GitOps — pull-ভিত্তিক deployment, Argo CD আর Flux

// Who holds which credential? A counting model, not a statistic.
const clusters = 5;                       // try 1, 5, 20
const push = [
  { holder: "CI", cred: "registry push", scope: "images" },
  { holder: "CI", cred: "repo read",     scope: "source" },
];
for (let i = 1; i <= clusters; i++) push.push({ holder: "CI", cred: `deploy to cluster ${i}`, scope: "cluster" });
const pull = [
  { holder: "CI", cred: "registry push",       scope: "images" },
  { holder: "CI", cred: "config repo PR only", scope: "proposal" },
];
for (let i = 1; i <= clusters; i++) {
  pull.push({ holder: `cluster ${i}`, cred: "config repo read", scope: "read" });
  pull.push({ holder: `cluster ${i}`, cred: "registry pull",    scope: "read" });
}
function report(name, creds, inbound) {
  const inCI = creds.filter((c) => c.holder === "CI");
  const direct = inCI.filter((c) => c.scope === "cluster").length;
  console.log(name);
  console.log(`  credentials held by CI       : ${inCI.length}`);
  console.log(`  held inside the clusters     : ${creds.length - inCI.length}`);
  console.log(`  clusters CI can change alone : ${direct}`);
  console.log(`  API endpoints CI must reach  : ${inbound}`);
  console.log(`  if CI leaks, direct cluster access: ${direct} of ${clusters}`);
}
report("PUSH (CI runs kubectl/helm)", push, clusters);
report("PULL (agent in each cluster)", pull, 0);
console.log("What pull does NOT remove:");
const risks = [
  ["merge to main in config repo", "reaches every cluster that follows main"],
  ["agent inside a cluster",       "still holds strong rights in that cluster"],
  ["central Argo CD hub",          `holds ${clusters} cluster credentials in one place`],
];
for (const [what, why] of risks) console.log(`  ${what}: ${why}`);

apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: shop-config
  namespace: abcl-go
spec:
  interval: 20s             # how often to look at Git
  url: http://abcl-go-git.abcl-go.svc.cluster.local:8080/git/shop-config.git
  ref:
    branch: main
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: shop
  namespace: abcl-go
spec:
  interval: 30s             # how often to compare with the cluster
  sourceRef:
    kind: GitRepository
    name: shop-config
  path: ./apps/shop
  prune: true               # delete what left Git
  wait: true                # applied is not enough, wait until healthy
  timeout: 90s
  targetNamespace: abcl-go
  serviceAccountName: gitops-deployer   # namespaced "edit", not cluster-admin

$ git log --oneline
f4a4441 add shop app: 2 replicas
$ git push -u origin main
 * [new branch]      main -> main

$ kubectl get gitrepository,kustomization -n abcl-go
NAME                                                 READY   STATUS
gitrepository.source.toolkit.fluxcd.io/shop-config   True    stored artifact for revision 'main@sha1:f4a4441d15…'
NAME                                             READY   STATUS
kustomization.kustomize.toolkit.fluxcd.io/shop   True    Applied revision: main@sha1:f4a4441d15…

# Events on the Kustomization
Service/abcl-go/shop created
Deployment/abcl-go/shop created
Health check passed in 5.031050527s
Reconciliation finished in 5.223067505s, next run in 30s

$ kubectl get pods -l app=shop -n abcl-go
NAME                    READY   STATUS    RESTARTS
shop-5d58d9cb68-jk5ld   1/1     Running   0
shop-5d58d9cb68-lm6nl   1/1     Running   0

$ kubectl get svc shop -n abcl-go      # before the delete
NAME   TYPE        CLUSTER-IP      PORT(S)
shop   ClusterIP   10.100.80.34    80/TCP
$ kubectl delete svc shop -n abcl-go
service "shop" deleted from abcl-go namespace
$ kubectl get svc shop -n abcl-go      # 26s later
NAME   TYPE        CLUSTER-IP      PORT(S)
shop   ClusterIP   10.100.44.254   80/TCP

