Initial commit
This commit is contained in:
Zhongwei Li
285
skills/gitops-workflow/SKILL.md
Normal file
285
skills/gitops-workflow/SKILL.md
Normal file
@@ -0,0 +1,285 @@
|
||||
---
|
||||
name: gitops-workflow
|
||||
description: Implement GitOps workflows with ArgoCD and Flux for automated, declarative Kubernetes deployments with continuous reconciliation. Use when implementing GitOps practices, automating Kubernetes deployments, or setting up declarative infrastructure management.
|
||||
---
|
||||
|
||||
# GitOps Workflow
|
||||
|
||||
Complete guide to implementing GitOps workflows with ArgoCD and Flux for automated Kubernetes deployments.
|
||||
|
||||
## Purpose
|
||||
|
||||
Implement declarative, Git-based continuous delivery for Kubernetes using ArgoCD or Flux CD, following OpenGitOps principles.
|
||||
|
||||
## When to Use This Skill
|
||||
|
||||
- Set up GitOps for Kubernetes clusters
|
||||
- Automate application deployments from Git
|
||||
- Implement progressive delivery strategies
|
||||
- Manage multi-cluster deployments
|
||||
- Configure automated sync policies
|
||||
- Set up secret management in GitOps
|
||||
|
||||
## OpenGitOps Principles
|
||||
|
||||
1. **Declarative** - Entire system described declaratively
|
||||
2. **Versioned and Immutable** - Desired state stored in Git
|
||||
3. **Pulled Automatically** - Software agents pull desired state
|
||||
4. **Continuously Reconciled** - Agents reconcile actual vs desired state
|
||||
|
||||
## ArgoCD Setup
|
||||
|
||||
### 1. Installation
|
||||
|
||||
```bash
|
||||
# Create namespace
|
||||
kubectl create namespace argocd
|
||||
|
||||
# Install ArgoCD
|
||||
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
|
||||
|
||||
# Get admin password
|
||||
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d
|
||||
```
|
||||
|
||||
**Reference:** See `references/argocd-setup.md` for detailed setup
|
||||
|
||||
### 2. Repository Structure
|
||||
|
||||
```
|
||||
gitops-repo/
|
||||
├── apps/
|
||||
│ ├── production/
|
||||
│ │ ├── app1/
|
||||
│ │ │ ├── kustomization.yaml
|
||||
│ │ │ └── deployment.yaml
|
||||
│ │ └── app2/
|
||||
│ └── staging/
|
||||
├── infrastructure/
|
||||
│ ├── ingress-nginx/
|
||||
│ ├── cert-manager/
|
||||
│ └── monitoring/
|
||||
└── argocd/
|
||||
├── applications/
|
||||
└── projects/
|
||||
```
|
||||
|
||||
### 3. Create Application
|
||||
|
||||
```yaml
|
||||
# argocd/applications/my-app.yaml
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: my-app
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://github.com/org/gitops-repo
|
||||
targetRevision: main
|
||||
path: apps/production/my-app
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: production
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
```
|
||||
|
||||
### 4. App of Apps Pattern
|
||||
|
||||
```yaml
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: applications
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://github.com/org/gitops-repo
|
||||
targetRevision: main
|
||||
path: argocd/applications
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: argocd
|
||||
syncPolicy:
|
||||
automated: {}
|
||||
```
|
||||
|
||||
## Flux CD Setup
|
||||
|
||||
### 1. Installation
|
||||
|
||||
```bash
|
||||
# Install Flux CLI
|
||||
curl -s https://fluxcd.io/install.sh | sudo bash
|
||||
|
||||
# Bootstrap Flux
|
||||
flux bootstrap github \
|
||||
--owner=org \
|
||||
--repository=gitops-repo \
|
||||
--branch=main \
|
||||
--path=clusters/production \
|
||||
--personal
|
||||
```
|
||||
|
||||
### 2. Create GitRepository
|
||||
|
||||
```yaml
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: GitRepository
|
||||
metadata:
|
||||
name: my-app
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m
|
||||
url: https://github.com/org/my-app
|
||||
ref:
|
||||
branch: main
|
||||
```
|
||||
|
||||
### 3. Create Kustomization
|
||||
|
||||
```yaml
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: my-app
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 5m
|
||||
path: ./deploy
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: my-app
|
||||
```
|
||||
|
||||
## Sync Policies
|
||||
|
||||
### Auto-Sync Configuration
|
||||
|
||||
**ArgoCD:**
|
||||
```yaml
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true # Delete resources not in Git
|
||||
selfHeal: true # Reconcile manual changes
|
||||
allowEmpty: false
|
||||
retry:
|
||||
limit: 5
|
||||
backoff:
|
||||
duration: 5s
|
||||
factor: 2
|
||||
maxDuration: 3m
|
||||
```
|
||||
|
||||
**Flux:**
|
||||
```yaml
|
||||
spec:
|
||||
interval: 1m
|
||||
prune: true
|
||||
wait: true
|
||||
timeout: 5m
|
||||
```
|
||||
|
||||
**Reference:** See `references/sync-policies.md`
|
||||
|
||||
## Progressive Delivery
|
||||
|
||||
### Canary Deployment with ArgoCD Rollouts
|
||||
|
||||
```yaml
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Rollout
|
||||
metadata:
|
||||
name: my-app
|
||||
spec:
|
||||
replicas: 5
|
||||
strategy:
|
||||
canary:
|
||||
steps:
|
||||
- setWeight: 20
|
||||
- pause: {duration: 1m}
|
||||
- setWeight: 50
|
||||
- pause: {duration: 2m}
|
||||
- setWeight: 100
|
||||
```
|
||||
|
||||
### Blue-Green Deployment
|
||||
|
||||
```yaml
|
||||
strategy:
|
||||
blueGreen:
|
||||
activeService: my-app
|
||||
previewService: my-app-preview
|
||||
autoPromotionEnabled: false
|
||||
```
|
||||
|
||||
## Secret Management
|
||||
|
||||
### External Secrets Operator
|
||||
|
||||
```yaml
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: db-credentials
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: aws-secrets-manager
|
||||
kind: SecretStore
|
||||
target:
|
||||
name: db-credentials
|
||||
data:
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: prod/db/password
|
||||
```
|
||||
|
||||
### Sealed Secrets
|
||||
|
||||
```bash
|
||||
# Encrypt secret
|
||||
kubeseal --format yaml < secret.yaml > sealed-secret.yaml
|
||||
|
||||
# Commit sealed-secret.yaml to Git
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
1. **Use separate repos or branches** for different environments
|
||||
2. **Implement RBAC** for Git repositories
|
||||
3. **Enable notifications** for sync failures
|
||||
4. **Use health checks** for custom resources
|
||||
5. **Implement approval gates** for production
|
||||
6. **Keep secrets out of Git** (use External Secrets)
|
||||
7. **Use App of Apps pattern** for organization
|
||||
8. **Tag releases** for easy rollback
|
||||
9. **Monitor sync status** with alerts
|
||||
10. **Test changes** in staging first
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
**Sync failures:**
|
||||
```bash
|
||||
argocd app get my-app
|
||||
argocd app sync my-app --prune
|
||||
```
|
||||
|
||||
**Out of sync status:**
|
||||
```bash
|
||||
argocd app diff my-app
|
||||
argocd app sync my-app --force
|
||||
```
|
||||
|
||||
## Related Skills
|
||||
|
||||
- `k8s-manifest-generator` - For creating manifests
|
||||
- `helm-chart-scaffolding` - For packaging applications
|
||||
Reference in New Issue
Block a user