GitOps with Argo CD

In GitOps the Git repository is the source of truth; a controller applies it and corrects drift. Argo CD is a popular CNCF project for this.

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/v2.2.5/manifests/install.yaml
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d
kubectl port-forward svc/argocd-server -n argocd 8080:443

Define an application:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata: { name: shop, namespace: argocd }
spec:
  project: default
  source:
    repoURL: https://github.com/acme/shop-config
    path: overlays/prod
    targetRevision: main
  destination: { server: https://kubernetes.default.svc, namespace: shop }
  syncPolicy:
    automated: { prune: true, selfHeal: true }

Keep application source code and deployment config in separate repositories, so a config change does not rebuild the image. Review changes through pull requests, which also gives you an audit trail.