yanacuti1121/yana-ai/argocd-gitops

# application.yaml — deploy yamtam-agent from Helm chart in Git
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name:      yamtam-prod
  namespace: argocd
spec:
  project: default
 
  source:
    repoURL:        https://github.com/org/yamtam-config
    targetRevision: main
    path:           charts/yamtam-agent
    helm:
      valueFiles:
        - values-prod.yaml
      parameters:
        - name:  image.tag
          value: "1.3.52"
 
  destination:
    server:    https://kubernetes.default.svc
    namespace: yamtam
 
  syncPolicy:
    automated:
      prune:    true       # delete resources removed from Git
      selfHeal: true       # auto-revert manual kubectl changes
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground
      - ApplyOutOfSyncOnly=true
    retry:
      limit: 3
      backoff: { duration: 5s, factor: 2, maxDuration: 3m }

# root-app.yaml — manages all sub-applications
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: root
  namespace: argocd
spec:
  source:
    repoURL:        https://github.com/org/yamtam-config
    targetRevision: main
    path:           apps/          # directory with Application yamls
  destination:
    server:    https://kubernetes.default.svc
    namespace: argocd
  syncPolicy:
    automated: { prune: true, selfHeal: true }

# Manual sync (force re-apply)
argocd app sync yamtam-prod
 
# Wait for sync to complete
argocd app wait yamtam-prod --timeout 120
 
# Check sync status
argocd app get yamtam-prod
 
# Rollback to previous revision
argocd app rollback yamtam-prod
 
# Diff: what would change if synced now?
argocd app diff yamtam-prod

// Argo CD can trigger webhooks on sync events
import express from 'express'
const app = express()
app.post('/argocd/webhook', express.json(), (req, res) => {
  const { application, operation } = req.body
  if (operation?.sync?.result?.resources?.some(r => r.status === 'OutOfSync')) {
    console.warn('[argocd] DRIFT DETECTED in', application.metadata.name)
    alertOncall({ app: application.metadata.name, status: 'OutOfSync' })
  }
  if (operation?.sync?.result?.phase === 'Failed') {
    console.error('[argocd] SYNC FAILED:', application.metadata.name)
  }
  res.sendStatus(200)
})

❌ automated.selfHeal: false → drift from manual changes persists until next manual sync
❌ automated.prune: false → deleted resources from Git remain in cluster (ghost resources)
❌ Secrets in Git → Argo CD syncs them in plaintext; use External Secrets Operator
❌ No retry policy → transient webhook/network error causes permanent OutOfSync state
❌ App-of-Apps without wave sync-order → child apps create resources before CRDs exist
❌ targetRevision: HEAD → always tracks latest commit including broken commits; use branch or tag