Week 17: GitOps & CI/CD for Kubernetes

name: Build and Push
on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run tests
        run: docker build --target test -t my-app:test .   # a "test" stage in the Dockerfile

      - name: Log in to registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        run: |
          docker build -t ghcr.io/my-org/my-app:${{ github.sha }} .
          docker push ghcr.io/my-org/my-app:${{ github.sha }}

TRADITIONAL CI/CD PUSH MODEL:
  CI pipeline --(kubectl apply, needs cluster credentials)--> Cluster
  Cluster state = whatever the last pipeline run pushed. Manual kubectl
  changes made directly against the cluster are invisible to Git.

GITOPS PULL MODEL:
  Git repo (desired state) <--(continuously watched)-- ArgoCD (in-cluster)
  ArgoCD reconciles the CLUSTER to match GIT, continuously — not just at
  deploy time. A manual kubectl change gets silently reverted, because
  Git, not the cluster, is the source of truth.

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

kubectl port-forward svc/argocd-server -n argocd 8080:443
# open https://localhost:8080 — get the initial admin password:
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/my-org/my-app-manifests.git
    targetRevision: main
    path: charts/my-app
    helm:
      valueFiles:
        - values-prod.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: prod
  syncPolicy:
    automated:
      prune: true       # remove resources deleted from Git
      selfHeal: true      # revert manual cluster changes back to match Git

# Edit values-prod.yaml in your manifests repo, bump replicaCount, commit, push
git commit -am "scale prod to 5 replicas"
git push

# Within ArgoCD's sync interval (default ~3 minutes, or instantly with a webhook):
kubectl get application my-app -n argocd    # STATUS moves to OutOfSync, then Syncing, then Synced
kubectl get deployment my-app -n prod        # replica count updates automatically

# Make a manual change directly against the cluster, bypassing Git entirely:
kubectl scale deployment/my-app --replicas=1 -n prod

# With selfHeal enabled, ArgoCD notices the mismatch and reverts it automatically:
kubectl get deployment my-app -n prod -w
# replicas briefly shows 1... then reverts back to 5, matching Git