ArgoCD GitOps持续交付平台搭建与多集群应用分发实战

GitOps理念与ArgoCD定位

GitOps将Git仓库作为基础设施和应用部署的唯一事实来源，所有变更通过Git提交触发自动同步。ArgoCD是Kubernetes原生的GitOps持续交付工具，与Flux并列为CNCF毕业项目中最主流的两个选择。ArgoCD的优势在于Web UI可视化、多集群管理、Sync Hooks和ApplicationSet批量生成能力。在多环境（dev/staging/prod）多集群场景下，ArgoCD的声明式管理模型比手动kubectl apply可靠得多。

ArgoCD安装与基础配置

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# 获取初始admin密码
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d

# 端口转发访问Web UI
kubectl port-forward svc/argocd-server -n argocd 8080:443

生产环境建议通过Ingress暴露ArgoCD，配合OIDC认证而非使用admin账户。Repo Server负责Git仓库克隆和Manifest渲染，在高并发场景下是性能瓶颈。

Application资源与同步策略

ArgoCD的核心API资源是Application，定义了Git仓库来源、目标集群和同步策略：

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/org/k8s-manifests.git
    targetRevision: main
    path: overlays/production
    kustomize:
      namePrefix: prod-
      images:
        - my-app=registry.example.com/my-app:v2.1.0
  destination:
    server: https://kubernetes.default.svc
    namespace: my-app
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true
    retry:
      limit: 3
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

selfHeal是ArgoCD最核心的特性——当有人通过kubectl手动修改了资源，ArgoCD检测到漂移后自动恢复为Git中声明的状态。ServerSideApply选项在大规模资源同步时避免last-applied-configuration注解过大导致请求失败。

Kustomize Overlay多环境管理

k8s-manifests/
├── base/
│   ├── deployment.yaml
│   ├── service.yaml
│   └── kustomization.yaml
├── overlays/
│   ├── development/
│   │   └── kustomization.yaml
│   ├── staging/
│   │   └── kustomization.yaml
│   └── production/
│       ├── kustomization.yaml
│       └── patches/
│           ├── replicas.yaml
│           └── resources.yaml

# overlays/production/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../../base
patches:
  - path: patches/replicas.yaml
    target:
      kind: Deployment
images:
  - name: my-app
    newName: registry.example.com/my-app
    newTag: v2.1.0

base目录定义通用资源，overlays各子目录通过patches覆盖差异化配置。ArgoCD Application的source.path指向对应的overlay目录即可实现环境隔离。

ApplicationSet多集群批量分发

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: my-app-multi-cluster
  namespace: argocd
spec:
  generators:
  - clusters:
      selector:
        matchLabels:
          env: production
  template:
    metadata:
      name: "my-app-{{name}}"
    spec:
      project: default
      source:
        repoURL: https://github.com/org/k8s-manifests.git
        targetRevision: main
        path: overlays/production
      destination:
        server: "{{server}}"
        namespace: my-app
      syncPolicy:
        automated:
          prune: true
          selfHeal: true

clusters生成器从ArgoCD集群列表中选择匹配标签的集群，为每个集群生成一个Application。新增集群只需在ArgoCD中注册并打上对应标签，ApplicationSet会自动为新集群创建Application并同步资源。

Sync Hooks与渐进式发布

apiVersion: batch/v1
kind: Job
metadata:
  name: pre-sync-db-migration
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  template:
    spec:
      containers:
      - name: migrate
        image: my-app-migrate:v2.1.0
        command: ["python", "manage.py", "migrate"]
      restartPolicy: Never
---
apiVersion: batch/v1
kind: Job
metadata:
  name: post-sync-smoke-test
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  template:
    spec:
      containers:
      - name: test
        image: my-app-test:v2.1.0
        command: ["python", "-m", "pytest", "tests/smoke/"]
      restartPolicy: Never

PreSync Hook在资源同步前执行数据库迁移，PostSync Hook在同步完成后运行冒烟测试。Hook执行失败默认会阻塞整个Sync流程，确保应用变更的安全性。

ArgoCD通知与状态告警

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-notifications-cm
  namespace: argocd
data:
  trigger.on-sync-failed: |
    - when: app.status.operationState.phase in ["Failed", "Error"]
      send: [app-sync-failed]
  template.app-sync-failed: |
    slack:
      attachments: |
        [{
          "title": "{{app.metadata.name}} sync failed",
          "color": "#ff0000",
          "fields": [
            {"title": "Error", "value": "{{app.status.operationState.message}}"},
            {"title": "Cluster", "value": "{{app.spec.destination.server}}"}
          ]
        }]

GitOps模式下ArgoCD让Kubernetes集群配置管理具备了完整的审计追踪、漂移修复和自动同步能力。多集群场景通过ApplicationSet实现声明式批量分发，Sync Hooks保证变更流程的可控性。