GitOps Labs

# --- install the argocd CLI ---
brew install argocd                       # macOS / Linux with Homebrew
# ...or grab the release binary (Linux amd64):
curl -sSL -o argocd https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
sudo install -m 555 argocd /usr/local/bin/argocd && rm argocd
argocd version --client

# --- get in ---
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath='{.data.password}' | base64 -d ; echo
# newer CLIs have a shortcut for the same value:
argocd admin initial-password -n argocd

kubectl -n argocd port-forward svc/argocd-server 8080:443     # leave running
argocd login localhost:8080 --username admin --insecure       # another terminal; paste that password

# guestbook.yaml — apply with: kubectl apply -f guestbook.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: guestbook
  namespace: argocd                    # Applications live beside the controller
spec:
  project: default
  source:
    repoURL: https://github.com/argoproj/argocd-example-apps.git
    targetRevision: HEAD
    path: guestbook
  destination:
    server: https://kubernetes.default.svc   # "in-cluster"
    namespace: guestbook
  syncPolicy:
    syncOptions:
      - CreateNamespace=true           # Argo creates the destination namespace

# the CLI way
argocd app set guestbook --sync-policy automated --auto-prune --self-heal

# the declarative way — this is what you would actually commit
kubectl -n argocd patch application guestbook --type merge -p \
  '{"spec":{"syncPolicy":{"automated":{"prune":true,"selfHeal":true}}}}'

# watch the loop work
kubectl -n guestbook scale deploy/guestbook-ui --replicas=5
kubectl -n guestbook get deploy guestbook-ui -w      # 5 ... 5 ... 1
argocd app get guestbook --hard-refresh              # skip the 3-minute poll

# workloads/ordered/00-migrate.yaml — a hook, not a wave: PreSync runs before everything
apiVersion: batch/v1
kind: Job
metadata:
  name: db-migrate
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded   # tidy up only if it worked
spec:
  backoffLimit: 0
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: migrate
          image: busybox:1.36
          command: ["sh","-c","echo 'applying schema 42...'; sleep 10; echo migrated"]
---
# workloads/ordered/10-config.yaml — wave -1: lands before the Deployment
apiVersion: v1
kind: ConfigMap
metadata:
  name: web-config
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
data:
  GREETING: "hello from wave -1"
---
# workloads/ordered/20-web.yaml — no annotation = wave 0, the default
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 2
  selector: { matchLabels: { app: web } }
  template:
    metadata: { labels: { app: web } }
    spec:
      containers:
        - name: web
          image: ghcr.io/stefanprodan/podinfo:6.7.0
          envFrom:
            - configMapRef: { name: web-config }
          resources:
            requests:
              cpu: 50m          # the HPA in lab 4 needs a request to compute a % against

# metrics-server on kind needs one patch (self-signed kubelet certs)
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
kubectl -n kube-system patch deploy metrics-server --type=json \
  -p='[{"op":"add","path":"/spec/template/spec/containers/0/args/-","value":"--kubelet-insecure-tls"}]'
kubectl -n kube-system rollout status deploy/metrics-server
kubectl top nodes

# add to the Application spec — BOTH halves are required
spec:
  ignoreDifferences:
    - group: apps
      kind: Deployment
      name: web
      jsonPointers:
        - /spec/replicas          # the HPA owns this field, not Git
  syncPolicy:
    automated: { prune: true, selfHeal: true }
    syncOptions:
      - RespectIgnoreDifferences=true   # without this, sync still overwrites it

# root.yaml — the only thing you apply by hand, ever
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: root
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/YOU/platform-config.git
    targetRevision: main
    path: apps                       # a folder full of Application manifests
    directory:
      recurse: true
  destination:
    server: https://kubernetes.default.svc
    namespace: argocd                # children are created here
  syncPolicy:
    automated: { prune: true, selfHeal: true }
---
# apps/guestbook.yaml — a child, committed to Git like any other manifest
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: guestbook
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io   # delete my workloads when I am deleted
spec:
  project: default
  source:
    repoURL: https://github.com/YOU/platform-config.git
    targetRevision: main
    path: workloads/web
  destination:
    server: https://kubernetes.default.svc
    namespace: guestbook
  syncPolicy:
    automated: { prune: true, selfHeal: true }
    syncOptions: [ CreateNamespace=true ]

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: payments
  namespace: argocd
spec:
  description: What the payments team is allowed to deploy
  sourceRepos:
    - https://github.com/YOU/platform-config.git      # this repo only
  destinations:
    - server: https://kubernetes.default.svc
      namespace: 'payments-*'                         # these namespaces only
  clusterResourceWhitelist: []                        # no cluster-scoped resources at all
  namespaceResourceBlacklist:
    - group: ''
      kind: ResourceQuota                             # tenants can't raise their own quota
    - group: ''
      kind: LimitRange
  roles:
    - name: read-only
      description: Tenant devs may look, and sync, but not delete
      policies:
        - p, proj:payments:read-only, applications, get, payments/*, allow
        - p, proj:payments:read-only, applications, sync, payments/*, allow