// A GitOps sync loop on a simulated clock (seconds). Change anything here.
const syncEvery = 30, selfHeal = true, prune = true;
const events = [
  { t: 10,  by: "git",     note: "commit: replicas 3",  git: { replicas: 3 } },
  { t: 75,  by: "kubectl", note: "scale to 6",          live: { replicas: 6 } },
  { t: 140, by: "git",     note: "commit: add banner",  git: { banner: "Eid sale" } },
  { t: 200, by: "git",     note: "commit: drop banner", git: { banner: undefined } },
];
const clean = (o) => JSON.stringify(Object.fromEntries(Object.entries(o).filter(([, v]) => v !== undefined)));
let desired = { replicas: 2 }, live = { replicas: 2 }, commit = 1, applied = 1, outOfSync = 0;

for (let t = 0; t <= 270; t += 5) {
  if (clean(desired) !== clean(live)) outOfSync += 5;
  for (const e of events.filter((x) => x.t === t)) {
    if (e.git) { desired = { ...desired, ...e.git }; commit++; }
    if (e.live) live = { ...live, ...e.live };
    console.log(`t=${t}s  ${e.by}: ${e.note}`);
  }
  if (t === 0 || t % syncEvery !== 0) continue;
  const newCommit = commit !== applied, drift = clean(desired) !== clean(live);
  if (!drift && !newCommit) continue;
  if (!newCommit && !selfHeal) { console.log(`t=${t}s  sync: OutOfSync, waiting for a human`); continue; }
  const next = { ...desired };
  if (!prune) for (const k in live) if (!(k in next) || next[k] === undefined) next[k] = live[k];
  const removed = Object.keys(live).filter((k) => live[k] !== undefined && next[k] === undefined);
  live = next; applied = commit;
  console.log(`t=${t}s  sync: commit ${commit} applied, live = ${clean(live)}` + (removed.length ? `, pruned ${removed}` : ""));
}
console.log(`final desired = ${clean(desired)}`);
console.log(`final live    = ${clean(live)}`);
console.log(`out of sync for ${outOfSync}s of 270s`);

$ kubectl patch kustomization shop -n abcl-go --type=merge -p '{"spec":{"suspend":true}}'
kustomization.kustomize.toolkit.fluxcd.io/shop patched
$ kubectl scale deploy/shop --replicas=4 -n abcl-go
deployment.apps/shop scaled
# 40s later, two sync intervals have passed
$ kubectl get deploy shop -n abcl-go
NAME   READY   UP-TO-DATE   AVAILABLE
shop   4/4     4            4
$ kubectl patch kustomization shop -n abcl-go --type=merge -p '{"spec":{"suspend":false}}'
kustomization.kustomize.toolkit.fluxcd.io/shop patched
# replicas back to 3, about 1s after resume

# A ConfigMap "banner" added through Git, and one made by hand
$ kubectl create configmap handmade --from-literal=owner=me -n abcl-go
$ kubectl get kustomization shop -n abcl-go \
    -o jsonpath='{range .status.inventory.entries[*]}{.id}{"\n"}{end}'
abcl-go_banner__ConfigMap
abcl-go_shop__Service
abcl-go_shop_apps_Deployment

$ git rm -q apps/shop/banner.yaml          # and its line in kustomization.yaml
$ git commit -qm "remove banner" && git push
   bcfdf64..87e97aa  main -> main

# 22s later
ConfigMap/abcl-go/banner deleted           # Event on the Kustomization
$ kubectl get cm banner handmade -n abcl-go
NAME       DATA
handmade   1
Error from server (NotFound): configmaps "banner" not found

shop-app/                  # app repo: developers work here
├── src/
├── Dockerfile
└── .ci/pipeline.yaml      # test, build, push image

shop-config/               # config repo: the cluster reads this
├── base/
│   ├── deployment.yaml
│   ├── service.yaml
│   └── kustomization.yaml
└── envs/
    ├── dev/kustomization.yaml       # image tag, replicas: 1
    ├── staging/kustomization.yaml   # image tag, replicas: 2
    └── prod/kustomization.yaml      # image tag, replicas: 6

