ArgoCD

Full ArgoCD Application lifecycle — sync, rollback, delete, create, repositories — entirely through the Kubernetes API. No ArgoCD API server access needed.

What you can see​

Via the Kind selector (Cmd/Ctrl + K):

• Application — ArgoCD Applications
• AppProject — Projects
• ApplicationSet — ApplicationSets
• Repositories — a virtual kind that lists repo Secrets (labeled argocd.argoproj.io/secret-type: repository)

The Applications table includes custom columns: NAME, SYNC, HEALTH, REPO, PATH, REVISION, AGE.

Application page​

Open an Application (double-click, or right-click → Info) and it opens as an in-workspace page in the central panel — not a floating window. Every other resource kind still opens as a floating Info window; the page model is enabled for Applications only.

The page has a compact two-row header:

1. ← Applications / <name>, the kind/namespace/age metadata, and the actions Sync, Refresh, Diagnose, YAML, ⋮
2. APP HEALTH · SYNC STATUS (with the target branch, the live revision, and an auto-sync marker when syncPolicy.automated is set) · LAST SYNC (outcome, revision, relative time, initiator — hover a failure for the operation message)
3. A button row — Details · Sync Status · History · Diff — with the view toggle, the managed-resource count, the tree's load time and a reload button on the right. On a narrow window the load time drops first, then the count shortens; the buttons scroll rather than losing the trailing entry.

The page itself has no tabs: the resource view fills it, and every detail surface opens over it. Details slides in a right-hand drawer with Summary · Parameters · Manifest · Events · History · Sync; Sync Status and History open the same drawer on their tab. The drawer is resizable, closes with Esc or ×, and never takes the tree below 360px — on a window too narrow for both it declines to open and says so rather than reducing the page to a sliver.

The view toggle switches the canvas between the resource tree and a list of the same managed resources. Switching does not re-seed: the tree's camera and expansions are exactly where you left them when you switch back.

Tree​

The page's default view: the Application's resource tree, laid out left-to-right by ownership depth — Application → Deployment → ReplicaSet → Pod, with Services, ConfigMaps, Secrets, PVCs and Certificates hanging off the root.

• Resource cards show the kind icon, name, kind and a health glyph.
• Parents connect to their children through shared orthogonal trunks. Secondary relations (a Service selecting a Pod, a Pod mounting a PVC) appear as dashed lines when you select one of their endpoints — select a node to see what else touches it. They are not drawn otherwise, because a permanently visible set of them is an untraceable haze rather than information.
• Selecting a node highlights its ancestor chain and direct children.
• Right-click a card for that resource's own actions — Info, and for Pods Shell and Logs. Info opens the resource in the Details drawer beside the tree, so the tree keeps its camera and expansions while you read; ← in the drawer returns to the application, Esc steps back one level at a time (resource → application → closed).
• Floating toolbar: Fit view, zoom out/in with the current percentage, and Legend & filters (collapsed by default).
• The tree is a snapshot taken when it was seeded. The header shows when, and warns as soon as the Application changes underneath it — press the reload button to reseed. Syncs and refreshes started from the page reseed it automatically.
• Pressing the reload button also removes resources that no longer exist. Surviving nodes flow back together to close the gap, and the camera stays where you left it. Removal happens only on a reload you pressed: a sync refreshes the tree but leaves it whole, because mid- rollout is exactly when the picture is most confusing.
• Removal is conservative by design, and there are three cases where a node deliberately stays:
  • The listing did not finish. If a resource type cannot be listed in full — no permission, a listing error, a timeout, an expired continue token — that type is skipped entirely for that namespace. "Absent from the list" only means "gone" when the list was read to the end.
  • ArgoCD still declares it. Anything in the Application's status.resources stays on screen even when the cluster no longer has it, and renders with the Missing status — ArgoCD's own verdict, shown the way ArgoCD shows it. It disappears once the controller drops the entry.
  • It is not one of the listed types. Only the eager workload chain is listed: ReplicaSets, Jobs, Pods and EndpointSlices. Secrets are never listed or reconciled — that would issue a namespace-wide LIST secrets and the audit event that comes with it, which the tree avoids on purpose.
• Switching cluster or context closes the Application page and its tree.

