Linux: CICD-ArgoCD

# 非高可用 HA
kubectl create namespace argocd

## 指定版本
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/install.yaml

## 最新版本
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# HA
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://github.com/argoproj/argo-cd/blob/stable/manifests/ha/install.yaml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  # ArgoCD 页面展示的应用名称，prod 环境实例
  name: order-prod
  # Application CR 自身存放的命名空间，固定 argocd(所有 Argo 应用都在这里)
  namespace: argocd
  # 删除应用时同步删除集群资源（级联删除）
  finalizers:
  - resources-finalizer.argocd.argoproj.io
spec:
  # 归属项目（权限隔离），default 为默认项目
  project: default

  # Source： Git 期望状态源（Kustomize/Helm/原生Yaml）
  source:
    repoURL: https://github.com/user/my-repo.git
    targetRevision: main # 分支/tag/commit hash
    path: app/order/prod
    directory:         # 纯 yaml/kustomize 目录配置
      resourse: true   # 是否递归扫描子目录
      include: "{*.yaml, *.yml}"
      exclude:         # 排队文件
      - *.tmp
    # Helm 专用配置
    helm:
      valueFiles:
      - values-prod.yaml
      valueObject:
        replicaCount: 3
      values: |
        image:
          repository: user/my-image
          pullPolicy: Always
          tag: xxx
    # Kustomize 专用
    kustomize:
      version: v5

  # Destination：部署目标集群和命名空间
  destination:
    # 本地集群： https://kubernetes.default.svc
    server: https://esk-prod.ap-southeast-1.eks.amazonaws.com
    namespace: order-prod

  # SyncPolicy 自动同步/自愈/修剪策略（GitOps 核心）
  syncPolicy:
    automated:
      prune: true          # git 删除资源，集群同步
      selfHeal: true       # 集群手动篡改，自动恢复 git 状态
      allowEmpty: false    # 不允许同步后无资源
    syncOptions:
    - CreateNamespace=true # 不存在 ns 自动创建
    - PrunePropagationPolicy=forground
    retry: # 部署失败自动重试
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

# status: ArgoCD 自动填充，只读
status:
  sync:
    status: Synced # Synced/OutOfSync/Unknown
  health:
    status: Healthy # Healthy/Progressing/Degraded/Missing

# 应用代码仓库 (app-repo)
app-repo/
├── src/
├── tests/
├── Dockerfile
├── .github/
│   └── workflows/
│       └── ci.yaml
└── README.md

# 部署配置仓库 (deploy-repo)
deploy-repo/
├── apps/
│   ├── frontend/
│   │   ├── base/
│   │   │   ├── deployment.yaml
│   │   │   ├── service.yaml
│   │   │   └── kustomization.yaml
│   │   └── overlays/
│   │       ├── dev/
│   │       ├── staging/
│   │       └── prod/
│   └── backend/
├── argocd/
│   └── applications/
└── README.md

argocd-demo % tree manifest
manifest
├── dev
│   ├── 01-namespace.yaml
│   ├── 02-service.yaml
│   └── 03-deployment.yaml
├── prod
│   ├── 01-namespace.yaml
│   ├── 02-service.yaml
│   └── 03-deployment.yaml
└── test
    ├── 01-namespace.yaml
    ├── 02-service.yaml
    └── 03-deployment.yaml

cat <<\EOF>> manifest/application.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: spring-boot-helloworld-test
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://gitee.com/lbtooth/argocd-demo.git  # 必须要在 coredns 中实现域名 gitlab.xx.com 解析
    targetRevision: HEAD
    path: manifest/test
    directory:
      resourse: true  # 是否递归扫描子目录
      include: "{*.yaml, *.yml}"
      exclude: "{README.md, dos/**,scripts/*.sh}"
  destination:
    # 应用在当前集群
    server: https://kubernetes.default.svc
    namespace: test
  # 同步策略
  syncPolicy:
    # 开启 git 变更同步
    automated:
      prune: true          # git 删除资源，集群同步
      selfHeal: true       # 集群手动篡改，自动回滚为 git 标准配置
      allowEmpty: false    # 不允许同步后无资源
    # 定时轮询拉取 git 仓库
    syncOptions:
    - CreateNamespace=true # 目标不存在 namespace 则自动创建
    # 同步重试机制（部署失败自动重试）
    retry:
      limit: 3
      backoff:
        duration: "30s"
        factor: 2
        maxDuration: "5m"
EOF

kubectl apply -f application.yaml

kubectl get applications -n argocd

kubectl get pod -n test

# 手动修改副本数
kubectl scale deploy -n test --replicas 3 spring-boot-helloworld; kubectl get pod -n test
# 过一会儿副本数又恢复为 1 个副本
kubectl get pod -n test

