GitOps for Infrastructure: How We Deploy With Zero SSH

Traditional:     Developer → kubectl apply → Cluster
GitOps:          Developer → Git PR → CI Review → ArgoCD → Cluster

Repositories:
├── app-service-a/          # Application code + Dockerfile
├── app-service-b/          # Application code + Dockerfile
└── infrastructure/          # All K8s manifests
    ├── base/               # Shared configurations
    │   ├── namespaces/
    │   ├── network-policies/
    │   └── rbac/
    ├── services/
    │   ├── api-service/
    │   │   ├── deployment.yaml
    │   │   ├── service.yaml
    │   │   ├── hpa.yaml
    │   │   └── kustomization.yaml
    │   └── payment-service/
    └── environments/
        ├── staging/
        │   └── kustomization.yaml
        └── production/
            └── kustomization.yaml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: production-services
spec:
  project: default
  source:
    repoURL: https://github.com/org/infrastructure
    targetRevision: main
    path: environments/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true        # Delete resources removed from Git
      selfHeal: true     # Revert manual changes
    syncOptions:
      - CreateNamespace=true

# 1. Developer pushes code to app repo
# 2. CI builds image: api-service:sha-abc123
# 3. CI updates infrastructure repo:

# Automated PR to infrastructure repo
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-service
spec:
  template:
    spec:
      containers:
        - name: api
          image: registry/api-service:sha-abc123  # Updated by CI

# GitHub Actions: Update image tag
- name: Update manifest
  run: |
    cd infrastructure
    kustomize edit set image api-service=registry/api-service:${{ github.sha }}
    git add .
    git commit -m "deploy: api-service ${{ github.sha }}"
    git push

# Who changed what and when?
git log --oneline environments/production/
# a1b2c3d deploy: api-service sha-abc123 (2024-03-15)
# d4e5f6g feat: add rate limiting to api (2024-03-14)
# g7h8i9j fix: increase memory limit for payment (2024-03-13)

# Rollback = revert a commit
git revert HEAD
git push
# ArgoCD detects change, reverts cluster to previous state
# Total time: ~90 seconds

# environments/staging/kustomization.yaml
bases:
  - ../../services/api-service
patchesStrategicMerge:
  - replicas-patch.yaml  # 1 replica instead of 3

# environments/production/kustomization.yaml  
bases:
  - ../../services/api-service
patchesStrategicMerge:
  - replicas-patch.yaml  # 3 replicas
  - resources-patch.yaml # More CPU/memory

# Cluster dies? No problem.
# 1. Provision new cluster
# 2. Install ArgoCD
# 3. Point ArgoCD at Git repo
# 4. Everything reconverges automatically

# Recovery time: ~15 minutes (cluster provisioning)
# Data loss: zero (Git has everything)

Old way: "I'll just quickly fix this in production" (kubectl edit)
New way: "I'll open a PR to fix this" (5 minutes longer, 100% safer)