Argo CD Application Drift Sentinel for Kestra

id: argocd-app-drift-sentinel
namespace: company.team
description: |
  On a schedule, read-only fetch an Argo CD application's sync and health
  status (nothing is synced, refreshed state aside, or rolled back) and
  classify it as HEALTHY, WARNING, CRITICAL, or UNREACHABLE. Log clean
  runs and page Slack the moment an application drifts out of sync or its
  health degrades, independent of any active deploy pipeline.

inputs:
  - id: argocd_application
    type: STRING
    defaults: "my-argocd-app"
    displayName: "Argo CD Application Name"
    description: "Name of the Argo CD Application to check."
  - id: force_refresh
    type: SELECT
    values: [ "true", "false" ]
    defaults: "false"
    displayName: "Force Live Refresh"
    description: "When true, bypasses Argo CD's cache and forces a live cluster
      re-check via argocd app get --refresh, at the cost of an extra API call."

triggers:
  - id: app_drift_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    description: Check the application every 6 hours. Shipped disabled; enable it
      once argocd_application points at a real application and a manual run has
      been verified.
    cron: "0 */6 * * *"
    disabled: true
    inputs:
      argocd_application: "my-argocd-app"
      force_refresh: "false"

tasks:
  - id: check_app_status
    type: io.kestra.plugin.argocd.apps.Status
    description: Read the application's sync and health state, plus its conditions
      and managed resources. Does not sync, modify, or roll back anything on the
      cluster.
    server: "{{ secret('ARGOCD_SERVER') }}"
    token: "{{ secret('ARGOCD_TOKEN') }}"
    application: "{{ inputs.argocd_application }}"
    refresh: "{{ inputs.force_refresh }}"
    allowFailure: true

  - id: classify_app_drift
    type: io.kestra.plugin.core.debug.Return
    description: Classify the reported sync and health status together, treating a
      missing output as a server or application lookup failure, any degraded or
      missing health as critical regardless of sync state, and an out-of-sync or
      transitional health state as a drift warning.
    format: "{{ (outputs.check_app_status.syncStatus is not defined or
      outputs.check_app_status.healthStatus is not defined) ? 'UNREACHABLE' :
      ((outputs.check_app_status.healthStatus == 'Degraded' or
      outputs.check_app_status.healthStatus == 'Missing' or
      outputs.check_app_status.healthStatus == 'Unknown') ? 'CRITICAL' :
      ((outputs.check_app_status.syncStatus == 'OutOfSync' or
      outputs.check_app_status.healthStatus == 'Progressing' or
      outputs.check_app_status.healthStatus == 'Suspended') ? 'WARNING' :
      'HEALTHY')) }}"

  - id: route_by_drift
    type: io.kestra.plugin.core.flow.Switch
    description: Route to a quiet log on a synced and healthy application, an
      informational Slack message on drift or a transitional health state, or a
      Slack page for a degraded application or an unreachable server.
    value: "{{ outputs.classify_app_drift.value }}"
    cases:
      "HEALTHY":
        - id: log_healthy
          type: io.kestra.plugin.core.log.Log
          message: "Argo CD application {{ inputs.argocd_application }} is healthy:
            syncStatus={{ outputs.check_app_status.syncStatus }} healthStatus={{
            outputs.check_app_status.healthStatus }}."
      "WARNING":
        - id: alert_warning_drift
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: Post an informational Slack message when the application is out of
            sync with Git or sitting in a transitional health state.
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {
              "text": "Argo CD drift sentinel WARNING: application {{ inputs.argocd_application }} is reporting syncStatus '{{ outputs.check_app_status.syncStatus }}' and healthStatus '{{ outputs.check_app_status.healthStatus }}'. This may be a manual change drifting from Git, or a rollout still in progress. Execution {{ execution.id }}."
            }
      "CRITICAL":
        - id: alert_critical_drift
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: Page Slack when the application's health is degraded, missing, or
            unknown, regardless of its sync state.
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {
              "text": "Argo CD drift sentinel CRITICAL: application {{ inputs.argocd_application }} is reporting healthStatus '{{ outputs.check_app_status.healthStatus }}' (syncStatus '{{ outputs.check_app_status.syncStatus }}'). The application is not healthy on the cluster. Execution {{ execution.id }}."
            }
      "UNREACHABLE":
        - id: alert_unreachable_app
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: Page Slack when the status check could not return sync or health
            state at all, indicating the Argo CD server is unreachable or the
            application does not exist.
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {
              "text": "Argo CD drift sentinel UNREACHABLE: checking application {{ inputs.argocd_application }} did not return a sync or health status (server unreachable, token invalid, or application not found). Execution {{ execution.id }}."
            }
    defaults:
      - id: log_unclassified
        type: io.kestra.plugin.core.log.Log
        message: "Argo CD drift sentinel completed with an unexpected classification: {{
          outputs.classify_app_drift.value }}."