// Promotion: one folder per environment, versus one branch per environment.
const shared = { image: "shop:1.4.0", replicas: 2, debug: false };
const show = (o) => `image=${o.image} replicas=${o.replicas} debug=${o.debug}`;
const log = [];

// Layout A: folders on one branch. Promotion copies ONE field, as one commit.
const folders = {
  dev:     { ...shared, replicas: 1, debug: true },
  staging: { ...shared },
  prod:    { ...shared, replicas: 6 },
};
function promote(from, to, field) {
  folders[to][field] = folders[from][field];
  log.push(`commit: promote ${field}=${folders[to][field]} ${from} -> ${to}`);
}
folders.dev.image = "shop:1.5.0";
log.push("commit: dev image shop:1.5.0");
promote("dev", "staging", "image");
promote("staging", "prod", "image");
console.log("A. folders");
for (const env in folders) console.log(`  ${env.padEnd(8)}${show(folders[env])}`);

// Layout B: branches. A merge carries EVERY difference that is not protected.
const branches = { dev: { ...folders.dev }, prod: { ...shared, replicas: 6 } };
const protectedFields = ["replicas"];     // try: [] or ["replicas", "debug"]
const before = { ...branches.prod };
for (const k in branches.dev) if (!protectedFields.includes(k)) branches.prod[k] = branches.dev[k];
console.log("B. branches: merge dev into prod");
console.log(`  before  ${show(before)}`);
console.log(`  after   ${show(branches.prod)}`);
const leaked = Object.keys(before).filter((k) => k !== "image" && before[k] !== branches.prod[k]);
console.log(`  changed besides image: ${leaked.length ? leaked.join(", ") : "nothing"}`);
console.log("History"); log.forEach((l, i) => console.log(`  ${i + 1}. ${l}`));

# Sample, not run here. Needs Flux's two image controllers.
apiVersion: image.toolkit.fluxcd.io/v1
kind: ImageRepository
metadata:
  name: shop
  namespace: flux-system
spec:
  image: registry.example.com/shop
  interval: 5m
---
apiVersion: image.toolkit.fluxcd.io/v1
kind: ImagePolicy
metadata:
  name: shop
  namespace: flux-system
spec:
  imageRepositoryRef:
    name: shop
  policy:
    semver:
      range: ">=1.4.0 <2.0.0"
---
apiVersion: image.toolkit.fluxcd.io/v1
kind: ImageUpdateAutomation
metadata:
  name: shop
  namespace: flux-system
spec:
  interval: 30m
  sourceRef:
    kind: GitRepository
    name: shop-config
  git:
    checkout:
      ref:
        branch: main
    commit:
      author:
        name: image-bot
        email: bot@example.com
    push:
      branch: image-updates        # a branch for review, not main
  update:
    path: ./envs/dev
    strategy: Setters
# And in the manifest, a marker on the image line:
#   image: registry.example.com/shop:1.4.0 # {"$imagepolicy": "flux-system:shop"}

# Sample, not run here. Only a pointer lives in Git.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: shop-db
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: example-store
  target:
    name: shop-db
  data:
    - secretKey: password
      remoteRef:
        key: shop/db-password

# Flux decrypts SOPS files itself. Passed --dry-run=server on the run's cluster.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: secrets
  namespace: abcl-go
spec:
  interval: 5m
  sourceRef:
    kind: GitRepository
    name: shop-config
  path: ./secrets
  prune: true
  decryption:
    provider: sops
    secretRef:
      name: sops-age

# Sample, not run here: the Argo CD form of the same idea.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: shop
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://git.example.com/team/shop-config.git
    targetRevision: main
    path: envs/prod
  destination:
    server: https://kubernetes.default.svc
    namespace: shop
  syncPolicy:
    automated:
      prune: true
      selfHeal: true