CNCF-hosted Co-located Events Europe 2025

One of the most exciting recent enhancements to Argo CD is native OCI (Open Container Initiative) integration support. No longer are you limited to Git or Helm as a storage backend, but Argo CD now natively integrates with a piece of infrastructure you already have available: an OCI registry. And the best part: all of your existing Argo CD content can be reused in a brand new way!

Join members of the Argo CD community that brought native OCI integration to life in this panel session as they share everything that you need to know to effectively take advantage of this new capability.

In particular, they will discuss:

* The development process and community collaboration involved
* The technical details associated with native OCI integration in Argo CD
* The business value and how it unlocks the benefits of Argo CD like never before
* Common methods for managing OCI content including integration into existing workflows
* Examples that you can use to get started in your own environment

Argo CD has unlocked a GitOps revolution for deploying and keeping our applications synced. The next big problem to be solved is how to manage promoting changes between environments. CI-driven updates, Image Updater, Progressive Sync, Kargo, Environment and Promotions, and Rendered Manifest Pattern all propose different ways to tackle the basic problem of how to get changes from one environment into another.

In this talk, we’ll review the current state of application promotion across environments and how the different approaches work with pitfalls and benefits. To keep it honest, DevOps grump and professional detractor Viktor Farcic will bring his honest take as we look at the seemingly endless nuances of environment promotion and change management.

Building on the foundations of Argo CD UI ephemeral access introduced in our previous talk, this session takes a deeper dive into implementing and configuring this extension and fine-grained RBAC in production environments. While the initial focus was on mitigating risks associated with powerful actions in the Argo CD UI, scaling these practices in production has revealed new challenges, unexpected complexities, and opportunities for refinement.
If you’re curious about the practicalities of running ephemeral access and fine-grained RBAC in production or eager to learn how to refine your own approaches, this talk will provide valuable insights and actionable takeaways. Join us to continue the conversation on enhancing safety, compliance, and efficiency in dynamic, high-stakes environments.

How do you bootstrap Argo CD? Is it Terraform? Kubectl apply? Or have you set it to auto with Autopilot? Installing Argo CD to play around is easy but setting it up for a scalable, well-organized, and well-managed software delivery experience requires know-how and a bit of elbow grease. In this session, we’ll show how Argo CD Autopilot works and can serve as the basis for your GitOps pattern. This has benefits like easy disaster recovery, better user experience, more predictability in organization and adoption, and an overall streamlined experience.

But Autopilot is just the beginning! It’s easy to customize (with or without a K) and set up to do much more than what you get out of the box. Don’t reinvent the wheel, it’s time to use autopilot.

As companies expand their usage of Argo CD and its powerful UI, robust security in multi-tenant environments becomes critical. Thus, misconfiguring Argo CD can lead to significant security vulnerabilities.

This session will provide a technical deep dive into securing Argo CD installations for multi-tenant environments. We’ll examine the building blocks for establishing effective security controls—like Application Projects, security policies, and user roles—and highlight best practices for defining access controls using Argo CD’s RBAC policies, and restricting deployments to specific clusters and namespaces and structuring Application Projects.

Through real-world examples, Argo CD admins will learn to configure their installations securely, manage permissions, and tailor the environment to meet organizational needs without compromising usability or productivity. The talk will also provide practical strategies to avoid common pitfalls in permission management.

The Argo CD CLI has been a cornerstone for managing GitOps workflows, but until now, it lacked support for extending its capabilities through plugins. This talk introduces plugin support to the ArgoCD CLI, enabling users to create custom plugins and use them as subcommands, extending the ArgoCD CLI functionality like kubectl.

In this talk, we’ll demonstrate the new plugin system’s real-world application by showcasing a plugin we developed: mta (Migrate to Argo CD). This plugin bridges the gap between Flux and Argo CD by exporting Flux components into Argo CD-compatible Custom Resources (CRs), simplifying migrations from Flux to Argo CD.

Argo CD supports a multi-tenant operation model. Cluster scoped Argo CD instance is the widely used approach wherein it uses a single service account to manage resources across multiple tenant namespaces and this brings in the security challenge of privilege escalation. When a cluster scoped Argo CD instance is used to manage resources across multiple tenant namespaces, it violates the principle of "least privilege" providing escalated privileges to all the tenants.

In this talk we will be looking at some of the best practices for handling privilege escalation in multi-tenant scenarios and how the recent feature of decoupling application syncs using a service account per tenant can be a real game changer in improving the security posture of Argo CD for mult-tenant scenarios.

As WebAssembly (WASM) and serverless technologies like SpinKube gain traction, they introduce new paradigms for lightweight, fast, and secure application deployments. However, the unique characteristics of SpinKube/WASM applications—such as custom resource definitions (CRDs) and unconventional health signals—pose challenges for Continuous Delivery.

In this talk, we’ll explore how to leverage ArgoCD to seamlessly deliver SpinKube-based WASM applications. We will demonstrate how ArgoCD’s built-in and custom health checks can monitor resource health, ensure smooth deployments, and surface critical insights for SpinKube workloads. Key takeaways include:

- How to integrate SpinKube/WASM applications with ArgoCD for Continuous Delivery.
- Practical examples of creating custom health checks for CRDs or non-standard resource types

Join us to discover how combining SpinKube and ArgoCD simplifies and scales Continuous Delivery for next-generation serverless applications.

We’ve learned to think of environment promotion in terms of deployment pipelines. But in the age of Kubernetes and everything-declarative, we need to abandon the imperative pipeline mode of thinking. According to the Kubernetes model, environment state should be declared, and an operator ought to drive towards that state. To achieve this, we need GitOps Promoter and its CommitStatus API.

GitOps Promoter is a new environment promotion tool that adheres strictly to GitOps principles. Promotions are handled through automated PRs, and promotion gates are implemented as commit statuses. This talk will demonstrate how to use the GitOps Promoter’s CommitStatus API to gate promotions on Argo CD application health. We’ll show how the only prerequisite to enabling a fully declarative GitOps promotion experience is “having an opinion about a commit.”