ArgoCD GitOps Setup

This document explains the ArgoCD configuration and GitOps deployment patterns used in this monorepo.

🎯 Overview

ArgoCD provides continuous deployment using GitOps principles, automatically synchronizing Kubernetes resources from this Git repository. The setup includes infrastructure components and application services managed through ApplicationSets with support for multiple environments.

📁 Directory Structure

argocd/
├── appsets/                  # ArgoCD ApplicationSets
│   └── dev/                 # Development environment
│       ├── infra.yaml       # Infrastructure ApplicationSet
│       └── services.yaml    # Services ApplicationSet
├── infra/                   # Infrastructure components
│   ├── cert-manager/        # TLS certificate management (self-signed CA)
│   ├── cnpg-system/        # CloudNativePG operator
│   ├── external-secrets/    # External secrets with password generation
│   ├── kafka/              # Apache Kafka with Strimzi operator
│   ├── kafka-ui/           # Kafka management UI
│   ├── maildev/            # Development email server with SMTP
│   ├── minio/              # S3-compatible object storage
│   ├── reflector/          # Secret/ConfigMap replication
│   └── strimzi/            # Kafka operator
└── services/               # Application services
    ├── api/                # API gateway service
    ├── auth/               # Authentication service (socat proxy)
    ├── common/             # Shared database cluster and secrets
    └── temporal/           # Temporal server with UI (dev/prod envs)

🚀 ApplicationSets

ApplicationSets automatically create and manage ArgoCD Applications based on Git repository structure.

Infrastructure ApplicationSet

Manages core infrastructure components with Go templating:

apiVersion: [argoproj.io/v1alpha1](<http://argoproj.io/v1alpha1>)
kind: ApplicationSet
metadata:
  name: infra
  namespace: argocd
spec:
  ignoreApplicationDifferences:
    - jsonPointers:
        - /spec/syncPolicy
  goTemplate: true
  goTemplateOptions: ["missingkey=error"]
  generators:
    - git:
        repoURL: [file:///mnt/monorepo-template.git](file:///mnt/monorepo-template.git)
        revision: HEAD
        directories:
          - path: argocd/infra/*/envs/dev
  template:
    metadata:
      name: "{{ index .path.segments 2 }}"
    spec:
      project: default
      source:
        repoURL: [file:///mnt/monorepo-template.git](file:///mnt/monorepo-template.git)
        targetRevision: HEAD
        path: "{{ .path.path }}"
      destination:
        server: [<https://kubernetes.default.svc>](<https://kubernetes.default.svc>)
        namespace: "{{ index .path.segments 2 }}"
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true
          - ApplyOutOfSyncOnly=true

Services ApplicationSet

Manages application services in the services namespace:

apiVersion: [argoproj.io/v1alpha1](<http://argoproj.io/v1alpha1>)
kind: ApplicationSet
metadata:
  name: services
  namespace: argocd
spec:
  ignoreApplicationDifferences:
    - jsonPointers:
        - /spec/syncPolicy
  goTemplate: true
  goTemplateOptions: ["missingkey=error"]
  generators:
    - git:
        repoURL: [file:///mnt/monorepo-template.git](file:///mnt/monorepo-template.git)
        revision: HEAD
        directories:
          - path: argocd/services/*/envs/dev
  template:
    metadata:
      name: "{{ index .path.segments 2 }}"
    spec:
      project: default
      source:
        repoURL: [file:///mnt/monorepo-template.git](file:///mnt/monorepo-template.git)
        targetRevision: HEAD
        path: "{{ .path.path }}"
      destination:
        server: [<https://kubernetes.default.svc>](<https://kubernetes.default.svc>)
        namespace: services
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true
          - ApplyOutOfSyncOnly=true

🏗 Infrastructure Components

cert-manager

• Purpose: Self-signed certificate authority for TLS
• Features: ClusterIssuer with self-signed CA, automatic certificate generation
• Namespace: cert-manager

apiVersion: [cert-manager.io/v1](<http://cert-manager.io/v1>)
kind: ClusterIssuer
metadata:
  name: selfsigned-cluster-issuer
spec:
  ca:
    secretName: selfsigned-ca