GitOps持续部署实战：ArgoCD自动化同步与多环境配置管理方案

GitOps将Git仓库作为基础设施和应用配置的唯一真实来源，通过声明式方式管理Kubernetes集群状态。ArgoCD作为CNCF毕业的GitOps工具，实现Git仓库与集群状态的自动同步，支持多环境配置管理、回滚和可视化审计。本文覆盖ArgoCD的安装配置、应用部署、多环境策略及生产实践要点。

ArgoCD安装与初始配置

ArgoCD通过kubectl直接安装到Kubernetes集群：

# 创建命名空间
kubectl create namespace argocd

# 安装ArgoCD
kubectl apply -n argocd -f \
  https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# 获取初始admin密码
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d

# 端口转发访问Web UI
kubectl port-forward svc/argocd-server -n argocd 8080:443

# 安装ArgoCD CLI
curl -sSL -o argocd \
  https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
chmod +x argocd && mv argocd /usr/local/bin/

# 登录
argocd login localhost:8080 --username admin --password PASSWORD

生产环境建议配置Ingress暴露ArgoCD并启用SSO认证：

cat > argocd-ingress.yaml << 'EOF'
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-ingress
  namespace: argocd
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
spec:
  ingressClassName: nginx
  rules:
  - host: argocd.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: argocd-server
            port:
              number: 443
EOF
kubectl apply -f argocd-ingress.yaml

Application声明式部署

ArgoCD Application通过CRD定义，指定Git仓库和目标集群的映射关系：

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: web-frontend
  namespace: argocd
spec:
  project: production
  source:
    repoURL: https://github.com/org/k8s-manifests.git
    targetRevision: main
    path: apps/web-frontend/overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    syncOptions:
    - CreateNamespace=true
    - PruneLast=true
    - ApplyOutOfSyncOnly=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

关键配置项说明：

prune: true —— 删除Git中已移除的资源
selfHeal: true —— 自动修复手动修改的集群状态，确保与Git一致
PruneLast: true —— 先部署新资源，最后清理旧资源，减少服务中断
ApplyOutOfSyncOnly: true —— 只同步偏离状态的资源，提升大型集群同步效率

Kustomize多环境配置管理

ArgoCD原生支持Kustomize，通过base和overlay结构管理多环境配置差异：

k8s-manifests/
├── apps/
│   ├── web-frontend/
│   │   ├── base/
│   │   │   ├── deployment.yaml
│   │   │   ├── service.yaml
│   │   │   ├── configmap.yaml
│   │   │   └── kustomization.yaml
│   │   └── overlays/
│   │       ├── dev/
│   │       │   ├── kustomization.yaml
│   │       │   └── patches/
│   │       ├── staging/
│   │       │   ├── kustomization.yaml
│   │       │   └── patches/
│   │       └── production/
│   │           ├── kustomization.yaml
│   │           └── patches/

base/kustomization.yaml定义公共资源配置：

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml
- service.yaml
- configmap.yaml

commonLabels:
  app.kubernetes.io/name: web-frontend
  app.kubernetes.io/managed-by: argocd

images:
- name: registry.example.com/web-frontend
  newTag: latest

production overlay覆盖副本数和资源配置：

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../base

patches:
- target:
    kind: Deployment
    name: web-frontend
  patch: |-
    - op: replace
      path: /spec/replicas
      value: 5
    - op: replace
      path: /spec/template/spec/containers/0/resources/requests/memory
      value: 512Mi
    - op: replace
      path: /spec/template/spec/containers/0/resources/limits/memory
      value: 1Gi

Application Set实现多环境自动生成

当应用和环境数量增长后，手动维护每个Application定义效率低。ApplicationSet通过模板自动生成Application：

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: web-frontend-multi-env
  namespace: argocd
spec:
  generators:
  - git:
      repoURL: https://github.com/org/k8s-manifests.git
      directories:
      - path: apps/*/overlays/*
  template:
    metadata:
      name: '{{path.basename}}-{{path[2]}}'
    spec:
      project: '{{path[2]}}'
      source:
        repoURL: https://github.com/org/k8s-manifests.git
        targetRevision: main
        path: '{{path}}'
      destination:
        server: https://kubernetes.default.svc
        namespace: '{{path[2]}}'
      syncPolicy:
        automated:
          prune: true
          selfHeal: true

path变量解析：apps/web-frontend/overlays/production会被拆分为path[0]=apps, path[1]=web-frontend, path[2]=overlays, path.basename=production。ApplicationSet自动为每个应用在每个环境下创建Application。

同步窗口与健康检查配置

生产环境需要限制部署时间窗口，避免在业务高峰期触发同步。ArgoCD通过Sync Window实现：

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: production
  namespace: argocd
spec:
  syncWindows:
  - kind: allow
    schedule: '0 9 * * 1-5'
    duration: 8h
    applications: ['*']
    namespaces: ['production']
  - kind: deny
    schedule: '0 17 * * 1-5'
    duration: 16h
    applications: ['*']

该配置允许工作日9:00-17:00同步生产环境，其余时间禁止同步。Resource Hook用于在同步前后执行自定义操作：

# 在Deployment中添加PreSync hook执行数据库迁移
metadata:
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded

ArgoCD内置健康检查支持常见资源类型。自定义资源通过Lua脚本扩展健康检查逻辑：

# argocd-cm ConfigMap中添加自定义健康检查
data:
  resource.customizations.health.cert-manager.io_Certificate: |
    hs = {}
    if obj.status ~= nil then
      if obj.status.conditions ~= nil then
        for i, condition in ipairs(obj.status.conditions) do
          if condition.type == "Ready" and condition.status == "True" then
            hs.status = "Healthy"
            return hs
          end
        end
      end
    end
    hs.status = "Progressing"
    return hs

通过ArgoCD的Web UI可以直观看到每个应用的同步状态、资源健康度和差异对比。配合ArgoCD Notifications插件，同步成功或失败时自动发送消息到Slack、企业微信或邮件，实现GitOps流水线的闭环监控。

原创文章，作者：小编，如若转载，请注明出处：https://www.yunthe.com/gitops-chi-xu-bu-shu-shi-zhan-argocd-zi-dong-hua-tong-bu-yu/