schema migration), and OpenBao (missing TLS server secret, the bao operator init client-timeout trap, lost-root-token recovery, the gp3-retain immutable-storage-class dance, the aws-CLI $HOME permission fix, and the per-secret KMS grant gotcha)

cogrion-gitops retired its own _bootstrap//app-roots/ directories once it was confirmed cogrion-terraform's modules/argocd already owns the AppProject/root Application lifecycle directly — there is no manual kubectl apply step on the gitops side anymore. See cogrion-gitops#6 for the full restructure history.