project
Argo CD is an open-source GitOps continuous delivery tool for Kubernetes that syncs cluster state to match manifests stored in Git repositories.
No evidence-backed relationships are recorded.
Argo CD 3.5 puts mutual TLS in front of its repo-server by default, closing the unauthenticated path a July 2026 Kustomize flaw used to run commands. Clusters without their own certificates get it on upgrade, so older GitOps installs should take 3.5 as a security patch.
Reality
k8s-secure-supply-chain, a kind-based reference build, uses five Kyverno checks to refuse at admission any image that CI did not sign and attest. Its author argues that CI scans and signatures stay advisory until the cluster enforces them.
Reality
NVIDIA has open-sourced the host configuration controller it ran internally as Skyhook. Its interruption budget and non-interrupt pod labels are the two fields that set how long a fleet-wide kernel change takes.
Reality
Apache Storm ships no maintained Helm chart and no migration guide, so one team wrote its own templates for EKS. The first thing that broke was a StorageClass name, and the only symptom was an init container log line.
Reality
Akuity's Agentic Control Plane authenticates each agent request as a named engineer and carries that person's existing permissions across every cluster it manages, with a policy layer above that can still block production actions.
Reality
The GitOps tooling worked, and seven services still went back to Docker Compose in a day, because the operator consumes every one of those images and cuts release tags for none of them.
Reality
A k3s workload moved to Amazon EKS without an application code change, and the three things that had to be fixed were the control plane endpoint policy, the instance type AWS would allow, and the credential doing the work.
Reality
A dev.to write-up prints the ClusterRole that gives an operator four write verbs on mutating webhook configurations, then the two manifest lines that make the resulting persistence read as a healthy cluster.
Reality
A dev.to writeup lays out per-account EKS clusters, digest-only promotion and OIDC everywhere. The metric-backed gate it calls critical is the thinnest part of the design.
Reality
A clean sync, a green dashboard, and ninety seconds later real 500s. One team's rewrite moves the health verdict out of Argo CD and into Rollouts, gated on Prometheus error rate and p99.
Reality
One team's write-up: four groups did valid local work, deploy state said done, and nothing in the pipeline asked whether an invoice could still be rendered.
Reality
Flux Mirror ships as a v2.9 CLI plugin that copies images, charts and desired-state artifacts from a config file. The Bitnami catalogue freeze is the argument for using it.
Reality
A CNCF blog account reports a self-upgrading K3s control plane on Kairos with etcd quorum intact. The instructive part is that both bugs were in the automation, not the OS.
Reality