# Application 定义示例
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/yourorg/configs.git
    targetRevision: main
    path: apps/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true      # 自动删除不再存在的资源
      selfHeal: true   # 自动修复漂移

# 1. 添加 Helm 仓库
helm repo add argo https://argoproj.github.io/argo-helm
helm repo update

# 2. 安装 Argo CD
helm install argocd argo/argo-cd \
  --namespace argocd \
  --create-namespace \
  --set server.service.type=LoadBalancer

# 3. 等待 Pod 就绪
kubectl wait --for=condition=ready pod -l app.kubernetes.io/name=argocd-server -n argocd --timeout=300s

# 4. 获取初始管理员密码
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d && echo

# 5. 访问 UI（任选一种方式）
# 方式 1: 端口转发
kubectl port-forward svc/argocd-server -n argocd 8080:443

# 方式 2: 如果使用 LoadBalancer
kubectl get svc argocd-server -n argocd
# 访问: https://<EXTERNAL-IP>

# 1. 安装 ArgoCD CLI（可选但推荐）
curl -sSL -o argocd-linux-amd64 https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
sudo install -m 555 argocd-linux-amd64 /usr/local/bin/argocd
rm argocd-linux-amd64

# 2. CLI 登录
argocd login localhost:8080 --username admin --password <初始密码>

# 3. 修改密码
argocd account update-password

# 4. 创建第一个应用
argocd app create guestbook \
  --repo https://github.com/argoproj/argocd-example-apps.git \
  --path guestbook \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace default

# 5. 同步应用
argocd app sync guestbook

# 简单的 CI 流水线
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: ci-pipeline-
spec:
  entrypoint: ci-pipeline
  templates:
  
  # 主流程定义
  - name: ci-pipeline
    dag:
      tasks:
      - name: clone
        template: git-clone
      
      - name: test
        dependencies: [clone]
        template: run-tests
      
      - name: build
        dependencies: [test]
        template: docker-build
      
      - name: push
        dependencies: [build]
        template: docker-push

  # 子任务模板
  - name: git-clone
    container:
      image: alpine/git
      command: [sh, -c]
      args: ["git clone https://github.com/yourorg/app.git /work"]
      volumeMounts:
      - name: workdir
        mountPath: /work

  - name: run-tests
    container:
      image: node:18
      command: [sh, -c]
      args: ["cd /work && npm install && npm test"]
      volumeMounts:
      - name: workdir
        mountPath: /work

  - name: docker-build
    container:
      image: gcr.io/kaniko-project/executor:latest
      args:
      - "--context=/work"
      - "--dockerfile=/work/Dockerfile"
      - "--destination=myregistry.com/app:{{workflow.uid}}"
      volumeMounts:
      - name: workdir
        mountPath: /work

  - name: docker-push
    container:
      image: curlimages/curl
      command: [sh, -c]
      args: ["echo 'Image pushed successfully'"]

  # 共享存储卷
  volumeClaimTemplates:
  - metadata:
      name: workdir
    spec:
      accessModes: [ "ReadWriteOnce" ]
      resources:
        requests:
          storage: 1Gi

# 1. 安装 Argo Workflows
helm install argo-workflows argo/argo-workflows \
  --namespace argo \
  --create-namespace \
  --set server.serviceType=LoadBalancer

# 2. 访问 UI
kubectl -n argo port-forward svc/argo-workflows-server 2746:2746

# 3. 提交工作流
kubectl apply -f my-workflow.yaml

# 4. 查看工作流状态
kubectl get workflows -n argo

# 5. 查看日志
kubectl logs -n argo <workflow-pod-name>

# 金丝雀发布（Canary）
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: my-app-canary
spec:
  replicas: 10
  strategy:
    canary:
      steps:
      - setWeight: 10    # 10% 流量到新版本
      - pause: {duration: 2m}
      
      - setWeight: 25    # 增加到 25%
      - pause: {duration: 2m}
      
      - setWeight: 50    # 增加到 50%
      - pause: {duration: 5m}
      
      - setWeight: 75    # 增加到 75%
      - pause: {}        # 手动审批
      
      - setWeight: 100   # 全量发布
      
      # 分析配置（自动回滚）
      analysis:
        templates:
        - templateName: success-rate
        startingStep: 2
        args:
        - name: service-name
          value: my-app
  