# 复用一套配置，overlays 打补丁
argocd-demo % tree kustomization
kustomization
├── base
│   ├── deployment.yaml
│   ├── kustomization.yaml
│   └── service.yaml
└── overlays
    ├── dev
    │   └── kustomization.yaml
    ├── prod
    │   └── kustomization.yaml
    └── test
        └── kustomization.yaml


kubectl create deploy nginx --image=nginx:1.15.12 --replicas=2 -oyaml --dry-run=client >base/deployment.yaml 
kubectl create svc clusterip nginx --tcp=8080:80 -o yaml --dry-run=client > base/service.yaml
cat > kustomization.yaml << EOF
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml
- service.yaml
EOF

cat <<\EOF>> kustomize/dev.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: spring-boot-hello-dev
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://gitee.com/lbtooth/argocd-demo.git
    targetRevision: HEAD
    path: kustomization/overlays/dev
    # Kustomize 专用
    kustomize:
      # kustomize 渲染时自动给所有资源添加 namespace: dev，优先级高于 kustomization/overlays/test/kustomization.yaml
      namespace: dev
  destination:
    server: https://kubernetes.default.svc
    # 指定 k8s 集群最终放在业务 pod/service 的命名空间，优先级高于上面的 kustomize.namespace
    namespace: dev
  # 同步策略
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    retry:
      limit: 5
      backoff:
        duration: "30s"
        factor: 2
        maxDuration: "5m"
    syncOptions:
    - CreateNamespace=true
EOF

argocd-demo % tree chart
chart
├── Chart.yaml
├── templates
│   ├── _helpers.tpl
│   ├── deployment.yaml
│   ├── ingress.yaml
│   ├── NOTES.txt
│   └── service.yaml
├── values-dev.yaml
├── values-prod.yaml
├── values-test.yaml
└── values.yaml

cat <<\EOF>> helm/dev.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: spring-boot-hello-dev
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://gitee.com/lbtooth/argocd-demo.git
    targetRevision: HEAD
    path: chart
    helm:
      valueFiles:
      - values.yaml     # 基础文件
      - values-dev.yaml # 补充文件
  destination:
    server: https://kubernetes.default.svc
    namespace: dev
  # 同步策略
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
     retry:
      limit: 5
      backoff:
        duration: "30s"
        factor: 2
        maxDuration: "5m"
    syncOptions:
    - CreateNamespace=true
EOF

cat <<\EOF>> manifest/applicationset.yaml
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: spring-boot-helloworld
  namespace: argocd
spec:
  generators:
  - list:
      elements:
      - env: dev
        path: manifest/dev
        ns: dev
      - env: test
        path: manifest/test
        ns: test
      - env: prod
        path: manifest/prod
        ns: prod
  template:
    metadata:
      name: 'sprint-boot-helloword-{{env}}'
      namespace: argocd
    spec:
      project: default
      source:
        repoURL: https://gitee.com/lbtooth/argocd-demo.git
        targetRevision: HEAD
        path: "{{path}"
        directory:
          resourse: true
          include: "{*.yaml, *.yml}"
          exclude: "{README.md,dos/**,scripts/*.sh}"
      destination:
        server: https://kubernetes.default.svc
        namespace: dev
      # 同步策略
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
          allowEmpty: false
        retry:
          limit: 5
          backoff:
            duration: "30s"
            factor: 2
            maxDuration: "5m"
        syncOptions:
        - CreateNamespace=true
EOF

cat > argocd/kustomize/applicationset.yaml  << EOF
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: nginx
  namespace: argocd
spec:
  generators:
  - list:
      elements:
      - env: dev
        business: pt
        path: pt/argocd/tmp/overlays/dev
        k8s-cluster: https://kubernetes.default.svc
        ns: default
      - env: test
        business: pt
        path: pt/argocd/tmp/overlays/test
        k8s-cluster: https://kubernetes.default.svc
        ns: test
      - env: prod
        business: pt
        path: pt/argocd/tmp/overlays/prod
        k8s-cluster: https://kubernetes.default.svc
        ns: prod
  template:
    metadata:
      name: '{{business}}-nginx-{{env}}'
      namespace: argocd
    spec:
      project: default
      source:
        repoURL: git@git.xxx.com:gitops/ops-deploy.git
        targetRevision: HEAD
        path: "{{path}}"
        kustomize:
          namespace: "{{ns}}"
      destination:
        server: "{{k8s-cluster}}"
        namespace: "{{ns}}"
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
          allowEmpty: false
        retry:
          limit: 5
          backoff:
            duration: "30s"
            factor: 2
            maxDuration: "5m"
        syncOptions:
        - CreateNamespace=true
EOF

curl -sSL -o argocd-linux-amd64 https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
sudo install -m 555 argocd-linux-amd64 /usr/local/bin/argocd
rm argocd-linux-amd64

