GitOps持续交付实战：ArgoCD与Kustomize声明式部署配置

小编 • • 网站运维

GitOps通过Git仓库作为系统状态的唯一真实来源，实现Kubernetes集群的声明式持续交付。ArgoCD作为CNCF毕业的GitOps工具，能够自动监听Git仓库变更并将应用同步至目标集群，配合Kustomize的覆盖层机制，可在同一基础配置上管理多环境差异。本文演示ArgoCD安装、Kustomize项目结构设计、多环境Application配置及同步策略调优的完整流程。

ArgoCD安装与初始配置

ArgoCD通过Helm或原生manifest部署至Kubernetes集群。推荐使用Helm Chart进行安装以便后续升级管理：

# 添加ArgoCD Helm仓库
helm repo add argo https://argoproj.github.io/argo-helm
helm repo update

# 创建命名空间并安装
kubectl create namespace argocd
helm install argocd argo/argo-cd \
  --namespace argocd \
  --set server.service.type=NodePort \
  --set server.service.nodePortHttp=30080 \
  --set configs.cm.application.instanceLabelKey=argocd.argoproj.io/instance

# 获取初始admin密码
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d

安装完成后通过argocd CLI登录并配置仓库凭证：

argocd login 127.0.0.1:30080 --username admin --password <初始密码>

# 更新admin密码
argocd account update-password

# 配置私有Git仓库凭证
argocd repo add https://github.com/myorg/k8s-manifests \
  --username gitbot \
  --password ghp_xxxxxxxxxxxx

Kustomize项目结构与多环境覆盖

项目仓库采用base+overlays结构隔离环境差异。base目录存放通用资源配置，overlays目录按环境覆盖差异部分：

k8s-manifests/
├── base/
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── configmap.yaml
│   ├── hpa.yaml
│   └── kustomization.yaml
├── overlays/
│   ├── dev/
│   │   ├── kustomization.yaml
│   │   ├── config-patch.yaml
│   │   └── replicas-patch.yaml
│   ├── staging/
│   │   ├── kustomization.yaml
│   │   ├── config-patch.yaml
│   │   └── resource-limits.yaml
│   └── production/
│       ├── kustomization.yaml
│       ├── config-patch.yaml
│       ├── resource-limits.yaml
│       └── pdb.yaml

base/kustomization.yaml定义共享资源：

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - deployment.yaml
  - service.yaml
  - configmap.yaml
  - hpa.yaml

commonLabels:
  app.kubernetes.io/name: api-server
  app.kubernetes.io/managed-by: argocd

images:
  - name: registry.example.com/api-server
    newTag: ""  # 由CI流水线注入

overlays/production/kustomization.yaml通过patches和resources覆盖生产环境配置：

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: production

resources:
  - ../../base
  - pdb.yaml

patches:
  - path: config-patch.yaml
    target:
      kind: ConfigMap
      name: api-server-config
  - path: resource-limits.yaml
    target:
      kind: Deployment
      name: api-server

replicas:
  - name: api-server
    count: 6

images:
  - name: registry.example.com/api-server
    newTag: v2.4.1

config-patch.yaml通过strategic merge修改生产环境配置：

apiVersion: v1
kind: ConfigMap
metadata:
  name: api-server-config
data:
  LOG_LEVEL: "warn"
  DB_POOL_SIZE: "50"
  REDIS_CLUSTER: "true"
  RATE_LIMIT: "1000"
  FEATURE_FLAG_NEW_UI: "true"

本地验证Kustomize渲染结果：

kubectl kustomize overlays/production | kubectl apply --dry-run=client -f -

ArgoCD Application声明式配置

每个环境对应一个Application资源，以GitOps方式管理ArgoCD自身配置。创建ApplicationSet实现多环境自动管理：

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: api-server-multi-env
  namespace: argocd
spec:
  generators:
    - list:
        elements:
          - env: dev
            branch: develop
            namespace: dev
          - env: staging
            branch: release
            namespace: staging
          - env: production
            branch: main
            namespace: production
  template:
    metadata:
      name: 'api-server-{{env}}'
    spec:
      project: default
      source:
        repoURL: https://github.com/myorg/k8s-manifests
        targetRevision: '{{branch}}'
        path: 'overlays/{{env}}'
      destination:
        server: https://kubernetes.default.svc
        namespace: '{{namespace}}'
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
          allowEmpty: false
        syncOptions:
          - CreateNamespace=true
          - PrunePropagationPolicy=foreground
          - PruneLast=true
        retry:
          limit: 5
          backoff:
            duration: 5s
            factor: 2
            maxDuration: 3m

automated.prune=true确保Git中删除的资源在集群中同步清除；selfHeal=true在检测到手动kubectl修改后自动回滚至Git声明的状态；PruneLast=true先部署新资源再清理旧资源，减少同步过程中的服务中断窗口。

部署ApplicationSet：

kubectl apply -f applicationset.yaml -n argocd

# 查看同步状态
argocd app list
# 查看具体应用详情
argocd app get api-server-production

同步策略与回滚管理

生产环境建议关闭自动同步，改为手动审批触发。通过SyncWindow限制同步时间窗口：

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: production-project
  namespace: argocd
spec:
  sourceRepos:
    - https://github.com/myorg/k8s-manifests
  destinations:
    - namespace: production
      server: https://kubernetes.default.svc
  syncWindows:
    - kind: allow
      schedule: '0 10-22 * * 1-5'
      duration: 12h
      applications:
        - 'api-server-production'
      namespaces:
        - production
      manualSync: true

上述配置仅允许工作日10:00-22:00进行生产环境同步，manualSync: true要求人工触发，防止非工作时间误部署。

回滚操作通过ArgoCD历史版本快速完成：

# 查看同步历史
argocd app history api-server-production

# 回滚到指定版本
argocd app rollback api-server-production <history-id>

# 或在Git中revert提交，ArgoCD自动同步回退

ArgoCD健康检查与资源钩子配置

自定义健康检查评估应用同步后的就绪状态。在argocd-cm ConfigMap中配置Lua脚本检测Deployment状态：

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  resource.customizations.health.Deployment: |
    hs = {}
    if obj.status ~= nil then
      if obj.status.conditions ~= nil then
        for i, condition in ipairs(obj.status.conditions) do
          if condition.type == "Progressing" and condition.status == "False" then
            hs.status = "Degraded"
            hs.message = condition.message
            return hs
          end
          if condition.type == "Available" and condition.status == "True" then
            hs.status = "Healthy"
            hs.message = condition.message
            return hs
          end
        end
      end
    end
    hs.status = "Progressing"
    hs.message = "Waiting for deployment rollout"
    return hs

SyncHook在同步前后执行自定义逻辑，常用于数据库迁移和缓存预热：

apiVersion: batch/v1
kind: Job
metadata:
  name: db-migration
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: migrator
          image: registry.example.com/migrator:v2.4.1
          command: ["./migrate", "up"]
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: db-credentials
                  key: url

PreSync钩子在应用同步前执行数据库迁移，HookSucceeded策略确保迁移成功后自动清理Job资源，避免残留对象干扰后续同步。

原创文章，作者：小编，如若转载，请注明出处：https://www.yunthe.com/gitops-chi-xu-jiao-fu-shi-zhan-argocd-yu-kustomize-sheng/

赞 (0)
小编小编
0
上一篇 1小时前
下一篇 1小时前

相关推荐