ArgoCD 2025 - Kubernetes GitOps

This repository contains the complete Kubernetes cluster configuration managed by ArgoCD using the App of Apps pattern.

Architecture

bootstrap/         # Root application for App of Apps pattern
gitops/
  ├── apps/        # ArgoCD Application manifests (App of Apps)
  └── k8s/         # Kubernetes resources managed by apps

Quick Start

Prerequisites

• Kubernetes cluster running
• ArgoCD installed in argocd namespace
• kubectl configured and connected
• kubeseal CLI installed (brew install kubeseal)
• Doppler service token

Bootstrap the Cluster

Option 1: Automated Bootstrap (Recommended)

# 1. Seal your Doppler token first
./scripts/seal-doppler-token.sh dp.st.YOUR_DOPPLER_TOKEN
git add gitops/k8s/doppler-secrets/doppler-token-sealed.yaml
git commit -m "Add sealed Doppler token"
git push

# 2. Run the bootstrap script
./bootstrap/bootstrap-cluster.sh

Option 2: Manual Bootstrap

# 1. Seal and commit Doppler token (see above)

# 2. Apply the root application
kubectl apply -f bootstrap/root-app.yaml

# 3. Watch applications sync
kubectl get applications -n argocd -w

Access ArgoCD UI

# Get admin password
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d && echo

# Open UI
open https://argocd.k8s.server.lan
# Username: admin
# Password: (from command above)

That's it! All applications will be automatically deployed by ArgoCD.

Deployed Applications

Infrastructure

• MetalLB - LoadBalancer for bare metal clusters
• Traefik - Ingress controller
• cert-manager - SSL/TLS certificate management

Security & Secrets

• Doppler Operator - Secrets management
• Doppler Secrets - Secret synchronization

Monitoring & Logging

• Prometheus Stack - Metrics and alerting
• Grafana - Dashboards and visualization
• Loki - Log aggregation
• Promtail - Log collection
• Blackbox Exporter - External monitoring

CI/CD

• Actions Runner Controller - GitHub Actions runners
• GitHub Runner - Self-hosted runners

ArgoCD

• ArgoCD Ingress - External access to ArgoCD UI

Adding New Applications

1. Create an Application manifest in gitops/apps/:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/x86txt/argocd_2025.git
    targetRevision: main
    path: gitops/k8s/my-app
  destination:
    server: https://kubernetes.default.svc
    namespace: my-app
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions: [CreateNamespace=true]

2. Create the resources in gitops/k8s/my-app/
3. Commit and push - ArgoCD handles the rest!

Repository Structure

bootstrap/

Contains the root Application that implements the App of Apps pattern. Apply this once to bootstrap everything.

gitops/apps/

Application manifests that define what to deploy. Each file is an ArgoCD Application resource.

gitops/k8s/

The actual Kubernetes resources (Deployments, Services, ConfigMaps, etc.) organized by application.

App of Apps Pattern

This repo uses the App of Apps pattern:

• Root App (bootstrap/root-app.yaml) watches gitops/apps/
• Child Apps in gitops/apps/ manage actual workloads
• GitOps workflow: commit → push → auto-deploy

Configuration

Network

• LoadBalancer IP: 10.5.22.60 (Traefik)
• ArgoCD URL: https://argocd.k8s.server.lan

Secrets

Secrets are managed via Doppler and synchronized automatically. See gitops/k8s/doppler-secrets/ for configuration.

Management

View all applications

kubectl get applications -n argocd

Sync all applications manually

kubectl annotate application -n argocd --all argocd.argoproj.io/refresh=hard --overwrite

Check application status

kubectl get application -n argocd <app-name> -o yaml

Troubleshooting

Application won't sync

# Force refresh
kubectl annotate application -n argocd <app-name> argocd.argoproj.io/refresh=hard --overwrite

Check application events

kubectl describe application -n argocd <app-name>

View logs

kubectl logs -n argocd -l app.kubernetes.io/name=argocd-server

Notes

• All applications use automated sync with prune and self-heal
• Namespaces are created automatically via CreateNamespace=true
• Secrets should never be committed - use Doppler or sealed secrets