gitops

name	gitops
description	Operational framework using Git as single source of truth for declarative infrastructure and applications
category	devops

GitOps

What I Do

I provide a framework for declarative infrastructure and application management using Git as the single source of truth. All changes are version-controlled, enabling review processes, rollbacks, and audit trails for infrastructure and deployments.

When to Use Me

• Managing Kubernetes clusters declaratively
• Implementing infrastructure version control
• Enabling git-based deployment approvals
• Maintaining audit trails for changes
• Standardizing deployment procedures
• Implementing progressive delivery
• Multi-environment configuration management

Core Concepts

• Declarative Desired State: Define infrastructure in code
• Git as Source of Truth: Single authoritative configuration
• Continuous Reconciliation: Operators enforce desired state
• Pull-based Deployments: Cluster pulls updates from Git
• Immutable Artifacts: Container images, Helm charts
• Diff and Sync: Comparing current vs. desired state
• Prerequisites: What's needed before applying changes
• Drift Detection: Identifying unauthorized changes
• Health Checks: Verifying system health after changes
• Audit Trail: Complete history of changes in Git

Code Examples

ArgoCD Application (YAML):

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: production-app
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: production
  source:
    repoURL: https://github.com/org/config-repo.git
    targetRevision: main
    path: applications/my-app/overlays/production
    kustomize:
      images:
        - myapp=registry.io/myapp:v2.3.1
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground
      - PruneLast=true
    retry:
      limit: 5
      backoff:
        duration: 5s
         
         
  
    
     
    
       
   

FluxCD Kustomization (YAML):

apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
  name: apps-production
  namespace: flux-system
spec:
  interval: 10m0s
  path: ./clusters/production/apps
  prune: true
  wait: true
  timeout: 5m0s
  retryInterval: 2m0s
  sourceRef:
    kind: GitRepository
    name: flux-system
  decryption:
    provider: sops
    secretRef:
      name: sops-gpg
  postBuild:
    substitute:
      REPLICA_COUNT: "3"
      MEMORY_LIMIT: "2Gi"
    substituteFrom:
    - kind: ConfigMap
      name: cluster-config
    - kind: Secret
      name: image-credentials
  healthChecks:
  - apiVersion: apps/v1
    kind: 
     
     
    
     
     
     
    
     
     
     

GitOps Workflow with Kustomize:

# clusters/base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - ../../base/deployment.yaml
  - ../../base/service.yaml
  - ../../base/hpa.yaml

namespace: default

commonLabels:
  app.kubernetes.io/part-of: myapp

images:
  - name: myapp
    newName: registry.io/myapp
    newTag: v1.0.0

configMapGenerator:
- files:
  - config.yaml
  name: app-config

secretGenerator:
- literals:
  - DATABASE_PASSWORD=changeme
  name: app-secrets
  type: Opaque

---
# clusters/production/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

bases:
  - ../../base

patches:
  - path: replicas-patch.yaml
    


    
     


  
  
     
     
    


  
   
  
   
  
   

Pull Request for GitOps Change:

## Summary
Increases API service replicas from 5 to 10 to handle projected traffic growth.

## Changes
- `clusters/production/kustomization.yaml`: Update replica count
- `clusters/production/replicas-patch.yaml`: Add API service scaling

## Verification
- [x] Tested locally with `kustomize build`
- [x] Diff reviewed in PR
- [x] Automated tests pass
- [x] Security scan completed

## Rollback Plan
- Revert this PR to roll back
- Estimated rollback time: 2 minutes

## Approval
Required: 2 approvers from Platform team
Labels: gitops/approved, deployment/pending

GitOps Change Pipeline:

# .github/workflows/gitops-sync.yaml
name: GitOps Sync

on:
  pull_request:
    paths:
      - 'clusters/**'
      - 'applications/**'
  push:
    branches:
      - main
    paths:
      - 'clusters/**'
      - 'applications/**'

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      
      - name: Setup Kustomize
        uses: imranismail/setup-kustomize@v1
      
      - name: Validate Kustomize
        run: |
          for cluster in clusters/*/; do
            echo "Validating $cluster"
            kustomize build "$cluster" > /dev/null
          done
      
      - name: Check Drift
        uses: stefanprodan/gitops-toolkit@v1
        with:
          action: drift-detect
           
           
      
         
           
         
        
           
  
     
           
     
    
        
      
          
         
        
             
             
           
      
          
         
        
           

Best Practices

1. Use branch strategies - Environment-specific branches (main, staging)
2. Implement code review - All changes through PRs
3. Enforce required reviewers - Platform team approval
4. Use immutable tags - Never use mutable image tags
5. Enable auto-sync - Continuous reconciliation
6. Implement drift detection - Alert on unauthorized changes
7. Use secrets management - External secrets, Vault, SOPS
8. Set resource quotas - Prevent resource exhaustion
9. Monitor sync status - Track reconciliation health
10. Test changes locally - Validate before pushing