## GitOps Without Borders: Running Argo CD Across Isolated Security Domains with Rafay’s Zero-Trust Kubectl

Modern enterprises rarely run applications in a single cluster. A production fleet might include on-prem clusters in Singapore and London, a regulated environment in AWS us-east-1, and a developer sandbox in someone’s laptop. **GitOps with Argo CD** is the natural way to keep all those clusters in the desired state—but the moment clusters live in different _security domains_ (fire-walled data centers, private VPCs, or even air-gapped networks) the simple `argocd cluster add` story breaks down:

- Bespoke bastion hosts or VPN tunnels for every hop  
- Long-lived bearer-token Secrets stashed in Argo’s namespace  
- High latency between the GitOps engine and far-flung clusters, turning reconciliations into a slog

**Rafay’s Zero-Trust Kubectl Access (ZTKA)** solves all three problems in one stroke. By front-loading the connection with a hardened **Kube API Access Proxy**—and issuing _just-in-time_ (JIT), short-lived ServiceAccounts inside every cluster.

> In this blog, we will describe how Rafay Zero Trust Kubectl Access Proxy gives Argo CD a secure path to every cluster in the fleet, even when those clusters sit deep behind corporate firewalls.

## Understanding ArgoCD Reconciliation: How It Works, Why It Matters, and Best Practices

[ArgoCD](https://argo-cd.readthedocs.io/en/stable/) is a powerful GitOps controller for Kubernetes, enabling declarative configuration and automated synchronization of workloads. One of its core functions is **reconciliation**, a continuous process by which ArgoCD ensures that the live state of a Kubernetes cluster matches the desired state defined in a Git repository.

While this might sound straightforward, reconciliation plays a critical role in the GitOps lifecycle, and its default behavior can be surprisingly aggressive. In this blog post, we’ll explore:

- What reconciliation in ArgoCD actually does  
- Why it exists and how it ensures cluster integrity  
- The pitfalls of the default timer  
- Best practices for tuning reconciliation to balance responsiveness and resource efficiency

Info  
In a related [**blog**](https://docs.rafay.co/blog/2025/08/05/drift-prevention-vs-detection-does-a-polling-approach-make-sense-at-scale/), we describe how customers using Rafay are able to **Block Drift** in the first place.