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: app
        image: myregistry.com/app:v2.0.0

# 蓝绿部署（Blue-Green）
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: my-app-bluegreen
spec:
  replicas: 5
  strategy:
    blueGreen:
      activeService: my-app-active     # 生产流量
      previewService: my-app-preview   # 预览流量
      autoPromotionEnabled: false      # 手动切换
      scaleDownDelaySeconds: 300       # 保留旧版本 5 分钟
  
  template:
    spec:
      containers:
      - name: app
        image: myregistry.com/app:v2.0.0

# 1. 安装 Rollouts Controller
helm install argo-rollouts argo/argo-rollouts \
  --namespace argo-rollouts \
  --create-namespace

# 2. 安装 kubectl 插件
curl -LO https://github.com/argoproj/argo-rollouts/releases/latest/download/kubectl-argo-rollouts-linux-amd64
sudo install -m 555 kubectl-argo-rollouts-linux-amd64 /usr/local/bin/kubectl-argo-rollouts

# 3. 查看 Rollout 状态
kubectl argo rollouts get rollout my-app -n production --watch

# 4. 手动推进金丝雀发布
kubectl argo rollouts promote my-app -n production

# 5. 紧急回滚
kubectl argo rollouts abort my-app -n production
kubectl argo rollouts undo my-app -n production

# 1. 定义事件源（接收 GitHub Webhook）
apiVersion: argoproj.io/v1alpha1
kind: EventSource
metadata:
  name: github-webhook
  namespace: argo-events
spec:
  service:
    ports:
    - port: 12000
      targetPort: 12000
  webhook:
    github-push:
      port: "12000"
      endpoint: /push
      method: POST

# 2. 定义传感器（触发工作流）
apiVersion: argoproj.io/v1alpha1
kind: Sensor
metadata:
  name: github-sensor
  namespace: argo-events
spec:
  dependencies:
  - name: github-dep
    eventSourceName: github-webhook
    eventName: github-push
    filters:
      data:
      - path: body.ref
        type: string
        value:
        - "refs/heads/main"  # 只监听 main 分支
  
  triggers:
  - template:
      name: trigger-workflow
      k8s:
        operation: create
        source:
          resource:
            apiVersion: argoproj.io/v1alpha1
            kind: Workflow
            metadata:
              generateName: ci-pipeline-
            spec:
              entrypoint: build-and-deploy
              templates:
              - name: build-and-deploy
                container:
                  image: alpine
                  command: [sh, -c]
                  args: ["echo 'Building from commit {{inputs.parameters.commit}}'"]
        parameters:
        - src:
            dependencyName: github-dep
            dataKey: body.head_commit.id
          dest: spec.arguments.parameters.0.value

# 1. 安装 Argo Events
helm install argo-events argo/argo-events \
  --namespace argo-events \
  --create-namespace

# 2. 创建 EventBus（消息总线）
kubectl apply -n argo-events -f - <<EOF
apiVersion: argoproj.io/v1alpha1
kind: EventBus
metadata:
  name: default
spec:
  nats:
    native:
      replicas: 3
EOF

# 3. 部署事件源和传感器
kubectl apply -f event-source.yaml
kubectl apply -f sensor.yaml

# 4. 暴露 Webhook 端点
kubectl -n argo-events port-forward svc/github-webhook-eventsource-svc 12000:12000

# 5. 在 GitHub 配置 Webhook
# URL: http://your-domain:12000/push
# Content type: application/json
# Events: Push events

# 在 ArgoCD Application 添加注解
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
  annotations:
    # 启用自动更新
    argocd-image-updater.argoproj.io/image-list: myapp=myregistry.com/app
    
    # 更新策略：latest 标签
    argocd-image-updater.argoproj.io/myapp.update-strategy: latest
    
    # 或者使用语义化版本
    # argocd-image-updater.argoproj.io/myapp.update-strategy: semver
    # argocd-image-updater.argoproj.io/myapp.allow-tags: regexp:^v[0-9]+\.[0-9]+\.[0-9]+$
    