# Part A — one Application per folder under tenants/
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: tenants
  namespace: argocd
spec:
  goTemplate: true
  goTemplateOptions: ["missingkey=error"]
  generators:
    - git:
        repoURL: https://github.com/YOU/platform-config.git
        revision: main
        requeueAfterSeconds: 60          # how fast a new folder is noticed
        directories:
          - path: tenants/*
  template:
    metadata:
      name: '{{.path.basename}}'         # "payments", "search", "checkout"
    spec:
      project: default
      source:
        repoURL: https://github.com/YOU/platform-config.git
        targetRevision: main
        path: '{{.path.path}}'
      destination:
        server: https://kubernetes.default.svc
        namespace: '{{.path.basename}}'
      syncPolicy:
        automated: { prune: true, selfHeal: true }
        syncOptions: [ CreateNamespace=true ]
---
# Part B — one Application per registered cluster
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: monitoring-everywhere
  namespace: argocd
spec:
  goTemplate: true
  generators:
    - clusters: {}                       # empty selector = every cluster Argo knows
  template:
    metadata:
      name: 'agent-{{.name}}'            # agent-in-cluster, agent-edge
    spec:
      project: default
      source:
        repoURL: https://github.com/YOU/platform-config.git
        targetRevision: main
        path: workloads/web
      destination:
        server: '{{.server}}'
        namespace: platform
      syncPolicy:
        automated: { prune: true, selfHeal: true }
        syncOptions: [ CreateNamespace=true ]

# registering a second kind cluster — the 127.0.0.1 trap
kind create cluster --name edge
kind get kubeconfig --name edge --internal > /tmp/edge.kubeconfig   # docker-network address
argocd cluster add kind-edge --kubeconfig /tmp/edge.kubeconfig --name edge
argocd cluster list          # in-cluster + edge, both with a recent "successful" status

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: previews
  namespace: argocd
spec:
  goTemplate: true
  generators:
    - pullRequest:
        github:
          owner: YOU
          repo: platform-config
          # labels:                    # step 6: uncomment to pick up only PRs
          #   - preview                #   carrying the "preview" label
          tokenRef:
            secretName: gh-token
            key: token
        requeueAfterSeconds: 60
        filters:                       # filters take regexes on branch/title, not labels
          - targetBranchMatch: main    # only PRs opened against main
  template:
    metadata:
      name: 'preview-{{.number}}'
    spec:
      project: default
      source:
        repoURL: https://github.com/YOU/platform-config.git
        targetRevision: '{{.head_sha}}'      # the PR's commit, not main
        path: workloads/web
      destination:
        server: https://kubernetes.default.svc
        namespace: 'preview-{{.number}}'
      syncPolicy:
        automated: { prune: true, selfHeal: true }
        syncOptions: [ CreateNamespace=true ]

flux check --pre
flux install

flux create source git podinfo \
  --url=https://github.com/stefanprodan/podinfo \
  --branch=master --interval=1m

flux create kustomization podinfo \
  --source=GitRepository/podinfo --path="./kustomize" \
  --target-namespace=default --prune=true --interval=1m --wait=true

flux get sources git
flux get kustomizations
flux reconcile kustomization podinfo --with-source     # don't wait for the interval

# the same thing declaratively — this is what you commit
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: podinfo
  namespace: flux-system
spec:
  interval: 1m                     # Flux puts the cadence on every object
  url: https://github.com/stefanprodan/podinfo
  ref:
    branch: master
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: podinfo
  namespace: flux-system
spec:
  interval: 1m
  sourceRef: { kind: GitRepository, name: podinfo }
  path: ./kustomize
  targetNamespace: default
  prune: true                      # Flux's equivalent of Argo's prune
  wait: true                       # block until resources report Ready

apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: podinfo
  namespace: flux-system
spec:
  interval: 10m
  url: https://stefanprodan.github.io/podinfo
---
apiVersion: helm.toolkit.fluxcd.io/v2       # older Flux: v2beta2
kind: HelmRelease
metadata:
  name: podinfo-helm
  namespace: default
spec:
  interval: 1m
  chart:
    spec:
      chart: podinfo
      version: '6.*'
      sourceRef:
        kind: HelmRepository
        name: podinfo
        namespace: flux-system
  driftDetection:
    mode: enabled                # warn | enabled | disabled
    ignore:
      - paths: ["/spec/replicas"]
        target: { kind: Deployment }   # let the HPA own this field
  values:
    replicaCount: 2
    ui:
      message: "reconciled by Flux"

apiVersion: image.toolkit.fluxcd.io/v1beta2      # check `flux --version`: APIs move
kind: ImageRepository
metadata: { name: podinfo, namespace: flux-system }
spec:
  image: ghcr.io/stefanprodan/podinfo
  interval: 5m
---
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImagePolicy
metadata: { name: podinfo, namespace: flux-system }
spec:
  imageRepositoryRef: { name: podinfo }
  policy:
    semver:
      range: 6.x                                 # never jump a major by accident
---
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageUpdateAutomation
metadata: { name: podinfo, namespace: flux-system }
spec:
  interval: 1m
  sourceRef: { kind: GitRepository, name: flux-system }
  git:
    checkout:
      ref: { branch: main }
    commit:
      author:
        name: fluxcdbot
        email: fluxcdbot@users.noreply.github.com
      messageTemplate: "chore: bump {{range .Updated.Images}}{{println .}}{{end}}"
    push: { branch: main }
  update:
    path: ./clusters/dev
    strategy: Setters                            # edit only marked lines