# Mac
brew install argocd

echo 'source <(argocd completion bash)' >> ~/.bashrc
source  ~/.bashrc

# 获取密码方法1
argocd admin initial-password -n argocd
# 获取密码方法2：k8s 集群内执行
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d

# 修改前，先登录 admin
argocd login argocd.xxx.com --username admin --password <初始密码> --insecure
## 修改密码。输入旧密码，再输入新密码
argocd account update-password

# 注销后用新密码登录
argocd logout argocd.xx.com
argocd login argocd.xxx.com

--server    #指定 ArgoCDServer 访问地址。适用多套 ArgoCD 环境切换登录
--username  #登录用户名。脚本自动化登录，无需交互式输入
--password  #登录密码。自动化脚本批量执行 argocd login
--insecure  #跳过 TLS 证书校验。测试环境自签证书、内网无合法SSL证书
--grpc-web  #使用 grpc-web 协议通信。通过 Ingress/LB 访问 ArgoCD 服务，必备参数
--timeout   #设置请求超时时间。适用于网络较差、跨机房访问，防止命令超时失败
-y/--yes    #所有交互式确认自动选择 yes。适用于自动化脚本、CI 流水线,避免等待人工确认

argocd login                   #登录ArgoCD服务端,保存本地token。如 
argocd login argocd.example.com --username admin password xxx

argocd logout                  #退出登录,清除本地凭证。如 
argocd logout argocd.example.com

argocd account update-password #修改当前登录用户密码

argocd account list            #列出所有用户账号


argocd context list            #查看本地保存的多个 argocd 服务连接

argocd context switch          #切换本地 argocd 服务上下文
argocd context switch argocd-prod

argocd app list  # 查询所有 application 列表
argocd app list -o wide

argocd app get <应用名>  # 查看单个应用详情

argocd app create       # 创建 application cr（命令行创建，替代 yaml apply）
argocd app create order-svc --repo https://gitlab/xxx \
   --path manifests \
   --dest-server https://k8s/api \
   --dest-namespace prod \
   --project prod-project

argocd app delete       # 删除应用

argocd proj xxx

argocd repo list
argocd repo xx

argocd cluster list
argocd cluster xx

argocd admin settings get # 读取全局 argocd-cm 配置
argocd admin settings edit # 直接编辑全局配置

argocd app sync --all # 同步集群内所有应用
argocd app list --sync-status OutOfSync  # 筛选所有不同步的应用
argocd app list --health-status Degraded # 筛选异常不健康应用
argocd app teminate-op                   # 终止卡住的同步操作

argocd app export # 导出 application 完整 yaml
argocd app export order-svc > app-order.yaml

argocd proj export # 导出 AppProject 完整 yaml

argocd app get nginx-dev

# 树形层级展示（看父子关系：Deployment → ReplicaSet → Pod）
argocd app resources nginx-dev --output tree

# 查看 Git 渲染出来的全部 yaml 清单
argocd app manifests nginx-dev

kubectl get application nginx-dev -n argocd -o yaml
# 重点看 status.resources 数组，里面记录所有托管资源
kubectl describe application nginx-dev -n argocd

# 提前恢复注解刷新能力。 修改 configMap argocd-cm
APP=nginx-dev
kubectl annotate -n argocd app ${APP} argocd.argoproj.io/refresh=hard --overwrite

# 方法1: ArgoCD UI回滚
# 在History页面选择之前版本Sync

# 方法2: 命令行回滚
argocd app rollback myapp-prod

# 方法3: Git revert（推荐）
cd deploy-repo
git revert HEAD
git push

pipeline {
    agent any

    options {
        withBuildUser()
    }
    environment {
        BUSINESS = "rl"
        DEPLOY_ENV = "dev"
        
        jobname = "${JOB_BASE_NAME}"
        OPS_GIT_URL = 'git@1.x.x.x:gitops/ops-deploy.git'
        OPS_PATH = "ops-deploy/${BUSINESS}/${jobname}/overlays/${DEPLOY_ENV}"
        image_url="public.ecr.aws/xxx/${jobname}:v${BUILD_NUMBER}"