    # Git 写回配置
    argocd-image-updater.argoproj.io/write-back-method: git
    argocd-image-updater.argoproj.io/git-branch: main
spec:
  source:
    repoURL: https://github.com/yourorg/app-configs.git
    path: overlays/production

# 1. 安装 Image Updater
helm install argocd-image-updater argo/argocd-image-updater \
  --namespace argocd \
  --set config.argocd.token=$(kubectl get secret -n argocd argocd-secret -o jsonpath='{.data.admin\.password}' | base64 -d)

# 2. 配置镜像仓库认证（如果需要）
kubectl create secret generic regcred \
  --from-file=.dockerconfigjson=$HOME/.docker/config.json \
  --type=kubernetes.io/dockerconfigjson \
  -n argocd

# 3. 查看更新日志
kubectl logs -n argocd -l app.kubernetes.io/name=argocd-image-updater -f

# Step 1: 安装 Argo CD
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Step 2: 访问 UI
kubectl port-forward svc/argocd-server -n argocd 8080:443 &

# Step 3: 获取密码并登录
ARGOCD_PASSWORD=$(kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d)
echo "ArgoCD Password: $ARGOCD_PASSWORD"

# 浏览器访问 https://localhost:8080
# 用户名: admin
# 密码: 上面输出的密码

# Step 4: 通过 UI 创建应用
# - Repository URL: https://github.com/argoproj/argocd-example-apps.git
# - Path: guestbook
# - Cluster: in-cluster
# - Namespace: default

# Step 5: 点击 "Sync" 按钮，几秒后应用就部署完成！

# 验证
kubectl get all -n default | grep guestbook

# 架构：GitHub Webhook → Argo Events → Argo Workflows → Argo CD

# 1. 准备 Git 仓库结构
your-app-repo/
├── src/                 # 应用代码
├── Dockerfile
├── k8s/
│   ├── base/
│   │   ├── deployment.yaml
│   │   └── kustomization.yaml
│   └── overlays/
│       └── production/
│           └── kustomization.yaml
└── .github/
    └── workflows/       # （可选）保留用于其他 CI 任务

# 2. 创建 Workflow 模板
kubectl apply -f - <<EOF
apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: ci-template
  namespace: argo
spec:
  entrypoint: ci-pipeline
  arguments:
    parameters:
    - name: repo-url
    - name: revision
  
  templates:
  - name: ci-pipeline
    dag:
      tasks:
      - name: checkout
        template: git-clone
      
      - name: unit-test
        dependencies: [checkout]
        template: run-tests
      
      - name: build-image
        dependencies: [unit-test]
        template: kaniko-build
      
      - name: update-manifest
        dependencies: [build-image]
        template: update-k8s

  - name: git-clone
    script:
      image: alpine/git
      command: [sh]
      source: |
        git clone {{workflow.parameters.repo-url}} /work
        cd /work && git checkout {{workflow.parameters.revision}}

  - name: run-tests
    container:
      image: node:18
      command: [sh, -c]
      args: ["cd /work && npm ci && npm test"]

  - name: kaniko-build
    container:
      image: gcr.io/kaniko-project/executor:latest
      args:
      - "--context=/work"
      - "--destination=myregistry.com/app:{{workflow.parameters.revision}}"

  - name: update-k8s
    script:
      image: alpine/git
      command: [sh]
      source: |
        apk add yq
        cd /work/k8s/overlays/production
        yq e ".images[0].newTag = \"{{workflow.parameters.revision}}\"" -i kustomization.yaml
        git add .
        git commit -m "Update image to {{workflow.parameters.revision}}"
        git push
EOF

# 3. 配置 GitHub Webhook（Events 部分见上文）

# 4. 创建 ArgoCD Application 监听 k8s 目录
argocd app create my-app \
  --repo https://github.com/yourorg/your-app.git \
  --path k8s/overlays/production \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace production \
  --sync-policy automated

# 1. 安装 Prometheus（用于指标监控）
helm install prometheus prometheus-community/kube-prometheus-stack \
  --namespace monitoring \
  --create-namespace