A resource opened this way gets its usual per-kind tabs — for a Pod, Overview · Containers · Volumes · Conditions · Events. Logs and Shell still open their own windows rather than becoming drawer tabs, so a terminal and the tree can be on screen together.

Two limits worth knowing: links inside the drawer (an owner reference, a bound PVC) open a floating Info window rather than replacing the drawer's contents, and a resource you lack permission to read says so instead of sitting on "Loading…".

The tree is derived entirely from the Kubernetes API: status.resources gives the top level, and ownerReferences give the workload chain below it. Two consequences:

• Applications whose destination is another cluster render from ArgoCD's recorded status only. No live resource data is fetched and per-resource actions are disabled, because resolving those objects by name against this cluster would show a different cluster's resource.
• Secret objects are never fetched — the tree shows them from ArgoCD's status metadata, so browsing an Application issues no get against a Secret. That is not the same as "no credentials on screen": the Application CR itself routinely carries them in spec.source.helm.parameters / values and spec.source.plugin.env, and the Parameters and Manifest drawer tabs and the YAML view all show those in full (see below).

Parameters​

(In the Details drawer.) The Helm overrides this Application declares — parameters, fileParameters and valueFiles as rows, and inline values / valuesObject as a YAML block. Multi-source Applications get one section per source, so two sources overriding the same key stay distinguishable.

Two things to know:

• Values are shown in full, in the clear. Helm parameters routinely carry credentials (database passwords, API tokens, Django secret keys). This matches ArgoCD's own Parameters panel and reflects that anyone who can read the Application can already read these values — through the YAML view here, through kubectl get application -o yaml, or through ArgoCD. Treat a screen share, a screenshot or a feedback attachment taken on this tab as carrying live credentials.
• Chart default values are not shown. ArgoCD lists them too, because its repo-server clones and renders the chart using the repository credentials. Kubezilla talks only to the Kubernetes API, so it can show what the Application declares and not what the chart defaults to. A shorter list than ArgoCD's is expected, not missing data.

Manifest​

(In the Details drawer, and in the floating Info window's tab strip.) The Application's spec as read-only YAML — project, source, destination, syncPolicy. Deliberately the spec only, matching ArgoCD's own MANIFEST tab; the YAML button in the header shows the whole live object instead, with folding, search and editing.

Note that spec includes source.helm.*, so the same plaintext values described under Parameters appear here too.

Diff​

Compares the live state of each OutOfSync resource against ArgoCD's recorded desired state. Two things to know:

• It is approximate, and the window says so. ArgoCD diffs against manifests its repo-server renders from git; Kubezilla has no repo-server, so it compares against what ArgoCD wrote into status. Close, but not the same thing.
• Secret values are redacted. Keys are shown, values are <redacted>, including the copy that lives in the last-applied-configuration annotation. If redaction cannot be applied the contents are withheld rather than shown.

On a fully Synced application the window opens and says there is nothing to compare, rather than the button appearing to do nothing.

Events​

(In the Details drawer.) Kubernetes events for the Application object itself — sync outcomes (OperationCompleted), comparison errors, and controller warnings. Polled every ~10 seconds while the tab is open; it starts polling the first time you select it, so an Application you never open Events on costs nothing.

If your identity lacks list on events in the Application's namespace, the failure appears in the error banner rather than as an empty tab. Events refresh while the Application page is the visible one; drilling into a child resource pauses the poll until you come back.

Overview​

• Sync status, Health status (color-coded badges).
• Source repo, path, target revision, destination cluster/namespace.
• Container images summary across managed resources.
• Clickable URLs — auto-extracted from managed Ingress, IngressRoute, and Gateway API resources.
• Deployment history snapshot.

Resources​

Every Kubernetes resource managed by this Application, with:

• Real-time health updates via WebSocket watcher.
• Action buttons: Logs, Restart, Shell, Delete.
• Clickable resource names that open their Info.

History​

Revision timeline. Each entry can be:

• Diffed against another revision (side-by-side).
• Rolled back to — creates a sync targeting that revision.

Sync​

Sync tooling:

• Sync — normal sync.
• Dry-run Sync — shows what would change without applying.
• Prune / Force / Replace options per run.

