World K7: Self-Driving

Capstone mission 6: Hands off

You will learn: to let Argo CD run Kedai Kancil from a Git repo, so one Git change reaches the cluster with no kubectl.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

Change one line in Git and commit. Watch the cluster follow.

Git (the order board)

apps/deployment.yaml

apiVersion: apps/v1

kind: Deployment

metadata:

name: kedai-kancil

spec:

replicas: 2

# selector and template: same as before

image:

Show the whole file

apiVersion: apps/v1
kind: Deployment
metadata:
  name: kedai-kancil
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: kedai-kancil
  template:
    metadata:
      labels:
        app: kedai-kancil
    spec:
      containers:
        - name: web
          image: nginx:1.30-alpine

Commits

c7c258e Add kedai-kancilin the cluster

Cluster · namespace default

Sync: SyncedHealth: Healthy

Deployment kedai-kancil: 2/2 ready · image 1.30-alpine

Manual change (drift)

syncPolicy:
  automated:
    selfHeal: true

Show the Argo CD Application

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: kedai-kancil
  namespace: argocd
spec:
  project: default
  source:
    repoURL: "https://github.com/you/kedai-kancil.git"
    path: apps
    targetRevision: main
  destination:
    server: "https://kubernetes.default.svc"
    namespace: default
  syncPolicy:
    automated:
      selfHeal: true

Nothing to do. Git and the cluster match.

Mission 6: Hands off. Your goal: one line changed in Git reaches your cluster. No kubectl for the change. Try it here first.

Try it

Step 1: a throwaway cluster with Argo CD. Use the official manifests only. Read the “you are here” sign before every command.

Real mission

Start a fresh practice cluster with kind.
kind create cluster --name kedai
Check the sign. It must say kind-kedai.
kubectl config current-context
Make a zone for Argo CD.
kubectl create namespace argocd
Install Argo CD from its official manifest.
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
Wait until every Argo CD part is ready.
kubectl wait --for=condition=Available deployment --all -n argocd --timeout=300s

0 of 5 steps done · Your ticks are saved.

Watch

Step 2: the order board. In your kedai-kancil repo, make apps/kedai-kancil.yaml with the YAML below. Which line will you change in step 4?

apiVersion: apps/v1
kind: Deployment
metadata:
  name: kedai-kancil
spec:
  replicas: 2
  selector:
    matchLabels:
      app: kedai-kancil
  template:
    metadata:
      labels:
        app: kedai-kancil
    spec:
      containers:
        - name: web
          image: nginx:1.30-alpine

Try it

Step 3: point Argo CD at Git. Save the YAML below as argocd/application.yaml. Put your username in repoURL.

Real mission

Commit both files and push them to your public repo.
git add apps argocd && git commit -m "Add GitOps app" && git push
Hand the Application to Argo CD. This is the last change by kubectl.
kubectl apply -f argocd/application.yaml
Wait a minute. Two kedai-kancil pods appear. Reading is fine.
kubectl get deployment kedai-kancil

0 of 3 steps done · Your ticks are saved.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: kedai-kancil
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/YOUR-USERNAME/kedai-kancil.git
    path: apps
  destination:
    server: https://kubernetes.default.svc
    namespace: default
  syncPolicy:
    automated:
      selfHeal: true

Predict

You push replicas: 3. Who changes the cluster?

Try it

Step 4: the one-line change. No kubectl allowed for it.

Real mission

In apps/kedai-kancil.yaml, change replicas: 2 to replicas: 3.
Commit and push the change.
git commit -am "Scale kedai-kancil to 3" && git push
Wait up to 3 minutes. Make a cup of teh tarik.
Look, don’t touch: the Deployment now says 3/3.
kubectl get deployment kedai-kancil

0 of 4 steps done · Your ticks are saved.

Check

Let GitHub’s public API confirm your order board. Type your username, then check.

Check it on GitHub

Your Kedai Kancil repo is publicNot checked yet
It has apps/kedai-kancil.yamlNot checked yet
It has argocd/application.yamlNot checked yet

Check

The API can’t see inside your cluster. Check these yourself.

Real mission

Argo CD shows the app Synced and Healthy.
kubectl get applications -n argocd
The Deployment shows 3/3 after your commit.
You changed no replicas with kubectl.
Bonus: scale it to 1 by hand. Self-heal puts 3 back.
kubectl scale deployment kedai-kancil --replicas=1
Done? Delete the practice cluster.
kind delete cluster --name kedai

0 of 5 steps done · Your ticks are saved.

You did it!

You can now run Kedai Kancil with GitOps, hands off.

Go deeper (optional)

Where the whole food-court story breaks. Real stalls stay put, but pods move and get new names. A real manager improvises; controllers only follow the board. And the order board is code: reviewed, versioned, undoable. Safety: throwaway clusters only. Use your Mission 2 image only if its package is public.