Running one Argo CD for many teams and many clusters: projects and RBAC per team, registering cloud clusters with short-lived credentials, namespace-scoped installs and the agent-based pull model.
Designing AppProjects so each team can deploy only from its repositories to its namespaces: source and destination allow and deny rules, cluster resource allow lists, project roles bound to SSO groups, and global projects.
Why the default project permits any repository, cluster and resource kind, and how to empty its sources and destinations so every application must belong to a deliberately scoped project.
Writing policy.csv so platform engineers administer Argo CD while application teams sync and roll back only their own apps: resources and actions, fine-grained update and delete on child resources, deny rules, and exec and logs access.
Managing many EKS clusters from one Argo CD without static kubeconfigs: management role and cross-account role chaining, EKS access entries instead of aws-auth, the argocd-k8s-auth exec provider, and least-privilege access policies.
Connecting Argo CD to Azure Kubernetes Service with kubelogin through argocd-k8s-auth: workload identity labels and annotations, service principal fallback, AAD_LOGIN_METHOD options and Entra ID RBAC on the cluster.
Connecting Argo CD to Google Kubernetes Engine clusters with argocd-k8s-auth gcp: Workload Identity on the management cluster, a GCP service account with the right IAM role, and bindings for the controller and server.
Managing cluster registrations and repository credentials as labeled Kubernetes Secrets in Git instead of argocd cluster add: secret types, credential templates, project-scoped entries and keeping the secrets themselves out of plain Git.
Managing remote or firewalled clusters with argocd-agent, where agents connect out to a central principal: managed and autonomous modes, which components run where, and the project's maturity today.
Running Argo CD without cluster-admin, for example for a tenant on a shared cluster: namespace-install manifests, installing CRDs separately, deploying only to external clusters, and the features that need a cluster-wide install.
Narrowing what Argo CD can write on each managed cluster: the argocd-manager-role, read-only cluster-wide with namespace-scoped write, cluster resource allow lists in projects, and sync impersonation per destination.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.