GitOps with Kubernetes

# Install ArgoCD in your cluster
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Access ArgoCD UI
kubectl port-forward svc/argocd-server -n argocd 8080:443

# Get the initial admin password
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

# Install ArgoCD CLI
brew install argocd

# Login to ArgoCD
argocd login localhost:8080 --username admin --password <password>

# Add a Git repository
argocd repo add https://github.com/your-org/your-repo.git --username <username> --password <password>

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: guestbook
  namespace: argocd
  # Optional finalizer to cascade delete resources
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  # The project the application belongs to
  project: default
  
  # Source repository and configuration
  source:
    # Git repository URL containing manifests
    repoURL: https://github.com/argoproj/argocd-example-apps.git
    # Revision to use (branch, tag, commit hash)
    targetRevision: HEAD
    # Path within the repository
    path: guestbook
    
    # Optional - If using Kustomize
    kustomize:
      namePrefix: prod-
      images:
      - gcr.io/my-repo/my-image:v1.0.0
    
    # Optional - If using Helm
    # helm:
    #   releaseName: guestbook
    #   valueFiles:
    #   - values.yaml
    #   values: |
    #     ingress:
    #       enabled: true
    #     replicaCount: 3
  
  # Destination cluster and namespace
  destination:
    # Target cluster - https://kubernetes.default.svc refers to the same cluster
    server: https://kubernetes.default.svc
    # Target namespace for the application
    namespace: guestbook
  
  # Sync policy and options
  syncPolicy:
    automated:
      # Automatically delete resources that no longer exist in Git
      prune: true
      # Automatically sync when drift is detected
      selfHeal: true
      # Only allow auto-sync from specific branches
      allowEmpty: false
    # Additional options
    syncOptions:
    - CreateNamespace=true
    - PrunePropagationPolicy=foreground
    - PruneLast=true
    
  # Ignore differences in specific fields
  ignoreDifferences:
  - group: apps
    kind: Deployment
    jsonPointers:
    - /spec/replicas

# Parent application managing multiple child applications
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: app-of-apps
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/my-org/gitops-repo.git
    targetRevision: HEAD
    path: apps
  destination:
    server: https://kubernetes.default.svc
    namespace: argocd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

# Install kubeseal
# brew install kubeseal

# Install the Sealed Secrets controller in your cluster
kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.19.1/controller.yaml

# Create a sealed secret
kubectl create secret generic db-creds \
  --from-literal=username=admin \
  --from-literal=password=t0p-s3cr3t \
  --dry-run=client -o yaml | \
kubeseal --format yaml > sealed-db-creds.yaml

# Example sealed secret
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: db-creds
  namespace: default
  # These annotations control the scope of secret decryption
  annotations:
    sealedsecrets.bitnami.com/cluster-wide: "false"
    sealedsecrets.bitnami.com/namespace-wide: "false"
spec:
  encryptedData:
    password: AgBy8hCi...truncated
    username: AgCtr7nk...truncated
  template:
    metadata:
      name: db-creds
      namespace: default
    type: Opaque

# Install SOPS
# brew install sops

# Create a GPG key for encryption
gpg --full-generate-key

# Example .sops.yaml configuration file
creation_rules:
  - path_regex: .*.yaml
    encrypted_regex: ^(data|stringData)$
    pgp: FINGERPRINT_HERE  # Replace with your GPG key fingerprint
    # Alternative: Use AWS KMS, GCP KMS, Azure Key Vault, etc.
    # kms: 'arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab'

# Encrypt a Kubernetes secret
sops --encrypt --in-place secret.yaml

# Example encrypted secret with SOPS
apiVersion: v1
kind: Secret
metadata:
    name: database-credentials
type: Opaque
data:
    # Values are encrypted inline by SOPS
    username: ENC[AES256_GCM,data:sO3j2YrZ,iv:Gh32,tag:gGH=,type:str]
    password: ENC[AES256_GCM,data:yQ7cPNxoQw==,iv:JHF1,tag:1l70,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age: []
    lastmodified: "2023-04-18T19:02:44Z"
    mac: ENC[AES256_GCM,data:LnBhv12F+g==,iv:LxYS,tag:vS6D,type:str]
    pgp:
        - created_at: "2023-04-18T19:02:03Z"
          enc: |
            -----BEGIN PGP MESSAGE-----
            [... encrypted content ...]
            -----END PGP MESSAGE-----
          fp: 1234ABCD1234ABCD1234ABCD1234ABCD12345678

# Usage with Flux
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
  name: secrets
  namespace: flux-system
spec:
  # Enable SOPS decryption
  decryption:
    provider: sops
    secretRef:
      name: sops-gpg  # Secret containing the private key
  path: ./secrets
  prune: true
  sourceRef:
    kind: GitRepository
    name: flux-system

# Create the GPG key secret for Flux
gpg --export-secret-keys --armor FINGERPRINT_HERE |
kubectl create secret generic sops-gpg \
  --namespace=flux-system \
  --from-file=sops.asc=/dev/stdin

# Install External Secrets Operator
kubectl apply -f https://github.com/external-secrets/external-secrets/releases/download/v0.6.1/external-secrets.yaml

# Configure a SecretStore (AWS Secrets Manager example)
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws-secretsmanager
  namespace: default
spec:
  provider:
    aws:
      service: SecretsManager
      region: us-east-1
      auth:
        secretRef:
          accessKeyIDSecretRef:
            name: aws-credentials
            key: access-key-id
          secretAccessKeySecretRef:
            name: aws-credentials
            key: secret-access-key