# 2. 创建 AnalysisTemplate（定义成功标准）
kubectl apply -f - <<EOF
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: success-rate
  namespace: production
spec:
  args:
  - name: service-name
  
  metrics:
  - name: success-rate
    interval: 1m
    count: 5
    successCondition: result[0] >= 0.95
    failureLimit: 2
    provider:
      prometheus:
        address: http://prometheus-server.monitoring.svc
        query: |
          sum(rate(http_requests_total{
            service="{{args.service-name}}",
            status!~"5.."
          }[1m])) 
          / 
          sum(rate(http_requests_total{
            service="{{args.service-name}}"
          }[1m]))
EOF

# 3. 创建 Rollout 资源
kubectl apply -f - <<EOF
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: my-app
  namespace: production
spec:
  replicas: 10
  strategy:
    canary:
      canaryService: my-app-canary
      stableService: my-app-stable
      trafficRouting:
        nginx:
          stableIngress: my-app-ingress
      steps:
      - setWeight: 10
      - pause: {duration: 2m}
      - setWeight: 30
      - pause: {duration: 2m}
      
      # 自动分析
      - setWeight: 50
      - analysis:
          templates:
          - templateName: success-rate
          args:
          - name: service-name
            value: my-app
      
      - setWeight: 100
  
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app: my-app
  
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: app
        image: myregistry.com/app:v1.0.0
        ports:
        - containerPort: 8080
EOF

# 4. 更新镜像触发金丝雀发布
kubectl argo rollouts set image my-app app=myregistry.com/app:v2.0.0 -n production

# 5. 实时监控发布过程
kubectl argo rollouts get rollout my-app -n production --watch

# 6. 如果需要手动干预
kubectl argo rollouts promote my-app -n production  # 推进到下一步
kubectl argo rollouts abort my-app -n production    # 中止并回滚

# 只需 Argo CD
helm install argocd argo/argo-cd -n argocd --create-namespace

# Git 仓库组织
app-configs/
├── apps/
│   ├── service-a/
│   ├── service-b/
│   └── service-c/
└── argocd/
    └── applications.yaml  # 定义所有 Application

# 1. 核心三件套
helm install argocd argo/argo-cd -n argocd --create-namespace
helm install argo-rollouts argo/argo-rollouts -n argo-rollouts --create-namespace
helm install argocd-image-updater argo/argocd-image-updater -n argocd

# 2. Git 仓库结构（推荐 Monorepo）
infrastructure/
├── clusters/
│   ├── dev/
│   ├── staging/
│   └── production/
├── base/              # 公共配置
└── monitoring/        # 监控配置

app-manifests/
├── app-a/
│   ├── base/
│   └── overlays/
│       ├── dev/
│       ├── staging/
│       └── production/

# 全家桶部署
helm install argocd argo/argo-cd -n argocd --create-namespace
helm install argo-workflows argo/argo-workflows -n argo --create-namespace
helm install argo-rollouts argo/argo-rollouts -n argo-rollouts --create-namespace
helm install argo-events argo/argo-events -n argo-events --create-namespace
helm install argocd-image-updater argo/argocd-image-updater -n argocd

# 集成外部工具
- Vault (密钥管理)
- Harbor (镜像仓库)
- Prometheus + Grafana (监控)
- ELK (日志)

# base/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 1  # 基础配置
  template:
    spec:
      containers:
      - name: app
        image: myregistry.com/app:latest
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"

# overlays/production/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
bases:
- ../../base
patchesStrategicMerge:
- deployment-patch.yaml

# overlays/production/deployment-patch.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 10  # 生产环境副本数
  template:
    spec:
      containers:
      - name: app
        resources:
          requests:
            memory: "512Mi"
            cpu: "500m"
          limits:
            memory: "1Gi"
            cpu: "1000m"

# values-dev.yaml
replicaCount: 1
resources:
  limits:
    memory: 256Mi

# values-production.yaml
replicaCount: 10
resources:
  limits:
    memory: 2Gi
ingress:
  enabled: true
  hosts:
  - app.example.com

apiVersion: v1
kind: Secret
metadata:
  name: db-password
stringData:
  password: "MyP@ssw0rd123"  # 千万别这样！

# 方式 1: 使用 Sealed Secrets
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: db-password
spec:
  encryptedData:
    password: AgBxG7... # 加密后的密文，可以安全提交到 Git

