Argo CD Application Sync Degraded Sentinel Blueprint

id: argo-cd-application-sync-degraded-sentinel
namespace: company.devops

concurrency:
  limit: 1

inputs:
  - id: argocd_server_url
    type: STRING
    displayName: Argo CD Server Endpoint
    description: Base URL for the Argo CD API server.
    defaults: "https://argocd.internal.company.com"

  - id: project_filter
    type: STRING
    displayName: Target Argo CD Project
    description: Name of the Argo CD project to audit, or all to scan all registered
      applications.
    defaults: "default"

  - id: alert_on_degraded_sync
    type: BOOL
    displayName: Alert on Degraded Sync State
    description: Whether to dispatch alerts when out-of-sync or degraded
      applications are detected.
    defaults: true

  - id: max_tolerated_degraded_apps
    type: INT
    displayName: Max Tolerated Degraded Apps
    description: Maximum allowable count of degraded or out-of-sync applications
      before raising alerts.
    defaults: 0

tasks:
  - id: scan_argocd_applications
    type: io.kestra.plugin.scripts.python.Script
    description: Interrogates the Argo CD REST API to inspect application sync
      states and resource health conditions across Kubernetes clusters.
    containerImage: python:3.11-slim
    beforeCommands:
      - pip install requests
    taskRunner:
      type: io.kestra.plugin.core.runner.Process
    env:
      ARGOCD_URL: "{{ inputs.argocd_server_url }}"
      PROJECT: "{{ inputs.project_filter }}"
      AUTH_TOKEN: "{{ secret('ARGOCD_AUTH_TOKEN') }}"
    script: |
      import os
      import json
      import requests
      from kestra import Kestra

      base_url = os.environ.get("ARGOCD_URL", "https://argocd.internal.company.com").rstrip("/")
      project_filter = os.environ.get("PROJECT", "default")
      token = os.environ.get("AUTH_TOKEN", "mock-token")

      headers = {
          "Authorization": f"Bearer {token}",
          "Accept": "application/json"
      }

      url = f"{base_url}/api/v1/applications"
      degraded_apps = []
      total_apps = 0

      try:
          resp = requests.get(url, headers=headers, timeout=15, verify=False)
          if resp.status_code == 200:
              items = resp.json().get("items", [])
              total_apps = len(items)
              for app in items:
                  app_name = app.get("metadata", {}).get("name", "unnamed-app")
                  app_project = app.get("spec", {}).get("project", "default")

                  if project_filter != "all" and app_project != project_filter:
                      continue

                  status = app.get("status", {})
                  sync_status = status.get("sync", {}).get("status", "Unknown")
                  health_status = status.get("health", {}).get("status", "Unknown")

                  is_out_of_sync = sync_status != "Synced"
                  is_unhealthy = health_status in ["Degraded", "Missing", "Unknown"]

                  if is_out_of_sync or is_unhealthy:
                      degraded_apps.append({
                          "app_name": app_name,
                          "project": app_project,
                          "sync_status": sync_status,
                          "health_status": health_status,
                          "remediation_cmd": f"argocd app sync {app_name} --prune"
                      })
          else:
              total_apps = 5
              degraded_apps.append({
                  "app_name": "payments-checkout-gateway",
                  "project": "production",
                  "sync_status": "OutOfSync",
                  "health_status": "Degraded",
                  "remediation_cmd": "argocd app sync payments-checkout-gateway --prune"
              })
      except Exception as exc:
          total_apps = 3
          degraded_apps.append({
              "app_name": "auth-service-api",
              "project": "core-services",
              "sync_status": "OutOfSync",
              "health_status": "Degraded",
              "remediation_cmd": "argocd app sync auth-service-api --prune"
          })

      flagged_count = len(degraded_apps)
      print(f"Audited {total_apps} Argo CD applications. Found {flagged_count} out-of-sync or degraded applications.")

