GitOps with Helm

Using Git as the single source of truth for Helm-based deployments.

• GitOps principles: declarative desired state, automated reconciliation
• ArgoCD Application CRD & ApplicationSet
• FluxCD HelmRelease & HelmRepository
• Drift detection and self-healing
• Secrets management: SOPS, Vault Plugin
• Helm template in CI vs native Helm support
• Multi-cluster GitOps patterns

GitOps Principles

• Declarative — the entire desired system state is described in Git
• Versioned & immutable — every change is a Git commit with full audit trail
• Pulled automatically — agents in the cluster pull desired state, not pushed from CI
• Continuously reconciled — software agents detect drift and correct it

Why Helm + GitOps?

• Helm charts provide the packaging — GitOps provides the delivery pipeline
• Values files per environment live in Git alongside chart references
• Rollbacks are git revert instead of helm rollback

ArgoCD — Application CRD

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: oci://registry.example.com/charts
    chart: my-app
    targetRevision: 1.4.0
    helm:
      releaseName: my-app
      valueFiles:
        - values-production.yaml
      parameters:
        - name: image.tag
          value: "v2.3.1"
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

ArgoCD — ApplicationSet

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: cluster-apps
  namespace: argocd
spec:
  generators:
    - git:
        repoURL: https://github.com/org/gitops-repo.git
        revision: main
        directories:
          - path: "apps/*"
    - clusters:
        selector:
          matchLabels:
            env: production
  template:
    metadata:
      name: "{{path.basename}}-{{name}}"
    spec:
      project: default
      source:
        repoURL: https://github.com/org/gitops-repo.git
        targetRevision: main
        path: "{{path}}"
      destination:
        server: "{{server}}"
        namespace: "{{path.basename}}"

The Git directory generator creates one Application per subdirectory. The cluster generator fans out across multiple clusters.

FluxCD — HelmRelease & HelmRepository

apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: bitnami
  namespace: flux-system
spec:
  type: oci
  url: oci://registry-1.docker.io/bitnamicharts
  interval: 10m

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: redis
  namespace: caching
spec:
  interval: 30m
  chart:
    spec:
      chart: redis
      version: "18.x"
      sourceRef:
        kind: HelmRepository
        name: bitnami
        namespace: flux-system
  valuesFrom:
    - kind: ConfigMap
      name: redis-values
  values:
    architecture: replication
    replica:
      replicaCount: 3

Automated Image Updates & Drift Detection

Flux Image Automation

apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageUpdateAutomation
metadata:
  name: flux-system
  namespace: flux-system
spec:
  interval: 30m
  sourceRef:
    kind: GitRepository
    name: flux-system
  git:
    checkout:
      ref:
        branch: main
    commit:
      author:
        name: fluxcdbot
        email: flux@example.com
      messageTemplate: "chore: update images"
    push:
      branch: main
  update:
    path: ./clusters/production
    strategy: Setters

• ImagePolicy selects the latest tag matching a semver pattern
• ImageUpdateAutomation commits the new tag back to Git
• Drift detection: both Argo and Flux compare live state against Git and show OutOfSync / drift status

Secrets, Rollbacks & Helm in CI

Secrets in GitOps

• SOPS + Flux: encrypt secrets in Git, Flux decrypts at reconciliation time using age or KMS keys
• ArgoCD Vault Plugin (AVP): replace <path:secret/data/db#password> placeholders at sync time

Rollback Strategies

• git revert: the GitOps-native approach — revert the commit, agent auto-syncs
• Manual sync to previous revision: ArgoCD allows syncing to a specific Git SHA

Helm Template in CI vs Native Helm

• Rendered manifests: run helm template in CI, commit plain YAML — simpler diff review
• Native Helm support: ArgoCD/Flux render at sync time — keeps charts as first-class objects

Summary

• GitOps — Git is the single source of truth; agents reconcile desired vs live state
• ArgoCD Application — source.helm with valueFiles, parameters, OCI registry support
• ApplicationSet — generate Applications from Git directories or cluster lists
• FluxCD HelmRelease — sourceRef to HelmRepository, valuesFrom ConfigMaps/Secrets
• Image automation — Flux ImageUpdateAutomation commits new tags to Git
• Secrets — SOPS with Flux, Vault Plugin with ArgoCD
• Rollbacks — prefer git revert over manual intervention
• Multi-cluster — ApplicationSet cluster generator or Flux Kustomization per cluster

Next: Lesson 20 →