GitOps and Kubernetes: A Practical Guide to Modern Deployment

# Add ArgoCD Helm repository# Create namespace# Create namespace# Create namespace# Create namespace# Create namespace# Install ArgoCD with HA configuration# Get initial admin password# Get initial admin password# Get initial admin password# Get initial admin password# Get initial admin password# Get initial admin password# Get initial admin password# Get initial admin password# Get initial admin password# Get initial admin password# Get initial admin passwordt initial admin password
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default
  source:
    repoURL: https://github.com/org/gitops-repo.git
    targetRevision: main
    path: apps/my-app/overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground
      - PruneLast=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: my-app-environments
  namespace: argocd
spec:
  generators:
    - list:
        elements:
          - cluster: dev
            url: https://dev-cluster.example.com
            namespace: dev
          - cluster: staging
            url: https://staging-cluster.example.com
            namespace: staging
          - cluster: production
            url: https://prod-cluster.example.com
            namespace: production
  template:
    metadata:
      name: 'my-app-{{cluster}}'
    spec:
      project: default
      source:
        repoURL: https://github.com/org/gitops-repo.git
        targetRevision: main
        path: 'apps/my-app/overlays/{{cluster}}'
      destination:
        server: '{{url}}'
        namespace: '{{namespace}}'
      syncPolicy:
        automated:
          prune: true
          selfHeal: true

# Install Flux CLI# Check prerequisites# Check prerequisites# Bootstrap Flux with GitHub# Bootstrap Flux with GitHub# Verify installation# Verify installation# Verify installation# Verify installation# Verify installation# Verify installation# Verify installation installation
flux check

apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: my-app
  namespace: flux-system
spec:
  interval: 1m
  url: https://github.com/org/my-app.git
  ref:
    branch: main
  secretRef:
    name: github-credentials
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: my-app
  namespace: flux-system
spec:
  interval: 10m
  targetNamespace: production
  sourceRef:
    kind: GitRepository
    name: my-app
  path: ./deploy/overlays/production
  prune: true
  healthChecks:
    - apiVersion: apps/v1
      kind: Deployment
      name: my-app
      namespace: production
  timeout: 2m

# Image repository to scan# Policy for selecting image tags# Policy for selecting image tags# Policy for selecting image tags# Policy for selecting image tags# Policy for selecting image tags# Policy for selecting image tags# Policy for selecting image tags# Automation to update Git# Automation to update Git# Automation to update Git# Automation to update Git# Automation to update Git# Automation to update Git# Automation to update Git# Automation to update Git# Automation to update Git update Git
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageUpdateAutomation
metadata:
  name: my-app
  namespace: flux-system
spec:
  interval: 30m
  sourceRef:
    kind: GitRepository
    name: fleet-infra
  git:
    checkout:
      ref:
        branch: main
    commit:
      author:
        email: flux@example.com
        name: Flux
      messageTemplate: 'Update {{.AutomationObject.Name}} to {{.NewTag}}'
    push:
      branch: main
  update:
    path: ./clusters/production
    strategy: Setters

gitops-repo/
├── apps/
│   ├── my-app/
│   │   ├── base/
│   │   │   ├── kustomization.yaml
│   │   │   ├── deployment.yaml
│   │   │   ├── service.yaml
│   │   │   └── configmap.yaml
│   │   └── overlays/
│   │       ├── dev/
│   │       │   ├── kustomization.yaml
│   │       │   └── patches/
│   │       │       └── replicas.yaml
│   │       ├── staging/
│   │       │   ├── kustomization.yaml
│   │       │   └── patches/
│   │       └── production/
│   │           ├── kustomization.yaml
│   │           └── patches/
│   │               ├── replicas.yaml
│   │               └── resources.yaml
│   └── another-app/
│       └── ...
├── infrastructure/
│   ├── controllers/
│   │   ├── ingress-nginx/
│   │   ├── cert-manager/
│   │   └── external-secrets/
│   └── configs/
│       ├── cluster-issuer.yaml
│       └── external-secrets-store.yaml
├── clusters/
│   ├── dev/
│   │   ├── apps.yaml
│   │   └── infrastructure.yaml
│   ├── staging/
│   └── production/
└── README.md

# apps/my-app/base/kustomization.yaml# apps/my-app/overlays/production/kustomization.yaml# apps/my-app/overlays/production/kustomization.yaml# apps/my-app/overlays/production/kustomization.yaml# apps/my-app/overlays/production/kustomization.yaml# apps/my-app/overlays/production/kustomization.yamlkustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: production
resources:
  - ../../base
patches:
  - path: patches/replicas.yaml
  - path: patches/resources.yaml
configMapGenerator:
  - name: my-app-config
    behavior: merge
    literals:
      - LOG_LEVEL=warn
      - ENVIRONMENT=production
images:
  - name: my-app
    newName: ghcr.io/org/my-app
    newTag: v1.2.3

# Install Sealed Secrets controller# Create a sealed secret# Create a sealed secret# Create a sealed secret# Create a sealed secret# Create a sealed secret# Create a sealed secret# Create a sealed secret# The sealed secret can be safely committed to Git# The sealed secret can be safely committed to Git# The sealed secret can be safely committed to Git# The sealed secret can be safely committed to Git# The sealed secret can be safely committed to Git# The sealed secret can be safely committed to Gitted to Git
cat sealed-secret.yaml

# Install External Secrets Operator# Configure ClusterSecretStore for AWS Secrets Manager# Configure ClusterSecretStore for AWS Secrets Manager# Configure ClusterSecretStore for AWS Secrets Manager# Configure ClusterSecretStore for AWS Secrets Manager# ExternalSecret that syncs from AWS# ExternalSecret that syncs from AWS# ExternalSecret that syncs from AWS# ExternalSecret that syncs from AWS# ExternalSecret that syncs from AWS# ExternalSecret that syncs from AWS# ExternalSecret that syncs from AWS# ExternalSecret that syncs from AWS# ExternalSecret that syncs from AWS# ExternalSecret that syncs from AWSlSecret that syncs from AWS
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: my-app-secrets
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: aws-secrets-manager
  target:
    name: my-app-secrets
    creationPolicy: Owner
  data:
    - secretKey: database-password
      remoteRef:
        key: production/my-app
        property: database-password
    - secretKey: api-key
      remoteRef:
        key: production/my-app
        property: api-key

# Install SOPS# Generate age key# Generate age key# Create .sops.yaml configuration# Encrypt a secret# Encrypt a secret# Encrypt a secret# Encrypt a secret# Encrypt a secret# Encrypt a secret# Encrypt a secret# Encrypt a secret# Encrypt a secret# Encrypt a secret# Encrypt a secret# Encrypt a secret# Decrypt (for ArgoCD or Flux)# Decrypt (for ArgoCD or Flux)# Decrypt (for ArgoCD or Flux)# Configure decryption key in clusterter
kubectl create secret generic sops-age \
  --namespace=argocd \
  --from-file=age.key