# 方式 2: 使用 External Secrets Operator (推荐)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-password
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: db-password
  data:
  - secretKey: password
    remoteRef:
      key: database/production
      property: password

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  resource.customizations: |
    Secret:
      ignoreDifferences: |
        jsonPointers:
        - /data    

# 大规模集群配置（管理 100+ 应用）
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  # 并发同步数量
  application.sync.max-concurrent: "20"
  
  # 资源缓存时间
  timeout.reconciliation: "180s"
  
  # 使用 Server-side apply (提升性能)
  application.resourceTrackingMethod: "annotation+label"

# 资源限制模板
spec:
  templates:
  - name: cpu-intensive-task
    container:
      image: myapp
      resources:
        requests:
          memory: "2Gi"
          cpu: "2000m"
        limits:
          memory: "4Gi"
          cpu: "4000m"
    # 节点选择
    nodeSelector:
      workload: compute-intensive
    # 容忍度
    tolerations:
    - key: "dedicated"
      operator: "Equal"
      value: "workflows"
      effect: "NoSchedule"

# Prometheus ServiceMonitor for Argo CD
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: argocd-metrics
  namespace: argocd
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: argocd-server
  endpoints:
  - port: metrics

# 告警规则示例
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: argocd-alerts
  namespace: argocd
spec:
  groups:
  - name: argocd
    interval: 30s
    rules:
    
    # 应用同步失败告警
    - alert: ArgoAppSyncFailed
      expr: |
        argocd_app_info{sync_status="OutOfSync"} == 1        
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: "ArgoCD app {{ $labels.name }} sync failed"
    
    # 应用健康状态异常
    - alert: ArgoAppUnhealthy
      expr: |
        argocd_app_info{health_status!="Healthy"} == 1        
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: "ArgoCD app {{ $labels.name }} is unhealthy"

# 备份 ArgoCD 配置
kubectl get applications -n argocd -o yaml > argocd-apps-backup.yaml
kubectl get appprojects -n argocd -o yaml > argocd-projects-backup.yaml

# 备份 Workflows
kubectl get workflows -n argo -o yaml > workflows-backup.yaml
kubectl get workflowtemplates -n argo -o yaml > workflow-templates-backup.yaml

# 定期备份脚本
cat > backup-argo.sh <<'EOF'
#!/bin/bash
BACKUP_DIR="/backup/argo/$(date +%Y%m%d)"
mkdir -p $BACKUP_DIR

# 备份所有 Argo 资源
for ns in argocd argo argo-rollouts argo-events; do
  kubectl get all -n $ns -o yaml > $BACKUP_DIR/$ns-all.yaml
done

# 压缩并上传到 S3
tar -czf $BACKUP_DIR.tar.gz $BACKUP_DIR
aws s3 cp $BACKUP_DIR.tar.gz s3://my-backups/argo/
EOF

chmod +x backup-argo.sh

# 添加到 crontab（每天凌晨 2 点备份）
echo "0 2 * * * /path/to/backup-argo.sh" | crontab -

# 1. 启用 RBAC
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.default: role:readonly
  policy.csv: |
    # 开发者只能查看和同步
    p, role:developer, applications, get, */*, allow
    p, role:developer, applications, sync, */*, allow
    g, dev-team, role:developer
    
    # 管理员完全权限
    p, role:admin, *, *, *, allow
    g, admin-team, role:admin    

# 2. 启用 SSO（以 GitHub 为例）
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  url: https://argocd.example.com
  dex.config: |
    connectors:
    - type: github
      id: github
      name: GitHub
      config:
        clientID: $GITHUB_CLIENT_ID
        clientSecret: $GITHUB_CLIENT_SECRET
        orgs:
        - name: your-org    

# 3. 限制可部署的镜像仓库
data:
  resource.customizations: |
    argoproj.io/Application:
      health.lua: |
        -- 只允许来自信任仓库的镜像
        local allowed_registries = {
          "myregistry.com",
          "gcr.io/myproject"
        }    

