ArgoCD GitOps持续部署与Kubernetes多集群配置同步实战

GitOps将Git仓库作为基础设施和应用配置的唯一可信源，通过声明式方式管理Kubernetes集群状态。ArgoCD作为CNCF毕业的GitOps工具，实现了从Git仓库到Kubernetes集群的自动同步与漂移检测。网站运维场景中，多环境配置一致性管理是保证部署质量的关键环节。本文记录ArgoCD从安装到多集群部署的完整配置流程。

ArgoCD安装与初始配置

ArgoCD通过Helm或Kubernetes YAML清单安装。生产环境建议使用Helm进行安装，便于版本管理和参数定制。

# 添加ArgoCD Helm仓库
helm repo add argo https://argoproj.github.io/argo-helm
helm repo update

# 创建命名空间
kubectl create namespace argocd

# 安装ArgoCD
helm install argocd argo/argo-cd \
    --namespace argocd \
    --set server.service.type=LoadBalancer \
    --set controller.replicas=1 \
    --set redis.persistence.enabled=true \
    --set redis.persistence.size=10Gi \
    --set server.metrics.enabled=true \
    --set controller.metrics.enabled=true

# 获取初始管理员密码
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

# 端口转发访问UI（生产环境配置Ingress）
kubectl port-forward svc/argocd-server -n argocd 8080:443

# 安装ArgoCD CLI
curl -sSL -o argocd https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
chmod +x argocd && mv argocd /usr/local/bin/

# 登录
argocd login localhost:8080 --username admin --password INITIAL_PASSWORD

Application资源定义与同步策略配置

ArgoCD的核心概念是Application，它定义了Git仓库中的清单与Kubernetes集群中目标命名空间的映射关系。

# argocd-app.yaml - Application资源定义
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: web-frontend
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  source:
    repoURL: https://github.com/example/k8s-manifests.git
    targetRevision: main
    path: apps/web-frontend/overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true           # 自动删除Git中已移除的资源
      selfHeal: true         # 自动修复手动修改导致的漂移
      allowEmpty: false
    syncOptions:
      - CreateNamespace=true
      - PruneLast=true
      - ApplyOutOfSyncOnly=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m
  revisionHistoryLimit: 10

关键参数说明：prune=true确保Git中删除的资源在集群中同步删除；selfHeal=true会在检测到集群状态与Git声明不一致时自动恢复，防止手动kubectl操作导致的配置漂移；PruneLast=true确保在删除旧资源前新资源已就绪；ApplyOutOfSyncOnly=true仅同步不同步的资源，减少不必要的API调用。

多集群部署与ApplicationSet批量管理

多集群场景下手动为每个集群创建Application不现实。ApplicationSet通过模板化生成多个Application，支持基于集群列表、Git目录结构等多种策略批量创建。

# applicationset-multi-cluster.yaml
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: web-frontend-multi-cluster
  namespace: argocd
spec:
  generators:
    - list:
        elements:
          - cluster: production-cluster-1
            url: https://prod-cluster-1.example.com:6443
            env: prod
          - cluster: production-cluster-2
            url: https://prod-cluster-2.example.com:6443
            env: prod
          - cluster: staging-cluster
            url: https://staging-cluster.example.com:6443
            env: staging
  template:
    metadata:
      name: 'web-frontend-{{cluster}}'
    spec:
      source:
        repoURL: https://github.com/example/k8s-manifests.git
        targetRevision: main
        path: 'apps/web-frontend/overlays/{{env}}'
      destination:
        server: '{{url}}'
        namespace: web-frontend
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true

# 集群注册 - 将外部集群注册到ArgoCD
kubectl config get-contexts

argocd cluster add prod-cluster-1-context \
    --label environment=production \
    --label region=us-east-1

argocd cluster add prod-cluster-2-context \
    --label environment=production \
    --label region=us-west-2

argocd cluster add staging-cluster-context \
    --label environment=staging

# 查看已注册集群
argocd cluster list

Kustomize多层叠加与多环境配置管理

配合Kustomize的base/overlay结构实现多环境配置差异管理。base目录存放通用配置，各环境overlay目录通过patch实现差异化配置。

# 目录结构
# k8s-manifests/
# ├── apps/
# │   └── web-frontend/
# │       ├── base/
# │       │   ├── deployment.yaml
# │       │   ├── service.yaml
# │       │   ├── configmap.yaml
# │       │   └── kustomization.yaml
# │       └── overlays/
# │           ├── production/
# │           │   ├── kustomization.yaml
# │           │   ├── replicas-patch.yaml
# │           │   └── resource-patch.yaml
# │           └── staging/
# │               ├── kustomization.yaml
# │               └── replicas-patch.yaml

# base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - deployment.yaml
  - service.yaml
  - configmap.yaml

# overlays/production/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: web-frontend
resources:
  - ../../base
patches:
  - replicas-patch.yaml
  - resource-patch.yaml
configMapGenerator:
  - name: app-config
    behavior: merge
    literals:
      - LOG_LEVEL=info
      - FEATURE_FLAG_NEW_UI=true
      - DB_POOL_SIZE=20

同步状态监控与漂移检测告警配置

ArgoCD暴露Prometheus格式的metrics，包括同步状态、应用健康度、集群资源使用等指标。配置Prometheus抓取和告警规则实现自动化监控。

# argocd-alerts.yaml - Prometheus告警规则
groups:
  - name: argocd
    rules:
      - alert: ArgoCDAppOutOfSync
        expr: argocd_app_info{sync_status="OutOfSync"} == 1
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "ArgoCD Application {{ $labels.name }} is OutOfSync"
          description: "Application {{ $labels.name }} in namespace {{ $labels.namespace }} has been OutOfSync for 10 minutes"

      - alert: ArgoCDAppDegraded
        expr: argocd_app_info{health_status="Degraded"} == 1
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "ArgoCD Application {{ $labels.name }} is Degraded"
          description: "Application {{ $labels.name }} health status is Degraded"

      - alert: ArgoCDSyncFailed
        expr: increase(argocd_app_sync_total{phase="Failed"}[10m]) > 0
        labels:
          severity: critical
        annotations:
          summary: "ArgoCD sync failed for {{ $labels.name }}"

ArgoCD还支持Webhook通知，集成Slack、钉钉、飞书等IM工具。通过在argocd-notifications ConfigMap中配置触发条件和模板，实现同步成功、失败、漂移等事件的通知推送。对于生产环境，建议selfHeal设为true但配合maintenance window，在业务低峰期自动同步以避免变更影响线上流量。多集群场景下需注意各集群Kubernetes版本的API兼容性差异，通过Kustomize的apiVersion mapping或ArgoCD的ignoreDifferences配置处理版本差异。