Homework

Put GitOps principles into practice by configuring ArgoCD Applications, FluxCD HelmReleases, and a multi-cluster deployment strategy.

Task 1 — ArgoCD Application with Drift Detection and Rollback

Set up an ArgoCD Application that deploys a Helm chart and demonstrates drift detection with automatic self-healing. Your setup must include:

1. A Git repository with the following structure:

gitops-homework/
  apps/
    webapp/
      application.yaml      # ArgoCD Application CRD
  envs/
    staging/
      values.yaml           # staging overrides
    production/
      values.yaml           # production overrides

2. An ArgoCD Application manifest that:
   • Deploys the bitnami/nginx chart (or any public Helm chart)
   • References environment-specific values from the envs/staging/ directory
   • Enables automated sync with selfHeal: true and prune: true
   • Sets a sync retry policy with backoff (5 retries, 5s initial delay, 2x factor, 3m cap)
3. Demonstrate drift detection by manually modifying the live deployment (e.g., kubectl scale or kubectl edit) and capturing ArgoCD restoring the declared state.
4. Perform a rollback using the ArgoCD CLI or UI: deploy a broken change via Git, then roll back to the previous healthy revision.

Task 2 — FluxCD HelmRelease with Encrypted Secrets

Configure a FluxCD-managed deployment that uses a HelmRelease resource with SOPS-encrypted secrets. Your deliverables:

1. A HelmRepository source pointing to a public chart repository (e.g., Bitnami).
2. A HelmRelease manifest that:
   • References the HelmRepository source and pins to a specific chart version
   • Uses valuesFrom to pull values from a Kubernetes Secret
   • Configures remediation: on install failure, retry 3 times; on upgrade failure, rollback automatically
   • Sets a spec.interval of 5m for reconciliation
3. A SOPS-encrypted secret file (secrets.enc.yaml) containing at least two sensitive values (e.g., database password and API key). Use either age or GPG for encryption.
4. A Kustomization resource that decrypts the SOPS secret and feeds it into the HelmRelease.

Task 3 — Multi-Cluster ApplicationSet

Design an ArgoCD ApplicationSet that deploys the same Helm chart across multiple clusters (or simulated clusters using namespaces) with per-target overrides. Requirements:

1. Write an ApplicationSet manifest that uses a list generator with at least three targets:

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: webapp-multi
  namespace: argocd
spec:
  generators:
    - list:
        elements:
          - cluster: dev
            url: https://kubernetes.default.svc
            namespace: dev
            replicas: "1"
          - cluster: staging
            url: https://kubernetes.default.svc
            namespace: staging
            replicas: "2"
          - cluster: production
            url: https://kubernetes.default.svc
            namespace: production
            replicas: "3"
  template:
    # ... complete the template

2. The template must:
   • Use {{cluster}} and {{namespace}} parameters in the Application name and destination
   • Pass {{replicas}} as a Helm parameter override
   • Include a sync policy with automated sync and self-heal
3. Add a sync wave annotation strategy: dev deploys first (wave 0), staging second (wave 1), production last (wave 2).
4. Document what happens when you:
   • Add a fourth cluster to the list generator
   • Remove a cluster from the list generator (explain the preserveResourcesOnDeletion policy)
   • Change the chart version — how does the rollout propagate?

Grading Rubric