  - id: log_audit_result
    type: io.kestra.plugin.core.log.Log
    description: Record a single audit line for every run regardless of branch
      taken, so the check's own history stays queryable independent of Slack.
    message: "Argo CD drift sentinel audit: application={{ inputs.argocd_application
      }} status={{ outputs.classify_app_drift.value }} sync_status={{
      outputs.check_app_status.syncStatus is defined ?
      outputs.check_app_status.syncStatus : 'n/a' }} health_status={{
      outputs.check_app_status.healthStatus is defined ?
      outputs.check_app_status.healthStatus : 'n/a' }} execution={{ execution.id
      }}."

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Alert Slack when the sentinel flow itself fails outright, so a
      broken check is never mistaken for a healthy application.
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "text": "Argo CD drift sentinel flow {{ flow.id }} FAILED (execution {{ execution.id }}). Sync and health status of application {{ inputs.argocd_application }} is now unknown; check the task logs and the Argo CD server manually."
      }

outputs:
  - id: status
    type: STRING
    value: "{{ outputs.classify_app_drift.value }}"

A GitOps application can drift out of sync with its source of truth, or quietly degrade on the cluster, long after the pipeline that deployed it has finished and stopped watching. This blueprint turns a scheduled, read-only argocd app get call into a Day 2 health gate: io.kestra.plugin.argocd.apps.Status reports the application's current sync and health state without changing anything on the cluster, a single Pebble expression classifies the combination, and the result routes to a quiet log, an informational Slack note, or a Slack page depending on severity.

How it works

check_app_status (io.kestra.plugin.argocd.apps.Status) reads argocd_application's sync status (Synced/OutOfSync) and health status (Healthy/Progressing/Degraded/Suspended/Missing/Unknown) from the Argo CD server, along with its conditions and managed resources. Setting refresh to "true" forces a live re-check instead of Argo CD's cached state, at the cost of an extra API call. allowFailure: true keeps a server or application lookup failure from aborting the flow outright.
classify_app_drift (io.kestra.plugin.core.debug.Return) evaluates a single Pebble expression against both fields together: missing either entirely becomes UNREACHABLE; a health status of Degraded, Missing, or Unknown becomes CRITICAL regardless of sync state, since a broken application matters more than whether Git and the cluster currently agree; an out-of-sync application or a transitional health status (Progressing, Suspended) becomes WARNING; otherwise HEALTHY.
route_by_drift (io.kestra.plugin.core.flow.Switch) branches on that classification: HEALTHY logs a quiet confirmation; WARNING posts an informational Slack note; CRITICAL and UNREACHABLE each page Slack with the reported sync and health status; a defaults fallback logs the raw value for any classification outside the four known cases.
log_audit_result (io.kestra.plugin.core.log.Log) writes one audit line per run, independent of which Switch branch fired, so the check's own history stays queryable even if Slack delivery fails.
The flow-level errors block pages Slack separately if the flow fails outright, so a broken sentinel is never mistaken for a healthy application.
The app_drift_schedule trigger checks every 6 hours and ships disabled: true, with explicit inputs: overrides for argocd_application and force_refresh so the scheduled run's target and cache behavior are pinned regardless of this flow's own defaults.

What you get

A scheduled, read-only drift and health check for any Argo CD application with zero custom argocd CLI scripting.
A single status output (HEALTHY / WARNING / CRITICAL / UNREACHABLE) other flows can gate on.
Three distinct Slack messages, one per severity, each carrying the reported sync and health status.
An audit log line on every run, separate from Slack, so the check's own history survives a webhook outage.

