GitOps with ArgoCD & Flux — Declarative Continuous Delivery

What is GitOps — Git as the Single Source of Truth

GitOps has revolutionized the way organizations approach continuous delivery and infrastructure automation, especially within Kubernetes ecosystems. At its core, GitOps leverages Git repositories as the definitive source of truth for all deployment configurations, infrastructure states, and application manifests. This approach ensures that any change to the desired state of the system is version-controlled, auditable, and repeatable, reducing configuration drift and enhancing security.

In traditional DevOps workflows, manual interventions, ad-hoc scripts, and inconsistent environments often lead to deployment errors and difficulties in tracking changes. GitOps addresses these issues by codifying infrastructure and application states into Git repositories. Developers and operations teams make changes via pull requests, which are then automatically applied to target environments through automation tools like ArgoCD and Flux CD. This model aligns development and operations, fostering collaboration and enabling rapid, reliable deployments.

For example, a typical GitOps workflow involves modifying Kubernetes manifests stored in Git. When a developer pushes a change, an automated process detects the update and synchronizes it with the Kubernetes cluster. This ensures that the cluster always mirrors the Git repository, establishing Git as the single source of truth. This methodology significantly reduces manual errors, accelerates deployment processes, and enhances compliance, making GitOps a vital component of modern DevOps training at Networkers Home.

GitOps Principles — Declarative, Versioned, Automated & Auditable

Implementing GitOps effectively requires adherence to core principles that ensure robust, scalable, and maintainable workflows. These principles are:

• Declarative Configuration: All system and application states are defined declaratively, meaning that the desired state is described explicitly rather than imperatively scripting how to achieve it. Kubernetes manifests, Helm charts, or Kustomizations serve as the declarative source, allowing tools like ArgoCD and Flux CD to reconcile the actual state with the desired state automatically.
• Version Control as the Single Source of Truth: Every change is committed to Git, providing an immutable, auditable history. This allows teams to track who made what change, when, and why, facilitating rollback and compliance auditing.
• Automation: Continuous deployment pipelines automatically detect changes in Git and synchronize them with target environments. This reduces manual intervention, accelerates delivery, and minimizes human error.
• Auditing & Compliance: With the entire configuration history stored in Git, organizations can easily audit changes, enforce policies, and ensure compliance with regulatory standards.

For instance, in a Kubernetes environment, GitOps principles enable seamless deployment of updated manifests or Helm charts whenever changes are committed, ensuring that production environments are always consistent with the source of truth. Adopting these principles leads to resilient, scalable, and transparent infrastructure management, as demonstrated in Networkers Home Blog.

ArgoCD — Installation, App of Apps & Sync Strategies

ArgoCD is a declarative, GitOps-powered continuous delivery tool designed specifically for Kubernetes. Its architecture revolves around the concept of applications that automatically synchronize their state with Git repositories, providing real-time visibility and control over deployments.

Installation: Installing ArgoCD involves deploying its components onto a Kubernetes cluster. The simplest method is via kubectl commands:

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

Post-installation, access the ArgoCD UI using port forwarding:

kubectl port-forward svc/argocd-server -n argocd 8080:443

Login credentials are typically the initial admin user with a generated password accessible through:

kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

App of Apps Pattern: A common deployment pattern in ArgoCD involves creating a parent application that manages child applications, enabling hierarchical and modular deployments. For example, a parent app can point to a Git repository containing multiple application manifests or Helm charts, each managed independently but synchronized collectively.

Sync Strategies: ArgoCD offers various synchronization modes to control how and when applications are updated:

• Automatic Sync: Changes detected in Git are automatically applied to the cluster, enabling continuous deployment without manual intervention.
• Manual Sync: Administrators trigger synchronization explicitly, providing control over rollout timing and validation.
• Pruning & Self-Healing: ArgoCD can automatically delete resources no longer defined in Git (pruning) and repair drifted resources to match the declared state.

Advanced users leverage health checks, hooks, and custom sync waves to fine-tune deployment workflows, ensuring reliable and predictable updates. For detailed steps and configurations, explore the Networkers Home Blog for comprehensive ArgoCD tutorials.

Flux CD — Controllers, Kustomizations & Helm Integration

Flux CD is another powerful GitOps tool that automates deployment workflows within Kubernetes. It consists of multiple controllers responsible for monitoring Git repositories and reconciling the desired state with the cluster.

Controllers: Flux operates through dedicated controllers such as:

• Source Controller: Watches Git repositories, Helm repositories, or other sources for changes.
• Kustomize Controller: Manages Kustomizations, applying overlays and transformations.
• Helm Controller: Handles Helm releases, enabling Helm chart deployment and upgrades.

These controllers continuously monitor their respective sources and trigger reconciliation processes whenever updates are detected. For example, a Git commit updating a Helm chart will be picked up by Flux's Helm Controller, which then applies the changes to the cluster.

Kustomizations: Flux enhances Kubernetes declarative management through Kustomizations, which enable layered configurations and overlays. A typical setup involves defining a Kustomization resource pointing to a Git repository:

apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
kind: Kustomization
metadata:
  name: my-app
spec:
  interval: 5m
  path: ./deploy
  prune: true
  sourceRef:
    kind: GitRepository
    name: my-git-repo
  targetNamespace: default

Flux also integrates seamlessly with Helm, allowing users to deploy Helm charts declaratively by specifying HelmRelease resources. This combination simplifies managing complex applications and promotes reproducibility.

