GitOps Basics — Declarative Deployments

## 1. Declarative Configuration
The entire system is described declaratively in configuration files.
No imperative scripts or manual steps. What's in the repository is
what should be running.

## 2. Git as Single Source of Truth
Git is the authoritative source for all configuration. There is no
configuration outside of Git. If it's not in the repository, it
doesn't exist in production.

## 3. Automated Reconciliation
An operator continuously compares the desired state (Git) with the
actual state (production) and corrects any drift automatically.

## 4. Pull-Based Deployments
The cluster pulls from the repository, not the other way around.
This eliminates the need for CI/CD to have cluster credentials,
improving security.

# k8s/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dodatech-api
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: dodatech-api
  template:
    metadata:
      labels:
        app: dodatech-api
    spec:
      containers:
      - name: api
        image: dodatech/api:v3.2.0
        ports:
        - containerPort: 8080
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
        resources:
          limits:
            memory: "512Mi"
            cpu: "500m"

---
# k8s/service.yaml
apiVersion: v1
kind: Service
metadata:
  name: dodatech-api
spec:
  selector:
    app: dodatech-api
  ports:
  - port: 443
    targetPort: 8080
  type: LoadBalancer

# Install Argo CD
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Get the initial admin password
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d

# Port forward to access the UI
kubectl port-forward svc/argocd-server -n argocd 8080:443

# Login via CLI
argocd login localhost:8080 --username admin

# application.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: dodatech-api
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/dodatech/infrastructure.git
    targetRevision: main
    path: k8s/production/api
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

# Register the application
kubectl apply -f application.yaml

# Check sync status
argocd app get dodatech-api

# Sync manually (if auto-sync is off)
argocd app sync dodatech-api

# 1. Developer updates the image tag
echo 'dodatech/api:v3.3.0' > k8s/production/api/version.txt
sed -i 's|image: dodatech/api:v3.2.0|image: dodatech/api:v3.3.0|' \
  k8s/production/api/deployment.yaml

# 2. Create a pull request
git checkout -b release-v3.3.0
git add k8s/production/api/
git commit -m "Release v3.3.0: update API image to v3.3.0"
git push origin release-v3.3.0
# Create PR on GitHub → team reviews → merge to main

# 3. Argo CD detects the change (auto-sync enabled)
# It automatically applies the new deployment
# The rollout happens with zero downtime (if configured)

# 4. Monitor the rollout
argocd app wait dodatech-api --health

# 5. Rollback if needed (revert the commit)
git revert HEAD
git push origin main
# Argo CD reverts automatically

# k8s/base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - deployment.yaml
  - service.yaml

images:
  - name: dodatech/api
    newTag: v3.2.0

# k8s/overlays/production/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - ../../base

namespace: production

replicas:
  - name: dodatech-api
    count: 5

patches:
  - target:
      kind: Deployment
    patch: |-
      - op: add
        path: /spec/template/spec/containers/0/env
        value:
          - name: LOG_LEVEL
            value: info

# application-gitops.yaml
spec:
  source:
    repoURL: https://github.com/dodatech/infrastructure.git
    path: k8s/overlays/production  # Point to the overlay

# Install Flux CLI
curl -s https://fluxcd.io/install.sh | sudo bash

# Bootstrap Flux
flux bootstrap github \
  --owner=dodatech \
  --repository=infrastructure \
  --branch=main \
  --path=./clusters/production

# Add a source (where config lives)
flux create source git dodatech-api \
  --url=https://github.com/dodatech/infrastructure \
  --branch=main

# Create a kustomization
flux create kustomization dodatech-api \
  --source=dodatech-api \
  --path="./k8s/production/api" \
  --prune=true \
  --interval=5m

# Simulate drift (manual kubectl edit)
kubectl edit deployment dodatech-api -n production
# Change replicas from 3 to 2

# Argo CD detects the drift and self-heals
$ argocd app get dodatech-api
...
Sync Status:        OutOfSync  # ← detected drift

# Within seconds, Argo CD reverts back to 3 replicas
$ kubectl get deployment dodatech-api -n production
NAME            READY   UP-TO-DATE   AVAILABLE   AGE
dodatech-api    3/3     3            3           5m

# Traditional CI/CD (push-based) — cluster credentials exposed
# .github/workflows/deploy.yaml
- name: Deploy to Kubernetes
  run: |
    kubectl apply -f k8s/  # Needs KUBECONFIG secret
    # Risk: any code change can access the cluster

# GitOps (pull-based) — no credentials in CI
# .github/workflows/deploy.yaml
- name: Update config
  run: |
    git add k8s/
    git commit -m "Update configuration"
    git push
  # CI only needs Git push permission, not cluster access