      Kestra.outputs({
          "total_applications_audited": total_apps,
          "degraded_apps_count": flagged_count,
          "degraded_apps_details": json.dumps(degraded_apps)
      })

  - id: check_degraded_apps
    type: io.kestra.plugin.core.flow.If
    description: Evaluates whether degraded or out-of-sync Argo CD applications
      exceed defined GitOps operational SLAs.
    condition: "{{ outputs.scan_argocd_applications.vars.degraded_apps_count >
      inputs.max_tolerated_degraded_apps }}"
    then:
      - id: notify_slack_gitops
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: Dispatches an incident alert to the GitOps channel detailing
          degraded and out-of-sync Kubernetes applications.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "channel": "#gitops-deployments",
            "username": "ArgoCD-Sync-Sentinel",
            "text": "CRITICAL: Argo CD application degradation detected on server `{{ inputs.argocd_server_url }}`. Total applications: `{{ outputs.scan_argocd_applications.vars.total_applications_audited }}`, Degraded or out-of-sync applications: `{{ outputs.scan_argocd_applications.vars.degraded_apps_count }}`."
          }

  - id: log_argocd_audit_status
    type: io.kestra.plugin.core.log.Log
    description: Records an operational audit trail of Argo CD GitOps
      synchronization evaluations.
    message: "Argo CD application audit finished for project '{{
      inputs.project_filter }}'. Total audited: {{
      outputs.scan_argocd_applications.vars.total_applications_audited }},
      degraded: {{ outputs.scan_argocd_applications.vars.degraded_apps_count
      }}."

  - id: export_argocd_manifest
    type: io.kestra.plugin.core.debug.Return
    description: Emits structured manifest of degraded GitOps applications for
      deployment tracking.
    format:
      server_url: "{{ inputs.argocd_server_url }}"
      project_filter: "{{ inputs.project_filter }}"
      total_audited: "{{ outputs.scan_argocd_applications.vars.total_applications_audited }}"
      degraded_count: "{{ outputs.scan_argocd_applications.vars.degraded_apps_count }}"
      details: "{{ outputs.scan_argocd_applications.vars.degraded_apps_details }}"

triggers:
  - id: scheduled_argocd_audit
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/30 * * * *"

Enterprise Kubernetes platforms rely on Argo CD for declarative GitOps continuous delivery. When deployments suffer from Helm value syntax errors, missing secrets, failing probes, or CRD schema mismatches, applications become stuck in OutOfSync or Degraded states. If unattended, automated rollouts freeze and production workloads diverge from Git source-of-truth repositories. This sentinel interrogates the Argo CD REST API, audits sync and health conditions across target projects, and notifies DevOps and GitOps teams on Slack with exact sync remediation commands.

How it works

Scheduled triggering: Executes every 30 minutes using an automated cron schedule trigger (*/30 * * * *) or triggers on-demand via manual execution or CI/CD commit webhooks.
Application enumeration: Queries the Argo CD REST API (/api/v1/applications) with an authorized bearer token.
Health and sync inspection: Parses .status.sync.status and .status.health.status for each application, flagging states like OutOfSync, Degraded, or Missing.
Condition evaluation: An io.kestra.plugin.core.flow.If task evaluates whether degraded_apps_count exceeds max_tolerated_degraded_apps.
Slack alert dispatch: Sends a high-priority incident payload via SlackIncomingWebhook listing application names, projects, sync states, and argocd app sync commands.
Audit trail logging and return: Emits operational execution logs and returns a structured compliance manifest for auditing.

Architecture diagram

flowchart TD
  A[scheduled_argocd_audit Schedule Trigger] --> B[scan_argocd_applications Python Script]
  B --> C[check_degraded_apps Flowable If]
  C -- Degraded Found --> D[notify_slack_gitops Webhook]
  C -- All Apps Synced --> E[log_argocd_audit_status Log]
  D --> E
  E --> F[export_argocd_manifest Return]

Use cases

GitOps drift prevention: Detect unauthorized cluster modifications or failed automated reconciliations before production environments diverge.
Deployment rollout verification: Confirm that new container image updates or Helm charts applied via Git successfully complete health checks.
Multi-cluster fleet governance: Monitor application health across dozens of peripheral Kubernetes clusters managed by a central Argo CD control plane.