ArgoCD vs Flux — Feature Comparison & When to Choose

Choosing between ArgoCD and Flux CD depends on organizational requirements, existing workflows, and specific feature preferences. The table below compares their key features:

When deciding, consider ArgoCD's user-friendly UI and advanced sync options for teams prioritizing visibility and control. Conversely, Flux's lightweight design and tight Git integration suit organizations with a preference for CLI workflows and automation. For comprehensive training, visit Networkers Home to explore courses tailored to these tools.

GitOps for Kubernetes — Deploying Manifests & Helm Charts

Implementing GitOps in Kubernetes involves managing both raw manifests and Helm charts, enabling flexible application deployment strategies. This section covers both approaches in depth.

Deploying Manifests

Deploying Kubernetes manifests via GitOps involves storing YAML files in Git repositories. These manifests define all Kubernetes resources—pods, services, deployments, ingress, etc.:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - containerPort: 80

Tools like ArgoCD or Flux CD monitor the Git repository containing these manifests. When a change occurs, such as updating the container image version, the tool applies the updated manifest to the cluster, triggering rolling updates and minimizing downtime.

Deploying Helm Charts

Helm charts encapsulate complex application deployments, making it easier to manage dependencies and upgrade processes. To deploy Helm charts via GitOps, store chart repositories or HelmRelease manifests in Git.

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: my-nginx
  namespace: default
spec:
  chart:
    spec:
      chart: nginx
      sourceRef:
        kind: HelmRepository
        name: stable
      version: '1.16.0'
  interval: 5m
  values:
    replicaCount: 3

This approach allows declarative management of Helm releases, with tools automatically handling upgrades and rollbacks. Combining manifests and Helm charts offers a comprehensive GitOps solution for Kubernetes deployments.

Secrets in GitOps — Sealed Secrets, SOPS & External Secrets

Managing secrets securely is critical in GitOps workflows. Storing plaintext secrets in Git repositories is unsafe; hence, techniques like Sealed Secrets, SOPS, and External Secrets are employed.

Sealed Secrets

Developed by Bitnami, Sealed Secrets allow encrypting Kubernetes secrets into a sealed secret that can be safely stored in Git. The sealed secrets are decryptable only within the cluster with the private key held by the controller:

kubectl create secret generic my-secret --from-literal=password=SuperSecret
kubeseal --format yaml < my-secret.yaml > my-sealed-secret.yaml

The sealed secret YAML can be committed to Git, and the controller decrypts it automatically during deployment.

SOPS (Secrets OPerationS)

Mozilla's SOPS encrypts YAML, JSON, or ENV files, integrating seamlessly with Git. Decryption occurs at runtime, often via CI/CD pipelines, ensuring secrets are never stored in plaintext in repositories. Example command:

sops -e -i secrets.yaml

External Secrets

Solutions like External Secrets enable Kubernetes to fetch secrets directly from external secret management systems such as AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault. This approach centralizes secret management, enhances security, and simplifies secret rotation.

Multi-Cluster GitOps — Managing Fleets of Clusters

As organizations scale, managing multiple Kubernetes clusters via GitOps becomes essential. Multi-cluster GitOps involves deploying, synchronizing, and maintaining consistent configurations across diverse environments—development, staging, production, or edge clusters.

Strategies include:

• Centralized Management: Use a single Git repository with directory structures segregated by cluster. Tools like ArgoCD and Flux support deploying multiple clusters from a common configuration source.
• Cluster-specific Repositories: Maintain dedicated repositories for each cluster, enabling tailored configurations and policies while ensuring consistency through shared templates or modules.
• Automation & RBAC: Automate synchronization with CI/CD pipelines and enforce Role-Based Access Control (RBAC) to restrict modifications per cluster.

For example, an organization might deploy a central Git repository with directories like dev/, staging/, and prod/. Each directory contains environment-specific manifests and Helm charts. Using tools like Networkers Home Blog, teams can implement automated workflows that synchronize each environment independently, ensuring consistency and compliance across the fleet of clusters.

Summary of Multi-Cluster Strategies

Implementing multi-cluster GitOps effectively ensures high availability, disaster recovery, and regional compliance, making it a strategic priority for cloud-native enterprises. To develop expertise in managing complex deployments, explore courses at Networkers Home.

Key Takeaways

• GitOps uses Git as the authoritative source for infrastructure and application deployment, ensuring consistency and traceability.
• Core GitOps principles include declarative configuration, version control, automation, and auditability, which promote reliable CI/CD workflows.
• ArgoCD and Flux CD are leading tools for implementing GitOps in Kubernetes, each offering unique features like UI, sync strategies, and extensibility.
• Deploying manifests and Helm charts declaratively simplifies application management, enabling seamless updates and rollbacks.
• Secure secret management techniques like Sealed Secrets, SOPS, and External Secrets are vital to safeguard sensitive data within GitOps workflows.
• Managing multiple clusters via GitOps ensures scalable, consistent, and compliant operations across diverse environments and geographic locations.
• For hands-on training and in-depth tutorials, visit Networkers Home.

Frequently Asked Questions