# Build Secure GitOps Workflows with Argo CD and Flux

Kubernetes delivery becomes risky when cluster state and deployment changes lack a controlled source of truth. This skill provides practical Argo CD and Flux workflow guidance.

## Install

```bash
npx skillstore add sickn33/gitops-workflow
```

## Metadata

- Status: approved
- Slug: sickn33-gitops-workflow
- Skillstore revision: r2
- Version status: missing
- Tree hash: 41ffad60f64fee1ebc607e42a1162f39aaaf5bfc73873c259e224858fdbf7f86
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/gitops-workflow
- Ref: 88a8e9a07f4c54ab105c1c41b6267c287146b07b
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, external\_commands, filesystem
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-gitops-workflow
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-gitops-workflow/manifest

## Capabilities

- Explains Argo CD and Flux installation and bootstrap workflows.
- Proposes Git repository layouts for applications, infrastructure, environments, and controller resources.
- Creates Argo CD Application and Flux source and Kustomization examples.
- Configures synchronization, pruning, retries, health checks, and maintenance windows.
- Outlines canary and blue-green delivery strategies.
- Covers external secret references, sealed secrets, and common synchronization troubleshooting.

## Use Cases

- Establish a cluster delivery platform: Design repository structure, controller setup, synchronization policies, and production approval boundaries.
- Onboard an application to GitOps: Define application sources, deployment destinations, secret references, and staged promotion behavior.
- Review deployment controls: Assess pruning, self-healing, retries, health checks, and operational safeguards before rollout.

## Prompt Templates

### Plan a basic GitOps setup

```
Create a beginner GitOps plan for my Kubernetes cluster using [Argo CD or Flux]. List prerequisites, safe installation choices, and validation steps.
```

### Design a repository layout

```
Design a GitOps repository for [applications], [environments], and [infrastructure]. Explain ownership, promotion flow, and where controller resources belong.
```

### Configure application reconciliation

```
Draft an Argo CD or Flux reconciliation design for [application]. Include sync intervals, retries, health checks, pruning safeguards, and secret references.
```

### Architect controlled multi-cluster delivery

```
Design a multi-cluster GitOps workflow for [environments]. Include progressive delivery, approval gates, rollback, RBAC, observability, and supply-chain integrity requirements.
```

## Limitations

- Requires valid Kubernetes cluster access, repository permissions, and installed command-line tools.
- Uses placeholder names, URLs, namespaces, and policies that require environment-specific review.
- Does not execute deployments, validate generated manifests, or confirm controller compatibility.
- Some installation examples depend on mutable upstream resources and require stronger integrity controls.

## Best Practices

- Pin installation artifacts and verify checksums or signatures before applying them.
- Test synchronization, pruning, rollback, and secret handling in staging before production.
- Require least-privilege access, production approvals, health checks, and reconciliation alerts.

## Anti Patterns

- Do not apply mutable remote manifests directly to a production cluster.
- Do not store plaintext credentials in Git, command arguments, or shared terminal logs.
- Do not enable automatic production pruning without tested recovery and explicit approval controls.

## Security Audit

- Audited at: 2026-07-24T00:16:24.515\+00:00
- Summary: Most static command-execution alerts are false positives caused by Markdown fences, placeholder URLs, or benign temporary-directory handling. Confirmed risks include unpinned remote Kubernetes manifests and a downloaded Flux installer executed with sudo without integrity verification. The examples also expose credentials through terminal commands and enable automated pruning against a production path.

## Stats

- Views: 132
- Downloads: 11
- Favorites: 0
- Popularity score: 0