Argo CD (GitOps)

# ===== 1) Install Argo CD =====
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Initial password
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d

# Expose for local dev
kubectl -n argocd port-forward svc/argocd-server 8080:443
# Open https://localhost:8080 -> log in as 'admin'

# CLI
brew install argocd
argocd login localhost:8080 --insecure

# ===== 2) Register your repo =====
argocd repo add https://github.com/myorg/shop-infra \
  --ssh-private-key-path ~/.ssh/id_ed25519
# Or via HTTPS with a token:
# argocd repo add https://github.com/... --username $USER --password $PAT

# ===== 3) Create an Application =====
argocd app create shop-staging \
  --repo https://github.com/myorg/shop-infra \
  --path k8s/overlays/staging \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace shop-staging \
  --sync-policy automated --auto-prune --self-heal \
  --revision main

# Now: every push to main in k8s/overlays/staging triggers a sync.

# YAML alternative (commit this so the app is also GitOps-managed)
# apps/shop-staging.yaml
# apiVersion: argoproj.io/v1alpha1
# kind: Application
# metadata:
#   name: shop-staging
#   namespace: argocd
# spec:
#   project: default
#   source:
#     repoURL: https://github.com/myorg/shop-infra
#     targetRevision: main
#     path: k8s/overlays/staging
#   destination:
#     server: https://kubernetes.default.svc
#     namespace: shop-staging
#   syncPolicy:
#     automated:
#       prune: true
#       selfHeal: true
#     syncOptions:
#       - CreateNamespace=true
#       - PruneLast=true
#       - RespectIgnoreDifferences=true

# ===== 4) App of Apps pattern =====
# One 'root' Application points at a folder of Application manifests; Argo CD
# manages the whole platform from a single bootstrap commit.

# apps/root.yaml
# apiVersion: argoproj.io/v1alpha1
# kind: Application
# metadata: { name: root, namespace: argocd }
# spec:
#   source: { repoURL: ..., targetRevision: main, path: apps }
#   destination: { server: https://kubernetes.default.svc, namespace: argocd }
#   syncPolicy: { automated: { selfHeal: true, prune: true } }

# ===== 5) Drift detection + self-heal =====
# Argo CD compares cluster state to Git every 3 min by default.
# - Drift: 'OutOfSync' status
# - selfHeal: true -> automatically re-applies Git state
# - 'Differences' tab in UI shows the YAML diff

# Manual sync
argocd app sync shop-staging
argocd app diff shop-staging
argocd app history shop-staging
argocd app rollback shop-staging <revision>

# ===== 6) Rollback =====
# git revert <commit>
# git push origin main
# Argo CD picks up the change in the next sync (or immediately on auto-sync).

# ===== 7) Helm + Argo CD =====
# spec:
#   source:
#     repoURL: https://charts.bitnami.com/bitnami
#     chart: redis
#     targetRevision: 17.0.0
#     helm:
#       values: |
#         auth:
#           password: 'strong-secret'
#         master:
#           persistence:
#             size: 10Gi

# ===== 8) Secrets =====
# DO NOT commit secrets to Git. Use:
# - sealed-secrets (Bitnami)         cluster-side decryption key
# - external-secrets operator        sync from Vault / AWS Secrets Manager
# - SOPS + KSOPS                     encrypted YAML in git, decrypted by Argo

# ===== 9) Multi-tenancy + RBAC =====
# Projects scope what apps can deploy where:
# kind: AppProject
# spec:
#   sourceRepos: ['https://github.com/myorg/shop-*']
#   destinations: [{ server: https://kubernetes.default.svc, namespace: 'shop-*' }]
#   clusterResourceWhitelist: [...]
#   roles:
#     - name: developer
#       policies:
#         - p, proj:shop:developer, applications, sync, shop/*, allow

# ===== 10) Notifications =====
# argocd-notifications watches app state and posts to Slack / Teams / webhooks.
# notify on sync failure / drift / out-of-sync.

# ===== 11) Decision matrix =====
# - GitOps for k8s clusters                          -> Argo CD or Flux
# - Argo CD                                          UI-heavy, declarative apps
# - Flux                                             pure-controllers + image automation
# - Manual kubectl apply                             do not, beyond your laptop

# ===== 12) Pitfalls =====
# - auto-sync with self-heal on critical clusters without alerting -> silent recreations
# - Committing secrets to Git
# - prune: true on shared namespaces -> deletes resources another team owns
# - Letting Argo CD itself drift from Git (bootstrap from a separate cluster)
# - Storing many environments in one branch -> deploy collisions

# GitOps — Argo CD reconciles cluster state to a git repo.