Muhtalip Dede · Founder of kprompt4 min readkprompt + Argo CD: sync status, drift, and approve-gated reconcile
Day-2 Argo CD with kprompt: detect Application CRDs, show gitops sync status, investigate drift vs Git, approve-gated sync/promote/rollback through the real Application API, and optional --gitops PR mode instead of live reconcile. Flux is the peer engine on the same contract. Not an Argo UI and not silent sync.
Argo CD is still the right controller for desired state in Git. kprompt does not replace the Application CRD, and it does not invent OutOfSync when neither Argo nor Flux is installed. It detects the controllers you already run, narrates sync + health, and turns “sync the payments application” into an approve-gated plan that patches the real Application API. Reads are free. Reconcile is not silent.
This is the site twin to the Medium thesis that GitOps stays declarative while AI Ops must stay intentional — intent → typed plan → approve → either live reconcile or a GitHub PR. Flux Kustomizations share the same CLI contract; examples lead with Argo CD.
Prerequisite: Application CRDs you already installed
kprompt tools reports GitOps when Flux Kustomization and/or Argo CD Application APIs are served. setup does not install Flux or Argo CD — brownfield bind-over-install. Prefer the controller your platform team already owns.
Detect — no second control plane
kprompt tools
# gitops: Argo CD Application present
# or: Flux Kustomization + Argo CD Application present
# or: MissingHint — neither CRD found
# setup never installs GitOps controllersshow gitops sync status — the compact read
Status and health are read-only. kprompt lists Applications (and Flux Kustomizations when present): sync status, health, revision hints. Missing GitOps fails clear with Drift.GitOpsMissing-class honesty — it does not fabricate a green sync table.
Status (read-only)
kprompt "show gitops sync status"
kprompt "gitops status" -n argocd
# Compact table — no reconcile, no PRDrift: OutOfSync as Investigation, not vibes
check cluster drift / what is out of sync reads the same controller truth and emits an Investigation: OutOfSync, Unhealthy, per-resource rows from Argo status.resources (non-Synced only), or Flux inventory when a Kustomization is OutOfSync. The scan never mutates. -o json stays report-only.
Drift scan
kprompt "check cluster drift"
kprompt "what is out of sync" -n argocd
kprompt "check drift" -o json | jq '.result'
# Findings (MVP): Drift.OutOfSync · Drift.Unhealthy · Drift.ResourceOutOfSync
# Drift.GitOpsMissing when neither engine is detected| Signal | Argo CD | If missing |
|---|---|---|
| Sync status | Application sync.status (Synced / OutOfSync) | Fail clear — no invented apps |
| Health | Application health (Healthy guidance when synced-but-unhealthy) | Omit — do not auto-sync unhealthy |
| Per-resource drift | status.resources[] not Synced (capped) | App-level only |
| Flux peer | Kustomization Ready / inventory when OutOfSync | degraded: flux-inventory if inventory absent |
Honesty: this is controller sync/health inventory — not a full live-vs-manifest field diff of every object. Manual changes GitOps already overwrote will not appear as drift.
Approve-gated sync — live reconcile toward Git
When an app is OutOfSync, drift may offer a reviewable sync plan. Or ask directly: sync the payments application. Apply goes through the real Argo CD Application API (or Flux reconcile annotation) — TTY y/N or --approve. That is live reconcile toward Git, not a PR and not kubectl apply freestyle.
Named sync (mutating — gated)
kprompt "sync the payments application" --approve
kprompt "show gitops sync status then sync payments" --approve
# Same gate as any mutating PlanResult
# Scale / delete / wipe-class stays on the Kubernetes path — not GitOps syncTwo write paths: reconcile vs --gitops PR
Intentional ops means choosing the write path on purpose. Live GitOps sync reconciles the cluster toward the repo you already trust. --gitops opens a GitHub PR instead of cluster apply for supported mutates (deploy / patch / Helm template) — merge, then let Argo or Flux reconcile. Sync plans themselves stay on the cluster path; omit --gitops for controller sync.
PR mode (desired state in Git)
kprompt "deploy redis" -n demo --gitops --gitops-repo acme/infra --approve
# Banner: Apply target: Git PR (not cluster)
# Merge → Argo/Flux reconcile — kprompt did not silent-applyTroubleshooting map (operator questions)
| You ask | kprompt shape | Mutates? |
|---|---|---|
| Is staging synced? | show gitops sync status | No |
| What drifted vs Git? | check cluster drift / what is out of sync | No (suggest may offer sync) |
| Pull Git into the cluster now | sync the <app> application | Yes — approve |
| Change desired state via PR | deploy … --gitops --gitops-repo … | PR only — not live apply |
| Why is the app unhealthy but Synced? | Drift.Unhealthy guidance | No auto-sync |
Observe: GitOps as evidence, not proof
Namespace Observe can attach GitOps EvidenceRefs when --gitops-evidence is on. Applications often live in argocd, not the app namespace — the flag only sees objects in the watch namespace. Missing GitOps → degraded: gitops. Sync status biases explanation; it never sole-proves root cause and never unlocks silent apply.
What we are not claiming
- Not an Argo CD UI / ApplicationSet designer / App-of-Apps installer
- Not a Flux bootstrap or Argo install via kprompt setup
- Not a full manifest field-level diff engine — controller sync/health inventory
- Not silent reconcile: OutOfSync ≠ auto sync
- Not replacing Git as source of truth — compose with it
- Not --gitops for live sync / scale / delete (those stay cluster apply)
Try it against the Argo CD you already run
Detect → status → drift → gated sync → deny wipe
kprompt tools
kprompt "show gitops sync status" -n argocd
kprompt "what is out of sync" -n argocd
kprompt "sync the payments application" # expect y/N — or pass --approve deliberately
kprompt "delete everything in the cluster"
# expect hard deny — GitOps never weakens the safety loopExperimental on purpose. Prefer non-production Applications while you learn the gate. If tools says GitOps is missing, install or point at the controller your platform already runs — do not stand up a second Argo so the screenshot looks green. Flux operators: same prompts; engine detection picks Kustomization when that is what you have.
Related posts
Top 100 Kubernetes prompts (natural language ↔ kubectl)
A tagged hub of ~100 real Kubernetes ops prompts—Operations, Debug, GitOps, Observability, Security, and Multi-cluster—each with a kubectl or tooling note, linked to our cheat sheet, error playbook, and edge-case guide.
Read articlekprompt + OpenTelemetry: trace payment request — without inventing spans
Day-2 OpenTelemetry with kprompt: bind Jaeger or Tempo, walk a span tree, narrate bottleneck waits, enrich service graphs with call edges when traces exist, and degrade honestly when OTel is missing. Not a Jaeger UI and not auto-remediation.
Read articlekprompt on Google Cloud: GKE day-2 with Gemini, without a new control plane
Use kprompt against GKE the same way you use kubectl — get-credentials, aliases, plan-before-apply — plus Gemini BYOK. Optional Observe agent on the cluster; no Marketplace SaaS, no kubeconfig upload.
Read article