Gitops Workflow

1---
2name: gitops-workflow
3description: Implement GitOps workflows with ArgoCD and Flux for automated, declarative Kubernetes deployments with continuous reconciliation. Use when implementing GitOps practices, automating Kubernetes deployments, or setting up declarative infrastructure management.
4---
5 
6# GitOps Workflow
7 
8Complete guide to implementing GitOps workflows with ArgoCD and Flux for automated Kubernetes deployments.
9 
10## Purpose
11 
12Implement declarative, Git-based continuous delivery for Kubernetes using ArgoCD or Flux CD, following OpenGitOps principles.
13 
14## Use this skill when
15 
16- Set up GitOps for Kubernetes clusters
17- Automate application deployments from Git
18- Implement progressive delivery strategies
19- Manage multi-cluster deployments
20- Configure automated sync policies
21- Set up secret management in GitOps
22 
23## Do not use this skill when
24 
25- You need a one-off manual deployment
26- You cannot manage cluster access or repo permissions
27- You are not deploying to Kubernetes
28 
29## Instructions
30 
311. Define repo layout and desired-state conventions.
322. Install ArgoCD or Flux and connect clusters.
333. Configure sync policies, environments, and promotion flow.
344. Validate rollbacks and secret handling.
35 
36## Safety
37 
38- Avoid auto-sync to production without approvals.
39- Keep secrets out of Git and use sealed or external secret managers.
40 
41## OpenGitOps Principles
42 
431. **Declarative** - Entire system described declaratively
442. **Versioned and Immutable** - Desired state stored in Git
453. **Pulled Automatically** - Software agents pull desired state
464. **Continuously Reconciled** - Agents reconcile actual vs desired state
47 
48## ArgoCD Setup
49 
50### 1. Installation
51 
52```bash
53# Create namespace
54kubectl create namespace argocd
55 
56# Install ArgoCD
57kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
58 
59# Get admin password
60kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d
61```
62 
63**Reference:** See `references/argocd-setup.md` for detailed setup
64 
65### 2. Repository Structure
66 
67```
68gitops-repo/
69├── apps/
70│   ├── production/
71│   │   ├── app1/
72│   │   │   ├── kustomization.yaml
73│   │   │   └── deployment.yaml
74│   │   └── app2/
75│   └── staging/
76├── infrastructure/
77│   ├── ingress-nginx/
78│   ├── cert-manager/
79│   └── monitoring/
80└── argocd/
81    ├── applications/
82    └── projects/
83```
84 
85### 3. Create Application
86 
87```yaml
88# argocd/applications/my-app.yaml
89apiVersion: argoproj.io/v1alpha1
90kind: Application
91metadata:
92  name: my-app
93  namespace: argocd
94spec:
95  project: default
96  source:
97    repoURL: https://github.com/org/gitops-repo
98    targetRevision: main
99    path: apps/production/my-app
100  destination:
101    server: https://kubernetes.default.svc
102    namespace: production
103  syncPolicy:
104    automated:
105      prune: true
106      selfHeal: true
107    syncOptions:
108    - CreateNamespace=true
109```
110 
111### 4. App of Apps Pattern
112 
113```yaml
114apiVersion: argoproj.io/v1alpha1
115kind: Application
116metadata:
117  name: applications
118  namespace: argocd
119spec:
120  project: default
121  source:
122    repoURL: https://github.com/org/gitops-repo
123    targetRevision: main
124    path: argocd/applications
125  destination:
126    server: https://kubernetes.default.svc
127    namespace: argocd
128  syncPolicy:
129    automated: {}
130```
131 
132## Flux CD Setup
133 
134### 1. Installation
135 
136```bash
137# Install Flux CLI
138curl -s https://fluxcd.io/install.sh | sudo bash
139 
140# Bootstrap Flux
141flux bootstrap github \
142  --owner=org \
143  --repository=gitops-repo \
144  --branch=main \
145  --path=clusters/production \
146  --personal
147```
148 
149### 2. Create GitRepository
150 
151```yaml
152apiVersion: source.toolkit.fluxcd.io/v1
153kind: GitRepository
154metadata:
155  name: my-app
156  namespace: flux-system
157spec:
158  interval: 1m
159  url: https://github.com/org/my-app
160  ref:
161    branch: main
162```
163 
164### 3. Create Kustomization
165 
166```yaml
167apiVersion: kustomize.toolkit.fluxcd.io/v1
168kind: Kustomization
169metadata:
170  name: my-app
171  namespace: flux-system
172spec:
173  interval: 5m
174  path: ./deploy
175  prune: true
176  sourceRef:
177    kind: GitRepository
178    name: my-app
179```
180 
181## Sync Policies
182 
183### Auto-Sync Configuration
184 
185**ArgoCD:**
186```yaml
187syncPolicy:
188  automated:
189    prune: true      # Delete resources not in Git
190    selfHeal: true   # Reconcile manual changes
191    allowEmpty: false
192  retry:
193    limit: 5
194    backoff:
195      duration: 5s
196      factor: 2
197      maxDuration: 3m
198```
199 
200**Flux:**
201```yaml
202spec:
203  interval: 1m
204  prune: true
205  wait: true
206  timeout: 5m
207```
208 
209**Reference:** See `references/sync-policies.md`
210 
211## Progressive Delivery
212 
213### Canary Deployment with ArgoCD Rollouts
214 
215```yaml
216apiVersion: argoproj.io/v1alpha1
217kind: Rollout
218metadata:
219  name: my-app
220spec:
221  replicas: 5
222  strategy:
223    canary:
224      steps:
225      - setWeight: 20
226      - pause: {duration: 1m}
227      - setWeight: 50
228      - pause: {duration: 2m}
229      - setWeight: 100
230```
231 
232### Blue-Green Deployment
233 
234```yaml
235strategy:
236  blueGreen:
237    activeService: my-app
238    previewService: my-app-preview
239    autoPromotionEnabled: false
240```
241 
242## Secret Management
243 
244### External Secrets Operator
245 
246```yaml
247apiVersion: external-secrets.io/v1beta1
248kind: ExternalSecret
249metadata:
250  name: db-credentials
251spec:
252  refreshInterval: 1h
253  secretStoreRef:
254    name: aws-secrets-manager
255    kind: SecretStore
256  target:
257    name: db-credentials
258  data:
259  - secretKey: password
260    remoteRef:
261      key: prod/db/password
262```
263 
264### Sealed Secrets
265 
266```bash
267# Encrypt secret
268kubeseal --format yaml < secret.yaml > sealed-secret.yaml
269 
270# Commit sealed-secret.yaml to Git
271```
272 
273## Best Practices
274 
2751. **Use separate repos or branches** for different environments
2762. **Implement RBAC** for Git repositories
2773. **Enable notifications** for sync failures
2784. **Use health checks** for custom resources
2795. **Implement approval gates** for production
2806. **Keep secrets out of Git** (use External Secrets)
2817. **Use App of Apps pattern** for organization
2828. **Tag releases** for easy rollback
2839. **Monitor sync status** with alerts
28410. **Test changes** in staging first
285 
286## Troubleshooting
287 
288**Sync failures:**
289```bash
290argocd app get my-app
291argocd app sync my-app --prune
292```
293 
294**Out of sync status:**
295```bash
296argocd app diff my-app
297argocd app sync my-app --force
298```
299 
300## Related Skills
301 
302- `k8s-manifest-generator` - For creating manifests
303- `helm-chart-scaffolding` - For packaging applications
304