# 限制 ArgoCD 出站流量
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argocd-egress
  namespace: argocd
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/part-of: argocd
  policyTypes:
  - Egress
  egress:
  # 允许访问 Kubernetes API
  - to:
    - namespaceSelector: {}
    ports:
    - protocol: TCP
      port: 443
  
  # 允许访问 Git 仓库
  - to:
    - podSelector: {}
    ports:
    - protocol: TCP
      port: 22
    - protocol: TCP
      port: 443

# 1. 查看应用详情
argocd app get my-app

# 2. 查看具体资源状态
kubectl get pods -n production
kubectl describe pod <pod-name> -n production

# 3. 查看日志
kubectl logs <pod-name> -n production

# 4. 强制刷新
argocd app sync my-app --force

# 创建 ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: workflow-executor
  namespace: argo

---
# 授予权限
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: workflow-executor
  namespace: argo
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "watch", "list"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: workflow-executor
  namespace: argo
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: workflow-executor
subjects:
- kind: ServiceAccount
  name: workflow-executor
  namespace: argo

---
# 在 Workflow 中使用
spec:
  serviceAccountName: workflow-executor

# 1. 查看 Rollout 状态
kubectl argo rollouts status my-app -n production

# 2. 查看分析结果
kubectl get analysisrun -n production
kubectl describe analysisrun <analysis-name> -n production

# 3. 如果是指标查询问题，检查 Prometheus
kubectl logs -n monitoring prometheus-server-xxx

# 4. 跳过当前分析（紧急情况）
kubectl argo rollouts promote my-app -n production --skip-current-step

# 5. 完全回滚
kubectl argo rollouts undo my-app -n production

# 1. 在 ArgoCD 中注册多个集群
argocd cluster add dev-cluster --name dev
argocd cluster add staging-cluster --name staging
argocd cluster add prod-cluster --name prod

# 2. 使用 ApplicationSet 管理多集群应用
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: my-app-multi-cluster
  namespace: argocd
spec:
  generators:
  - list:
      elements:
      - cluster: dev
        url: https://dev-cluster
        namespace: default
      - cluster: staging
        url: https://staging-cluster
        namespace: default
      - cluster: prod
        url: https://prod-cluster
        namespace: production
  
  template:
    metadata:
      name: 'my-app-{{cluster}}'
    spec:
      project: default
      source:
        repoURL: https://github.com/yourorg/configs.git
        targetRevision: main
        path: 'apps/my-app/overlays/{{cluster}}'
      destination:
        server: '{{url}}'
        namespace: '{{namespace}}'
      syncPolicy:
        automated:
          prune: true
          selfHeal: true

-- ConfigMap: argocd-cm
resource.customizations: |
  argoproj.io/Rollout:
    health.lua: |
      hs = {}
      if obj.status ~= nil then
        if obj.status.phase == "Healthy" then
          hs.status = "Healthy"
          hs.message = "Rollout is healthy"
          return hs
        end
        if obj.status.phase == "Degraded" then
          hs.status = "Degraded"
          hs.message = obj.status.message
          return hs
        end
      end
      hs.status = "Progressing"
      hs.message = "Waiting for rollout"
      return hs

# ArgoCD 通知配置
apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-notifications-cm
  namespace: argocd
data:
  # Slack 通知
  service.slack: |
    token: $slack-token    
  
  # 定义触发器
  trigger.on-sync-succeeded: |
    - when: app.status.operationState.phase in ['Succeeded']
      send: [app-sync-succeeded]    
  
  trigger.on-sync-failed: |
    - when: app.status.operationState.phase in ['Error', 'Failed']
      send: [app-sync-failed]    
  
  # 定义模板
  template.app-sync-succeeded: |
    message: |
      Application {{.app.metadata.name}} has been successfully synced.
      Sync Status: {{.app.status.sync.status}}
    slack:
      attachments: |
        [{
          "title": "{{.app.metadata.name}}",
          "title_link": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",
          "color": "good"
        }]    

# 第一步：安装 Argo CD（5 分钟）
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# 第二步：部署你的第一个应用（3 分钟）
argocd app create my-first-app \
  --repo https://github.com/argoproj/argocd-example-apps.git \
  --path guestbook \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace default

argocd app sync my-first-app

# 第三步：享受 GitOps 的魅力 🎉