Context menu actions​

Right-click any Application:

Action	Effect
Sync	Triggers a sync by patching the Application's operation field. Pruning is off — matching argocd app sync, which also does not prune unless asked
Dry-run Sync	Plan-only sync
Hard Refresh	argocd.argoproj.io/refresh: hard annotation
Normal Refresh	argocd.argoproj.io/refresh: normal annotation
Suspend Auto-Sync	Turns off syncPolicy.automated, remembering prune/self-heal
Resume Auto-Sync	Re-enables it with the remembered values — the menu row states them (prune: on/off) before you click
Diff OutOfSync	Opens diff of live vs desired for out-of-sync resources
Rollback	Via History tab
Delete (cascade)	Finalizer set — removes all managed resources
Delete (non-cascade / orphan)	Removes the Application only, leaves resources

On the Application page these actions live on the header (Sync, Refresh) and in its ⋮ menu (Dry run, Hard refresh, Terminate sync, Suspend/Resume, Delete). Two differences from the list context menu:

• Delete opens a confirmation naming the Application and its managed-resource count, with cascade as an explicit checkbox (default: off).
• Every page action targets the Application the page was opened for, even if you have since navigated the main window to a different kind or namespace.

Creating an Application​

From Dots menu → Create Application (shown when ArgoCD is the current kind):

Form fields:

• Name
• Namespace — usually argocd
• Project — defaults to default
• Source: Repository URL, Path, Target Revision (branch/tag/commit).
• Destination: Cluster server URL, Namespace.
• Sync policy: Automated (toggle), Prune (toggle), Self-heal (toggle), Allow-empty (toggle).
• Sync options (multi-select): CreateNamespace=true, ApplyOutOfSyncOnly=true, etc.

Click Create — the Application manifest is applied via server-side apply.

Repositories​

The virtual Repositories kind lists Secrets labeled as ArgoCD repositories.

Columns: NAME, TYPE, URL, PROJECT, CONNECTION STATE.

Adding a repository​

From the Repositories list → Add Repository:

Source type	Fields
Git (HTTPS)	URL, username, password / token
Git (SSH)	URL, SSH private key, optional known-hosts
Helm	URL, optional username/password
OCI	URL, optional credentials

Also:

• TLS verify / Insecure skip verify.
• Enable LFS (Git only).
• Project — scope the repo to a Project or leave blank for global.

Saving writes a Secret with the appropriate ArgoCD labels and annotations.

Real-time health​

Each managed resource in an Application's Resources tab has a WebSocket watch running — you'll see health badges flip in real time as pods come up or go down.

Tips​

• Can't see Applications? — ArgoCD installs the CRDs into whatever namespace the controller runs in (usually argocd). Switch namespace or use All namespaces.
• URLs missing from Overview? — Kubezilla auto-detects them from Ingress, Traefik IngressRoute, and Gateway API HTTPRoute. If your app uses something exotic (Istio VirtualService, etc.), they won't be picked up.
• Delete didn't remove resources? — you chose non-cascade delete. Re-delete with cascade, or clean up manually.
• Sync says "Unknown"? — ArgoCD controller may be paused or unreachable. Check the argocd-application-controller pod.
• Tree looks out of date? — it is a snapshot; the header says when it was taken and warns when the Application has changed since. Press reload.
• Tree shows no resources? — the header explains why when ArgoCD says so (repo unreachable, comparison error, project restriction). The Overview tab has the full conditions.
• Card actions greyed out? — the Application's destination is another cluster (or ArgoCD does not name one), so Kubezilla shows status only rather than acting on same-named objects in the cluster you are connected to.

Limits​

Kubezilla talks to the Kubernetes API only — it never needs ArgoCD API server credentials. Two things follow from that:

• Diff is approximate. A true desired-vs-live diff needs the manifests ArgoCD's repo-server renders from git; those are not in the Application object. Kubezilla diffs the live state of out-of-sync resources instead.
• Authorization is Kubernetes RBAC, not ArgoCD RBAC. Actions are permitted by your kubeconfig identity's rights on the Application object; ArgoCD's own argocd-rbac-cm policy is not consulted, and its audit trail records the initiator Kubezilla sends.