GitOps (WIP)

Introduction

https://www.weave.works/blog/what-is-gitops-really

GIT as the source of truth for the cluster
GIT as is the single place where we operate (create, change, destroy) for all environments
Changes are all observable via GIT

Tools Used

Installation

1. Prerequisites

A kubernetes cluster with kubectl configured. More to come here. I recommend Minikube, the k8s that comes with docker, or k3s. There is also numerous cloud options.

2. Install Sealed Secrets

Sealed Secrets to allow secrets to be declared openly in this repository. Sealed secrets are encrypted using public/private key encryption (AES-256). The private key resides within the cluster and is used to decrypt Sealed Secrets to Secrets.

2.1 Add Sealed Secrets to the cluster

kubectl -f apply cluster/base/sealedsecrets.yaml

2.2 Set the Sealed Secrets private key

When initially installing Sealed Secrets in a cluster, the Sealed Secrets controller will generate a private key.

When a new cluster is created for a new infrastructure environment you must use the same private key to allow existing secrets to be unsealed in that cluster. You should back this key up and store in an encrypted file store.

# Replace the master key
kubectl delete -f master.key
kubectl apply -f master.key

# Delete the controller pod (this will cause it to restart and read the new key)
kubectl delete pod -l name=sealed-secrets-controller

3. Apply the kustomization

Sanity check the cluster config with:

kustomize build cluster/env/prod

If the kustomization looks good, apply with:

kustomize build cluster/env/prod/ | kubectl apply -f -

The combined kustomization will:

Create cluster namespaces
Install Ambassador
Install ArgoCD and create ArgoCD apps that will sync this new configuration to the cluster

4. Ingress/network config

Currently you will need to configure you ingress and such for ambassador. When this is no longer WIP you will see an example of doing this delcaratively using external-dns and cert-manager. You will need a cluster on the internet though, without more work you would not be able to do this on your local.

Usage

Once the cluster is setup and Argo is deployed, you can give GitOps a shot by upgrading the redis version.

git checkout -b upgrade-redis

Change .images[{name=='redis'}].newTag to the version of redis you want to upgrade to. Commit and review the PR. On merge, Argo will see the change and redeploy the redis deployment. You could use yq to do this as well.

elocke/gitops-example