Who it's for

Platform teams running GitOps with Argo CD who have no check for drift or degraded health once a deploy pipeline finishes.
On-call engineers who want a signal that a manual cluster change drifted from Git, or that a rollout never actually settled, before it is discovered by accident.
Teams that already verify status immediately after a sync (as in a deploy pipeline) and want a complementary, continuous signal that is not tied to any specific deploy.

Why orchestrate this with Kestra

Argo CD's own UI shows drift and health in real time, but nothing pages anyone when it happens unless someone is watching the dashboard. Kestra's scheduled, read-only Status check gives that page automatically: the schedule, the classification, and the Slack call are all one auditable execution history, with the Switch branch ready to grow into real remediation (triggering the existing Sync task on drift, opening a ticket) without rewriting the check itself.

Prerequisites

An Argo CD server reachable at the ARGOCD_SERVER secret, with an existing Application named argocd_application.
An Argo CD auth token with read access to that application.
A Slack incoming webhook for the WARNING, CRITICAL, UNREACHABLE, and flow-failure alerts.

Secrets

ARGOCD_SERVER: Argo CD server address, e.g. argocd.example.com or argocd-server.argocd.svc.cluster.local:443.
ARGOCD_TOKEN: Argo CD API token with at least read access to the application.
SLACK_WEBHOOK: Slack incoming webhook used for every alert branch and the flow-failure alert.

In Kestra OSS (no Enterprise secrets backend), secrets are supplied as environment variables prefixed SECRET_, base64-encoded, and read back in flows with {{ secret('NAME') }}, for example SECRET_SLACK_WEBHOOK=$(echo -n 'https://hooks.slack.com/services/<placeholder>' | base64). This keeps credentials out of the flow YAML but, per Kestra's own documentation, offers no encryption at rest or access control beyond the host environment; use the Enterprise secrets backend for stronger guarantees.

Quick start

Start a local single-node Kubernetes cluster in Docker, on its own API server port well away from Kestra's own UI: docker run -d --name k3s-server --privileged -p 6443:6443 rancher/k3s:latest server --tls-san=localhost
If Kestra is also running in Docker, check docker network ls for Kestra's network and attach the cluster to it: docker network connect YOUR_KESTRA_NETWORK k3s-server
Install Argo CD into the cluster and port-forward its API server to a port that does not collide with Kestra's own 8080: docker exec k3s-server kubectl create namespace argocd docker exec k3s-server kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml docker exec k3s-server kubectl port-forward svc/argocd-server -n argocd 8443:443
Retrieve the initial admin password and generate an API token: docker exec k3s-server kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" argocd login localhost:8443 --username admin argocd account generate-token
Add ARGOCD_SERVER (localhost:8443), ARGOCD_TOKEN, and SLACK_WEBHOOK as secrets, create a sample Application, and run the flow once manually to confirm status reads HEALTHY.
Enable app_drift_schedule once pointed at a real server and application.

How to extend

Chain a WARNING branch into the existing io.kestra.plugin.argocd.apps.Sync task for automatic drift correction instead of a Slack note alone.
Loop this flow's argocd_application input over every application a team owns using io.kestra.plugin.core.flow.Loop, instead of checking one application per execution.
Parse outputs.check_app_status.conditions or outputs.check_app_status.resources to name the specific resource causing a Degraded health status in the Slack alert.
Push status into a KV store and alert only on state transitions instead of every run.

Inputs

argocd_application: the Argo CD Application to check (type STRING, default my-argocd-app).
force_refresh: type SELECT, values ["true", "false"], default "false"; forces a live cluster re-check instead of Argo CD's cached state.

Outputs

status: one of HEALTHY, WARNING, CRITICAL, UNREACHABLE.
Example path: {{ outputs.classify_app_drift.value }}, also exposed as the flow output {{ outputs.status }}.

Pitfalls

Without refresh: "true", Argo CD can serve a cached sync/health status for a short window after a cluster-side change; set it to "true" if the check needs to see drift the moment it happens, at the cost of one extra API call per run.
Progressing health is classified WARNING, not CRITICAL, because it is normal during any rollout; a WARNING that persists across several scheduled checks in a row is the real signal of a stuck rollout, not a single occurrence.
This flow only ever calls argocd app get; it never calls argocd app sync, argocd app rollback, or argocd app delete, so there is nothing destructive to default to dry-run for.
ARGOCD_TOKEN only needs read access to the target application; scope it narrowly rather than reusing an administrative token for a monitoring check.