Argo CD #

kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts \
  -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# macOS
brew install argocd

# 或从 GitHub Releases 下载
# https://github.com/argoproj/argo-cd/releases/latest

# 方式一：Port Forwarding（开发环境推荐）
kubectl port-forward svc/argocd-server -n argocd 8080:443
# 访问 https://localhost:8080

# 方式二：LoadBalancer
kubectl patch svc argocd-server -n argocd -p '{"spec": {"type": "LoadBalancer"}}'

# 方式三：Ingress（生产环境推荐）
# 参考 https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/

# 获取 admin 初始密码
argocd admin initial-password -n argocd

# CLI 登录
argocd login <ARGOCD_SERVER>

# 修改密码
argocd account update-password

# 列出所有 kubeconfig context
kubectl config get-contexts -o name

# 注册集群
argocd cluster add <context-name>

# CLI 方式创建 Application
argocd app create guestbook \
  --repo https://github.com/argoproj/argocd-example-apps.git \
  --path guestbook \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace default

# 查看应用状态
argocd app get guestbook

# 同步（部署）应用
argocd app sync guestbook

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: guestbook
  namespace: argocd
spec:
  project: default                    # AppProject 名称
  source:
    repoURL: https://github.com/argoproj/argocd-example-apps.git
    targetRevision: HEAD              # branch / tag / commit SHA
    path: guestbook                   # 仓库中的路径
    # helm:                           # Helm Chart 配置
    #   valueFiles:
    #     - values.yaml
    # kustomize:                      # Kustomize 配置
    #   namePrefix: prod-
  destination:
    server: https://kubernetes.default.svc   # 目标集群
    namespace: default                        # 目标命名空间
  syncPolicy:
    automated:                       # 自动同步策略
      selfHeal: true                 # 自动修复集群中手动变更
      prune: true                    # 自动删除 Git 中已移除的资源
    syncOptions:
      - CreateNamespace=true         # 自动创建目标 namespace
      - ServerSideApply=true         # 使用 Server-Side Apply

spec:
  syncPolicy:
    automated:
      prune: true       # Git 中删除的资源自动从集群中删除
      selfHeal: true    # 集群中手动变更自动回滚到 Git 状态

metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "1"   # 数字越小越先部署

metadata:
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: default
spec:
  syncWindows:
    - kind: allow         # allow 或 deny
      schedule: "0 22 * * *"   # cron 表达式：每天 22:00
      duration: 2h              # 窗口持续 2 小时
      applications:
        - "*"                   # 匹配所有应用
      manualSync: true          # 窗口外允许手动同步

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: guestbook
  namespace: argocd
spec:
  generators:
    - list:
        elements:
          - cluster: staging
            url: https://staging.example.com
          - cluster: production
            url: https://production.example.com
  template:
    metadata:
      name: '{{cluster}}-guestbook'
    spec:
      project: default
      source:
        repoURL: https://github.com/org/guestbook.git
        targetRevision: HEAD
        path: kustomize/{{cluster}}
      destination:
        server: '{{url}}'
        namespace: guestbook

argocd cluster add <context-name>
# 会在目标集群的 kube-system 命名空间创建 argocd-manager ServiceAccount

# argocd-rbac-cm ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.default: role:readonly
  policy.csv: |
    p, role:devops, applications, sync, default/*, allow
    p, role:devops, applications, get, default/*, allow
    g, devops-team, role:devops

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: my-project
  namespace: argocd
spec:
  description: 项目描述
  sourceRepos:            # 允许的 Git 仓库
    - 'https://github.com/my-org/*'
  destinations:           # 允许的目标集群和 namespace
    - server: https://kubernetes.default.svc
      namespace: my-namespace
  clusterResourceWhitelist:  # 允许的集群级资源
    - group: ''
      kind: Namespace
  namespaceResourceBlacklist: # 禁止的资源类型
    - group: ''
      kind: ResourceQuota
  roles:                  # 项目级角色
    - name: admin
      policies:
        - p, proj:my-project:admin, applications, *, my-project/*, allow

# 应用管理
argocd app list                           # 列出所有应用
argocd app get <app>                      # 查看应用详情
argocd app sync <app>                     # 同步应用
argocd app rollback <app> <revision>      # 回滚到指定版本
argocd app diff <app>                     # 查看差异
argocd app delete <app>                   # 删除应用
argocd app history <app>                  # 查看同步历史

# 集群管理
argocd cluster list                       # 列出已注册集群
argocd cluster add <context>              # 注册集群
argocd cluster rm <context>               # 移除集群

# 仓库管理
argocd repo add <repo-url>               # 添加 Git 仓库
argocd repo list                          # 列出已注册仓库

# 项目操作
argocd proj list                          # 列出所有 AppProject
argocd proj get <project>                 # 查看项目详情