# Define an ExternalSecret
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-credentials
  namespace: default
spec:
  refreshInterval: "15m"
  secretStoreRef:
    name: aws-secretsmanager
    kind: SecretStore
  target:
    name: database-credentials
    creationPolicy: Owner
  data:
  - secretKey: username
    remoteRef:
      key: database/credentials
      property: username
  - secretKey: password
    remoteRef:
      key: database/credentials
      property: password

# Flux notification provider for Slack
apiVersion: notification.toolkit.fluxcd.io/v1beta1
kind: Provider
metadata:
  name: slack
  namespace: flux-system
spec:
  type: slack
  channel: gitops-notifications  # Slack channel name
  address: https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK  # For non-secret config
  secretRef:
    name: slack-url  # Reference to a secret containing the webhook URL
---
# Secret containing the Slack webhook URL
apiVersion: v1
kind: Secret
metadata:
  name: slack-url
  namespace: flux-system
stringData:
  address: https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK
---
# Alert configuration for a specific application
apiVersion: notification.toolkit.fluxcd.io/v1beta1
kind: Alert
metadata:
  name: on-call-webapp
  namespace: flux-system
spec:
  providerRef:
    name: slack
  eventSeverity: info  # Minimum severity to trigger alerts (info, error)
  eventSources:        # Resources to watch for events
    - kind: GitRepository
      name: webapp
    - kind: Kustomization
      name: webapp
    - kind: HelmRelease
      name: webapp
  exclusionList:       # Regex patterns to exclude from alerting
    - ".*upgrade.*succeeded.*"
  inclusionList:       # Regex patterns to specifically include (optional)
    - ".*error.*"
    - ".*failed.*"
  suspend: false       # Whether to suspend this alert
---
# Example for Microsoft Teams notification
apiVersion: notification.toolkit.fluxcd.io/v1beta1
kind: Provider
metadata:
  name: teams
  namespace: flux-system
spec:
  type: msteams
  address: https://outlook.office.com/webhook/YOUR-TEAMS-WEBHOOK-URL
---
# Example for email notifications
apiVersion: notification.toolkit.fluxcd.io/v1beta1
kind: Provider
metadata:
  name: email
  namespace: flux-system
spec:
  type: smtp
  address: smtp.gmail.com:587
  username: sender@gmail.com
  secretRef:
    name: smtp-credentials

# Grafana dashboard ConfigMap example
apiVersion: v1
kind: ConfigMap
metadata:
  name: flux-dashboards
  namespace: monitoring
  labels:
    grafana_dashboard: "true"  # Label for Grafana to discover this dashboard
data:
  flux-control-plane.json: |
    {
      "annotations": { ... },
      "editable": true,
      "gnetId": null,
      "graphTooltip": 0,
      "id": 1,
      "links": [],
      "panels": [
        {
          "datasource": "Prometheus",
          "fieldConfig": { ... },
          "gridPos": { ... },
          "id": 1,
          "title": "Reconciliation Operations",
          "options": { ... },
          "targets": [
            {
              "expr": "sum(increase(gotk_reconcile_count{}[5m])) by (controller)",
              "interval": "",
              "legendFormat": "{{controller}}",
              "refId": "A"
            }
          ],
          "type": "timeseries"
        },
        {
          "datasource": "Prometheus",
          "fieldConfig": { ... },
          "gridPos": { ... },
          "id": 2,
          "title": "Reconciliation Duration",
          "options": { ... },
          "targets": [
            {
              "expr": "histogram_quantile(0.95, sum(rate(gotk_reconcile_duration_seconds_bucket{}[5m])) by (le, controller))",
              "interval": "",
              "legendFormat": "{{controller}} p95",
              "refId": "A"
            }
          ],
          "type": "timeseries"
        }
      ],
      "refresh": "10s",
      "schemaVersion": 30,
      "style": "dark",
      "tags": ["flux", "gitops"],
      "templating": { ... },
      "time": { ... },
      "timepicker": { ... },
      "timezone": "",
      "title": "Flux Control Plane",
      "uid": "flux-control-plane",
      "version": 1
    }

# Example Kyverno policy
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
  annotations:
    policies.kyverno.io/title: Require Labels
    policies.kyverno.io/category: Best Practices
    policies.kyverno.io/severity: medium
    policies.kyverno.io/description: >-
      Enforce organizational labels for resource ownership and management.
spec:
  validationFailureAction: enforce  # 'enforce' or 'audit'
  background: true  # Process existing resources
  rules:
  - name: check-team-label
    match:
      resources:
        kinds:
        - Deployment
        - StatefulSet
        - DaemonSet
    validate:
      message: "The label 'team' is required to identify resource ownership"
      pattern:
        metadata:
          labels:
            team: "?*"  # Requires non-empty string
            
---
# Example requiring resource limits
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-resource-limits
spec:
  validationFailureAction: enforce
  background: true
  rules:
  - name: validate-resources
    match:
      resources:
        kinds:
        - Deployment
        - StatefulSet
    validate:
      message: "Resource limits are required for CPU and memory"
      pattern:
        spec:
          template:
            spec:
              containers:
                - name: "*"
                  resources:
                    limits:
                      memory: "?*"
                      cpu: "?*"

# Example Flux pipeline with security scanning
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: GitRepository
metadata:
  name: podinfo
  namespace: flux-system
spec:
  interval: 5m
  url: https://github.com/stefanprodan/podinfo
  ref:
    branch: master
---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
kind: Kustomization
metadata:
  name: podinfo
  namespace: flux-system
spec:
  interval: 5m
  path: "./kustomize"
  prune: true
  sourceRef:
    kind: GitRepository
    name: podinfo
  validation: client
  postBuild:
    substituteFrom:
    - kind: ConfigMap
      name: security-policies
    substitute:
      scan_images: "true"
      block_severity: "CRITICAL"