🚀 gitops-platform-argocd

Production-grade Argo CD GitOps control plane — app-of-apps + ApplicationSets, multi-environment, progressive delivery with Argo Rollouts, secrets via Sealed Secrets / External Secrets Operator.

---

✨ Highlights

• 🌳 App-of-apps root + ApplicationSets for scalable multi-tenant management
• 🌐 Multi-env: dev / staging / prod via list & matrix generators
• 🚦 Progressive delivery: Argo Rollouts canary + blue-green examples with Prometheus analysis
• 🔐 Secrets: External Secrets Operator (GCP Secret Manager via Workload Identity) + Sealed Secrets
• 👥 RBAC: AppProjects scoping access, OIDC-ready
• 🔄 Drift detection + auto-heal + automated sync with retry/backoff
• 🔁 Sync waves for ordered rollout across environments
• ✅ CI gates: yamllint, kustomize build, kubeconform schema validation

---

�� Repository Layout

.
├── bootstrap/               # One-time install: Argo CD Helm values + root app-of-apps
│   ├── argocd-install.yaml
│   ├── values.yaml
│   └── root-app.yaml        # Apply once → bootstraps everything else
├── projects/                # AppProjects (RBAC scopes)
│   ├── platform.yaml        # Cluster-wide infra (ingress, observability, policy)
│   └── apps.yaml            # Tenant workloads (with developer role)
├── applicationsets/         # Scalable app generation
│   ├── projects.yaml        # Apply AppProjects from git
│   ├── platform-addons.yaml # Same addons across all envs
│   └── microservices.yaml   # Matrix: services × environments
├── apps/                    # Sample app manifests (Kustomize)
│   ├── base/
│   └── overlays/{dev,staging,prod}/
├── rollouts-examples/       # Argo Rollouts: canary + blue-green
│   ├── canary/
│   └── blue-green/
├── secrets/                 # ESO + Sealed Secrets samples
└── .github/workflows/       # CI: yamllint, kustomize, kubeconform

🚀 Bootstrap (One-Time)

# 1. Install Argo CD
helm repo add argo https://argoproj.github.io/argo-helm
helm install argocd argo/argo-cd -n argocd --create-namespace -f bootstrap/values.yaml

# 2. Apply the root app-of-apps — Argo takes over from here
kubectl apply -f bootstrap/root-app.yaml

# 3. (Optional) Login to UI
argocd login argocd.platform.example.com --sso

🌳 The App-of-Apps Pattern

flowchart LR
  Root[root Application] --> AS[ApplicationSets]
  AS --> Projects[AppProjects]
  AS --> Addons[platform-addons-{dev,staging,prod}]
  AS --> Apps[microservices: 3 svcs × 3 envs = 9 apps]
  Addons --> AddonRepo[(k8s-platform-addons repo)]
  Apps --> AppRepo[(microservices-demo-app repo)]

Loading

One root → ApplicationSets → ~15 generated Applications. Add a new service or environment → automatically rendered.

🚦 Progressive Delivery (Argo Rollouts)

Strategy	Use Case	Example
Canary (NGINX traffic split + Prometheus analysis)	Stateless web services	rollouts-examples/canary/
Blue-green (preview service + manual promote)	Risky migrations, schema changes	rollouts-examples/blue-green/

Analysis templates query Prometheus for success-rate & latency, auto-rollback on regression.

🔐 Secrets Strategy

flowchart TB
  Dev[Developer] --> Git[git commit ExternalSecret CR]
  Git --> Argo[Argo CD]
  Argo --> ESO[External Secrets Operator]
  ESO --> WI{Workload Identity}
  WI --> GSM[GCP Secret Manager]
  GSM --> K8sSecret[K8s Secret in cluster]
  K8sSecret --> Pod[Pod]

Loading

• Plain text never in git — only references
• Workload Identity — no SA keys
• Sealed Secrets as fallback for clusters without ESO

👥 RBAC Model

Project	Who	Permissions
platform	platform-admins	Cluster-wide, all resources
apps	app-developers	sync + get on apps in apps/* (no delete)

📜 License

MIT — see LICENSE.

---

Author: Kushalesh — Senior GKE Platform Engineer