Stage 7 · Master
Self-Service Platform API & CLI
GitOps Bridge: ArgoCD & Flux Integration
Use ApplicationSet, Kustomize, Helm. Platform API creates Applications; GitOps engine syncs. Drift detection and auto-heal.
GitOps Principles
- Declarative: Desired state in Git (manifests, Helm values, Kustomize)
- Versioned: Git history = audit trail, rollback = git revert
- Automated: Controller continuously reconciles cluster to Git state
- Self-healing: Drift detected and corrected automatically
- Platform API creates Application resources; ArgoCD/Flux does the sync
ArgoCD Architecture
ApplicationSet for Multi-Tenancy
ApplicationSet generates Application resources from a template. Perfect for platform: one ApplicationSet per team/project, generates Applications for each service.
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
name: payments-team-services
namespace: argocd
spec:
generators:
- git:
repoURL: https://github.com/platform/team-config.git
revision: HEAD
directories:
- path: teams/payments/services/*
template:
metadata:
name: '{{path.basename}}'
namespace: argocd
labels:
team: payments
platform.example.com/managed-by: applicationset
spec:
project: payments
source:
repoURL: 'https://github.com/{{path.basename}}.git'
targetRevision: HEAD
path: manifests/overlays/production
destination:
server: https://kubernetes.default.svc
namespace: 'payments-{{path.basename}}'
syncPolicy:
automated:
prune: true
selfHeal: true
allowEmpty: false
syncOptions:
- CreateNamespace=true
- PrunePropagationPolicy=foreground
retry:
limit: 5
backoff:
duration: 5s
factor: 2
maxDuration: 3m
ignoreDifferences:
- group: ""
kind: Secret
jsonPointers:
- /data
ApplicationSet generates Applications from team config repo. Each service repo gets an ArgoCD Application with team-specific settings.
Kustomize + Helm
Platform golden paths use Kustomize for overlays (base + environment patches). Helm for third-party dependencies (operators, CRDs). ArgoCD supports both natively.
manifests/
├── base/ # Kustomize base
│ ├── deployment.yaml
│ ├── service.yaml
│ ├── servicemonitor.yaml
│ ├── networkpolicy.yaml
│ └── kustomization.yaml
├── overlays/
│ ├── preview/ # PR environments
│ │ ├── kustomization.yaml
│ │ └── patch.yaml # replicaCount: 1, no PDB
│ ├── staging/
│ │ ├── kustomization.yaml
│ │ └── patch.yaml # replicaCount: 2, resource limits
│ └── production/
│ ├── kustomization.yaml
│ └── patch.yaml # replicaCount: 3+, PDB, HPA, strict resources
└── charts/ # Helm dependencies (if any)
└── requirements.yaml
Base defines common resources. Overlays patch for environment-specific config. ArgoCD applies overlay based on target cluster/namespace.
Platform API → ArgoCD
Platform controller creates ArgoCD Application resources via Kubernetes API. ArgoCD then manages the sync. Platform API doesn't do the sync — it declares the desired Application.
Drift Detection & Auto-Heal
- ArgoCD compares live cluster state vs Git manifests every 3 min (configurable)
- OutOfSync status → UI shows diff, webhook fires
- Auto-heal (selfHeal: true): ArgoCD automatically applies Git state to fix drift
- Prune: Removes resources deleted from Git
- Platform controller also reconciles every 5 min — catches ArgoCD failures
- Drift alert: Platform SLI tracks % of services OutOfSync > 5 min
Never kubectl apply directly to production. All changes go through Git. ArgoCD ensures cluster matches Git. Platform API ensures Application resources exist in Git/ArgoCD.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.