GitOps Workflow: Git as Single Source of Truth

gitops-repo/
├── apps/
│   ├── production/
│   │   ├── myapp/
│   │   │   ├── deployment.yaml
│   │   │   ├── service.yaml
│   │   │   ├── ingress.yaml
│   │   │   └── kustomization.yaml
│   │   └── database/
│   │       ├── statefulset.yaml
│   │       └── service.yaml
│   │
│   ├── staging/
│   │   └── myapp/
│   │       ├── deployment.yaml
│   │       ├── service.yaml
│   │       └── kustomization.yaml
│   │
│   └── dev/
│       └── myapp/
│           └── ...
│
├── infrastructure/
│   ├── namespaces/
│   │   ├── production.yaml
│   │   ├── staging.yaml
│   │   └── dev.yaml
│   │
│   ├── ingress-controller/
│   │   └── nginx-ingress.yaml
│   │
│   └── monitoring/
│       ├── prometheus/
│       └── grafana/
│
├── argocd/
│   ├── applications/
│   │   ├── myapp-production.yaml
│   │   ├── myapp-staging.yaml
│   │   └── infrastructure.yaml
│   │
│   └── projects/
│       └── default-project.yaml
│
└── README.md

# argocd/applications/myapp-production.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp-production
  namespace: argocd
spec:
  # Where the app is defined in Git
  source:
    repoURL: https://github.com/myorg/gitops-repo
    targetRevision: main
    path: apps/production/myapp

  # Where to deploy
  destination:
    server: https://kubernetes.default.svc
    namespace: production

  # Sync policy
  syncPolicy:
    automated:
      prune: true      # Delete resources not in Git
      selfHeal: true   # Revert manual changes
      allowEmpty: false

    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground
      - PruneLast=true

    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

  # Health assessment
  ignoreDifferences:
    - group: apps
      kind: Deployment
      jsonPointers:
        - /spec/replicas  # Ignore HPA changes

  # Notifications
  notifications:
    - when: on-sync-succeeded
      destination: slack
    - when: on-sync-failed
      destination: pagerduty

# PR approval workflow
name: GitOps PR Validation

on:
  pull_request:
    paths:
      - 'apps/**'
      - 'infrastructure/**'

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Validate Kubernetes YAML
        run: |
          kubeval apps/**/*.yaml
          kustomize build apps/production/myapp | kubeval -          

      - name: Dry-run in staging
        run: |
          kubectl apply --dry-run=server -k apps/staging/myapp          

      - name: Security scan
        run: |
          kubesec scan apps/production/myapp/deployment.yaml          

      - name: Policy check
        run: |
          conftest test apps/production/myapp/*.yaml          

  require-approval:
    needs: validate
    runs-on: ubuntu-latest
    steps:
      - name: Check required approvals
        if: contains(github.event.pull_request.files, 'apps/production')
        run: |
          # Require 2 approvals for production changes
          APPROVALS=$(gh pr view ${{ github.event.pull_request.number }} --json reviews -q '.reviews | length')
          if [ "$APPROVALS" -lt 2 ]; then
            echo "Production changes require 2 approvals"
            exit 1
          fi