使用ArgoCD和Flux实现GitOps工作流的完整指南用于自动化Kubernetes部署。下载地址Skill源码下载地址agentic-awesome-skills/skills/gitops-workflow at main · sickn33/agentic-awesome-skills · GitHub技能概述gitops-workflow 技能是一个用于实现GitOps工作流的技能使用ArgoCD或Flux CD进行声明式、基于Git的持续交付。它遵循OpenGitOps原则帮助团队实现自动化Kubernetes部署、渐进式交付策略和多集群管理。主要功能ArgoCD部署安装、配置和管理ArgoCDFlux CD部署Bootstrap和配置Flux自动同步策略配置自动同步、自愈和修剪渐进式交付Canary和Blue-Green部署策略密钥管理External Secrets和Sealed Secrets多集群管理App of Apps模式和多环境配置触发条件在以下情况下应该调用此技能:为Kubernetes集群设置GitOps从Git自动化应用部署实现渐进式交付策略管理多集群部署配置自动同步策略在GitOps中设置密钥管理OpenGitOps原则声明式- 整个系统以声明方式描述版本化和不可变- 期望状态存储在Git中自动拉取- 软件代理自动拉取期望状态持续协调- 代理持续协调实际状态与期望状态ArgoCD设置1. 安装# 创建命名空间kubectl create namespace argocd# 安装ArgoCDkubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml# 获取管理员密码kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath{.data.password} | base64 -d2. 仓库结构gitops-repo/├── apps/│ ├── production/│ │ ├── app1/│ │ │ ├── kustomization.yaml│ │ │ └── deployment.yaml│ │ └── app2/│ └── staging/├── infrastructure/│ ├── ingress-nginx/│ ├── cert-manager/│ └── monitoring/└── argocd/├── applications/└── projects/3. 创建ApplicationapiVersion: argoproj.io/v1alpha1kind: Applicationmetadata:name: my-appnamespace: argocdspec:project: defaultsource:repoURL: https://github.com/org/gitops-repotargetRevision: mainpath: apps/production/my-appdestination:server: https://kubernetes.default.svcnamespace: productionsyncPolicy:automated:prune: trueselfHeal: truesyncOptions:- CreateNamespacetrue4. App of Apps模式apiVersion: argoproj.io/v1alpha1kind: Applicationmetadata:name: applicationsnamespace: argocdspec:project: defaultsource:repoURL: https://github.com/org/gitops-repotargetRevision: mainpath: argocd/applicationsdestination:server: https://kubernetes.default.svcnamespace: argocdsyncPolicy:automated: {}Flux CD设置1. 安装# 安装Flux CLIcurl -s https://fluxcd.io/install.sh | sudo bash# Bootstrap Fluxflux bootstrap github \--ownerorg \--repositorygitops-repo \--branchmain \--pathclusters/production \--personal2. 创建GitRepositoryapiVersion: source.toolkit.fluxcd.io/v1kind: GitRepositorymetadata:name: my-appnamespace: flux-systemspec:interval: 1murl: https://github.com/org/my-appref:branch: main3. 创建KustomizationapiVersion: kustomize.toolkit.fluxcd.io/v1kind: Kustomizationmetadata:name: my-appnamespace: flux-systemspec:interval: 5mpath: ./deployprune: truesourceRef:kind: GitRepositoryname: my-app同步策略ArgoCD自动同步syncPolicy:automated:prune: true # 删除Git中不存在的资源selfHeal: true # 协调手动更改allowEmpty: falseretry:limit: 5backoff:duration: 5sfactor: 2maxDuration: 3m渐进式交付Canary部署apiVersion: argoproj.io/v1alpha1kind: Rolloutmetadata:name: my-appspec:replicas: 5strategy:canary:steps:- setWeight: 20- pause: { duration: 1m }- setWeight: 50- pause: { duration: 2m }- setWeight: 100Blue-Green部署strategy:blueGreen:activeService: my-apppreviewService: my-app-previewautoPromotionEnabled: false密钥管理External Secrets OperatorapiVersion: external-secrets.io/v1beta1kind: ExternalSecretmetadata:name: db-credentialsspec:refreshInterval: 1hsecretStoreRef:name: aws-secrets-managerkind: SecretStoretarget:name: db-credentialsdata:- secretKey: passwordremoteRef:key: prod/db/passwordSealed Secrets# 加密密钥kubeseal --format yaml secret.yaml sealed-secret.yaml# 将sealed-secret.yaml提交到Git最佳实践分离环境- 为不同环境使用单独的仓库或分支实现RBAC- 为Git仓库配置访问控制启用通知- 为同步失败配置告警使用健康检查- 为自定义资源配置健康检查实施审批门控- 为生产环境配置审批流程密钥不入Git- 使用External Secrets管理密钥App of Apps模式- 用于组织和管理应用标签发布- 便于回滚监控同步状态- 配置告警先测试- 在staging环境先测试更改故障排查# 同步失败 argocd app get my-app argocd app sync my-app --prune # 不同步状态 argocd app diff my-app argocd app sync my-app --force