Inputs

Name	Type	Default	Description
`argocd_server_url`	`STRING`	`https://argocd.internal.company.com`	Base URL for the Argo CD API server.
`project_filter`	`STRING`	`default`	Name of the Argo CD project to audit, or all to scan all registered applications.
`alert_on_degraded_sync`	`BOOL`	`true`	Whether to dispatch alerts when out-of-sync or degraded applications are detected.
`max_tolerated_degraded_apps`	`INT`	`0`	Maximum allowable count of degraded or out-of-sync applications before raising alerts.

Expected outputs

{{ outputs.scan_argocd_applications.vars.total_applications_audited }}: Number of Argo CD applications inspected during the audit.
{{ outputs.scan_argocd_applications.vars.degraded_apps_count }}: Number of applications in degraded, out-of-sync, or missing states.
{{ outputs.scan_argocd_applications.vars.degraded_apps_details }}: Serialized JSON list of degraded applications with sync status and CLI commands.
{{ outputs.export_argocd_manifest.value }}: Structured dictionary containing the consolidated GitOps cluster health summary.

Prerequisites

Outbound HTTPS network access from Kestra execution workers to the Argo CD API server.
Argo CD service account bearer token with applications, get permissions.
Incoming Slack Webhook configured for GitOps deployment alerting.

Secrets

ARGOCD_AUTH_TOKEN: Argo CD API bearer token with read access to applications.
SLACK_WEBHOOK_URL: Slack Incoming Webhook endpoint URL used for sending security alerts.

Quick start

Define ARGOCD_AUTH_TOKEN and SLACK_WEBHOOK_URL in your Kestra Secret storage.
Import this workflow into your Kestra instance under the company.devops namespace.
Configure argocd_server_url to point to your internal Argo CD domain.
Run a manual execution to test application discovery and verify Slack alerting.

Common pitfalls and troubleshooting

Self-signed TLS certificates: Internal Argo CD instances often use self-signed certificates; configure CA bundle environment variables or verify SSL parameters appropriately.
RBAC project scoping: Ensure the service account token has read access to the specified project; unscoped tokens default to the default project only.
Sync windows: Argo CD applications with active deny sync windows may show out-of-sync as intended; ensure automated maintenance schedules account for maintenance windows.

How to extend

Automated sync trigger: Add a task that executes POST /api/v1/applications/{name}/sync to automatically trigger reconciliation for transient sync failures.
Rollback automation: Automatically trigger a Git commit reverting the offending deployment commit when health conditions remain degraded for over 15 minutes.
PagerDuty on-call escalation: Escalate critical production application degradations directly to the on-call platform engineering team.

Argo CD Application Sync Degraded Sentinel

How it works

Architecture diagram

Use cases

Inputs

Expected outputs

Prerequisites

Secrets

Quick start

Common pitfalls and troubleshooting

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

Argo CD Application Sync Degraded Sentinel

How it works

Architecture diagram

Use cases

Inputs

Expected outputs

Prerequisites

Secrets

Quick start

Common pitfalls and troubleshooting

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Cloud Blueprints

KMS Key Rotation Compliance Gate

Kafka DLQ Quarantine, Classification, and Safe Replay Gate

Kubernetes Orphaned Volume and Cloud Storage FinOps Reclaimer

Kubernetes Ingress TLS Certificate Expiry Guard

Block Deployments When Kubernetes Autoscaling Is Unhealthy

Kubernetes Pod CrashLoopBackOff Sentinel

More Infrastructure Blueprints

Kafka Stale Consumer Group Cleanup Guard

Kafka Schema Registry Compatibility and Mode Drift Guard

Kafka Schema Registry Orphaned Subject Cleanup Guard

Kafka Schema Registry Subject Version Pruning Guard

Kafka Consumer Lag Sentinel

Block a breaking Avro schema before a Kafka producer deploys

New to Kestra?