        ARGO_APP = "${jobname}" + "-${DEPLOY_ENV}"
        ARGOCD_SERVER   = 'argocd.xxx.com:80'
        GITOPS_SHA = 'HEAD'
    }

    stages {

        
        stage('create deployment yaml') {
            steps {
                script {
                  //configFileProvider([configFile(fileId: 'eks-config', targetLocation: "eks-config")]){
                  //    sh """
                  //    /root/bin/kubectl --kubeconfig=/root/.kube/config-dev set image deployment/${jobname} ${jobname}=${image_url}
                  //    """
                  //} 
                  dir("ops-deploy") {
                    git branch: 'main',  changelog: false, poll: false, credentialsId: 'git-argocd', url: OPS_GIT_URL
                  }
                  dir(OPS_PATH) {
                    withCredentials([sshUserPrivateKey(credentialsId: 'git-argocd', keyFileVariable: 'PK')]) {
                      sh """
                      ls -l
                      yq '.images[0].newTag = "v" + strenv(BUILD_NUMBER)' kustomization.yaml 
                      git status
                      yq -i '.images[0].newTag = "v" + strenv(BUILD_NUMBER)' kustomization.yaml
                      git status
                      GIT_SSH_COMMAND="ssh -i $PK" git pull origin main
                      git add kustomization.yaml
                      git commit -m "Ci: ${jobname}.${DEPLOY_ENV}.${BUSINESS} image: ${image_url}"
                      GIT_SSH_COMMAND="ssh -i $PK" git push  origin HEAD:main
                      """
                    }
                  }
                }
            }
        }

        stage('Argo CD Deploy') {
            steps {
                withCredentials([
                    string(
                        credentialsId: 'argocd-token',
                        variable: 'ARGOCD_AUTH_TOKEN'
                    )
                ]) {
                    sh '''
                        echo "$ARGOCD_AUTH_TOKEN"
                        argocd app sync "$ARGO_APP" \
                          --server "$ARGOCD_SERVER" \
                          --grpc-web \
                          --plaintext \
                          --auth-token "$ARGOCD_AUTH_TOKEN" \
                          --revision "$GITOPS_SHA" \
                          --timeout 600

                        argocd app wait "$ARGO_APP" \
                          --server "$ARGOCD_SERVER" \
                          --grpc-web \
                          --plaintext \
                          --auth-token "$ARGOCD_AUTH_TOKEN" \
                          --sync \
                          --health \
                          --operation \
                          --timeout 600
                    '''
                }
            }
        }
    }
    post {
        success {
            script {
                notifyLark('SUCCESS')
            }
        }

        failure {
            script {
                notifyLark('FAILURE')
            }
        }

        aborted {
            script {
                notifyLark('ABORTED')
            }
        }
    }
}

import groovy.json.JsonOutput
def notifyLark(String result) {
    def success = result == 'SUCCESS'
    def title = success ? '✅ Argo CD 发布成功' : '❌ Argo CD 发布失败'
    def color = success ? 'green' : 'red'

    withCredentials([
        string(
            credentialsId: 'lark-release-webhook',
            variable: 'LARK_WEBHOOK'
        )
    ]) {
        def payload = JsonOutput.toJson([
            msg_type: 'interactive',
            card: [
                header: [
                    template: color,
                    title: [
                        tag    : 'plain_text',
                        content: title
                    ]
                ],
                elements: [
                    [
                        tag: 'markdown',
                        content: """\
**项目：** ${BUSINESS ?: 'unknown'}
**应用：** ${ARGO_APP ?: 'unknown'}
**环境：** ${DEPLOY_ENV ?: 'unknown'}
**GitOps SHA：** `${env.GITOPS_SHA ?: 'unknown'}`
**构建任务：** ${env.JOB_NAME} #${env.BUILD_NUMBER} by ${env.BUILD_USER}
**发布结果：** ${result}
**详情：** [查看 Jenkins 构建](${env.BUILD_URL})
""".stripIndent()
                    ]
                ]
            ]
        ])

        writeFile file: 'lark-message.json', text: payload

        sh '''
            curl --fail-with-body \
              --silent \
              --show-error \
              --request POST \
              --header 'Content-Type: application/json' \
              --data @lark-message.json \
              "$LARK_WEBHOOK"
        '''
    }
}