GitOps

How do changes reach your cluster? If people run kube control apply from their laptops, nobody knows what is really running, and mistakes are hard to undo. Git ops fixes this, with a simple rule. Git describes the cluster, and a robot makes the cluster match it. Let's see it work for real.

• Git describes the cluster
• A robot keeps them equal
• Every change is reviewed

The GitOps loop

The idea builds on everything you learned. The desired state lives in a Git repository, as manifests, or charts. A tool running inside the cluster, such as Argo C D, or Flux, watches the repository. When a commit changes the files, the tool applies the difference. And it keeps comparing, and if someone changes the cluster by hand, the tool sees the drift, and puts it back. You get history, reviews, and rollbacks, from Git, for free. To roll back, revert a commit.

1. Commit to Gitthe desired state
2. Tool watchesArgo CD or Flux
3. Apply differencescluster matches Git
4. Undo driftmanual changes reverted

An Argo CD application

This object tells Argo C D what to deliver. The source is a Git repository, a revision, and a path inside it. The destination is this cluster, in the guestbook namespace. And the sync policy is automated. Prune means, delete things that were removed from Git. Self heal means, undo manual changes. With this one file, the guestbook app is delivered, and defended.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: guestbook
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/argoproj/argocd-example-apps.git
    targetRevision: HEAD
    path: guestbook
  destination:
    server: https://kubernetes.default.svc
    namespace: guestbook
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true

Argo CD in the cluster

Argo C D runs as a handful of pods, in its own namespace. We apply the application. After a moment, it reports synced, and the guestbook pods appear. Now watch the self healing. We scale the deployment by hand, to four replicas, behind Git's back. Argo C D notices the drift, and a few seconds later, the replica count is back to one, exactly what Git says. The cluster follows the repository.

kubectl get pods -n argocd
NAME                                                READY   STATUS    RESTARTS      AGE
argocd-application-controller-0                     1/1     Running   1 (10m ago)   4h54m
argocd-applicationset-controller-64d46967d9-2hgjj   1/1     Running   0             5m53s
argocd-dex-server-68c6ddc495-dwpv9                  1/1     Running   1 (10m ago)   4h54m
argocd-notifications-controller-56cbb77b6d-lz5mm    1/1     Running   3 (10m ago)   4h54m
argocd-redis-b898656d-qdbjx                         1/1     Running   0             5m53s
argocd-repo-server-68d48564d-z2ssn                  1/1     Running   2 (10m ago)   4h54m
argocd-server-865c8767c8-88ztg                      1/1     Running   0             5m53s
kubectl apply -f application.yaml
application.argoproj.io/guestbook created
kubectl get applications -n argocd
NAME        SYNC STATUS   HEALTH STATUS
guestbook   Synced        Healthy
kubectl -n guestbook scale deployment guestbook-ui --replicas=4
deployment.apps/guestbook-ui scaled
kubectl get deployment -n guestbook
NAME           READY   UP-TO-DATE   AVAILABLE   AGE
guestbook-ui   1/1     1            1           80s

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: guestbook
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/argoproj/argocd-example-apps.git
    targetRevision: HEAD
    path: guestbook
  destination:
    server: https://kubernetes.default.svc
    namespace: guestbook
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true

Argo CD dashboard

Argo C D also has a dashboard. The first screen lists applications, with their sync status and health. Open one, and you see a live map of everything it manages. The service, the deployment, the replica set, and each pod, with their health. It is a clear picture of what Git promised, and what is running.

Summary