https://github.com/basel5001/gitops-cluster
Full GitOps platform: ArgoCD + Crossplane + Kyverno + Argo Rollouts, multi-env promotion
https://github.com/basel5001/gitops-cluster
argo-rollouts argocd crossplane gitops kubernetes kyverno platform-engineering progressive-delivery
Last synced: about 22 hours ago
JSON representation
Full GitOps platform: ArgoCD + Crossplane + Kyverno + Argo Rollouts, multi-env promotion
- Host: GitHub
- URL: https://github.com/basel5001/gitops-cluster
- Owner: basel5001
- License: mit
- Created: 2026-06-30T18:58:19.000Z (25 days ago)
- Default Branch: main
- Last Pushed: 2026-07-19T02:06:55.000Z (6 days ago)
- Last Synced: 2026-07-19T04:08:10.101Z (6 days ago)
- Topics: argo-rollouts, argocd, crossplane, gitops, kubernetes, kyverno, platform-engineering, progressive-delivery
- Language: HCL
- Size: 29.3 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
- Security: SECURITY.md
Awesome Lists containing this project
README
# GitOps Cluster
Production-grade GitOps platform using ArgoCD, Crossplane, Kyverno, and Argo Rollouts
on Kubernetes. Multi-environment promotion with policy enforcement and infrastructure-as-code.
## Architecture
```
+---------------------+
| GitHub Repo |
| (Single Source of |
| Truth) |
+----------+----------+
|
git push / PR merge
|
+----------v----------+
| ArgoCD |
| (Continuous Sync) |
+----------+----------+
|
+--------------------+--------------------+
| | |
+---------v-------+ +---------v-------+ +---------v-------+
| dev (ns) | | staging (ns) | | prod (ns) |
| | | | | |
| Canary Rollout | | BlueGreen | | BlueGreen |
| (auto) | | (auto promote) | | (manual promote) |
+-----------------+ +-----------------+ +------------------+
+-------------------+ +-------------------+ +------------------+
| Crossplane | | Kyverno | | Argo Rollouts |
| (Infra Provision) | | (Policy Engine) | | (Prog. Delivery) |
+-------------------+ +-------------------+ +------------------+
```
## Repository Structure
```
gitops-cluster/
├── apps/ # Application manifests per environment
│ ├── dev/ # Dev environment (canary rollouts)
│ ├── staging/ # Staging environment (blue-green, auto)
│ └── prod/ # Production environment (blue-green, manual)
├── infra/ # Infrastructure components
│ ├── argocd/ # ArgoCD install + App-of-Apps
│ ├── crossplane/ # Crossplane + AWS provider + compositions
│ ├── kyverno/ # Kyverno + cluster policies
│ └── argo-rollouts/ # Argo Rollouts controller
├── terraform/ # EKS cluster bootstrap (Terraform)
├── .github/
│ ├── workflows/ # CI validation + security scanning
│ ├── PULL_REQUEST_TEMPLATE.md
│ └── ISSUE_TEMPLATE/
└── Makefile # Operational commands
```
## Quick Start
### Option A: Local Development (kind)
```bash
# Create a local cluster
kind create cluster --name gitops-cluster
# Bootstrap ArgoCD and the App-of-Apps
make bootstrap
# Get ArgoCD admin password
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d
# Port-forward ArgoCD UI
kubectl -n argocd port-forward svc/argocd-server 8080:443
# Open https://localhost:8080 (admin / )
```
### Option B: AWS EKS
```bash
# Initialize and apply Terraform
cd terraform/
terraform init
terraform plan
terraform apply
# Configure kubectl
aws eks update-kubeconfig --region us-east-1 --name gitops-cluster
# Bootstrap ArgoCD
make bootstrap
```
## App Promotion Workflow
```
1. Developer creates PR 4. Promote to staging
modifying apps/dev/ (update apps/staging/ via PR)
| |
v v
2. CI validates manifests 5. Auto blue-green deploy
(kubeconform + dry-run) to staging
| |
v v
3. Merge -> ArgoCD auto-sync 6. Promote to prod (PR)
canary rollout in dev Manual promotion required
(autoPromotionEnabled: false)
```
### Promoting an Application
**Dev -> Staging:**
```bash
# Copy and adapt the manifest
cp apps/dev/demo-app.yml apps/staging/demo-app.yml
# Edit: change namespace, environment label, replicas, strategy
# Create PR -> merge -> ArgoCD syncs automatically
```
**Staging -> Prod:**
```bash
# Same pattern, but prod uses manual blue-green promotion
cp apps/staging/demo-app.yml apps/prod/demo-app.yml
# Edit: change namespace, environment label, replicas
# After ArgoCD syncs, manually promote:
kubectl argo rollouts promote demo-app -n prod
```
## Components
### ArgoCD (App Delivery)
- **Install**: Helm chart v7.7.5 via ArgoCD Application
- **App-of-Apps**: ApplicationSet that auto-discovers `apps/*/` directories
- **Sync Policy**: Automated with prune and self-heal enabled
### Crossplane (Infrastructure Provisioning)
- **Provider**: Upbound AWS Provider Family v1.14.0
- **Compositions**: S3 bucket with encryption (AES256) and versioning
- **Usage**: Create a claim in any namespace:
```yaml
apiVersion: storage.xops.io/v1alpha1
kind: S3Bucket
metadata:
name: my-bucket
spec:
region: us-east-1
environment: dev
```
### Kyverno (Policy Enforcement)
| Policy | Action | Description |
|--------|--------|-------------|
| `require-labels` | Enforce | Requires `team` and `environment` labels on Deployments/StatefulSets |
| `disallow-privileged` | Enforce | Blocks privileged containers and running as root |
| `restrict-image-registries` | Enforce | Only allows images from ECR, GHCR, and Docker Hub official |
### Argo Rollouts (Progressive Delivery)
- **Dev**: Canary strategy (20% -> 50% -> 80% -> 100%, 30s pauses)
- **Staging**: Blue-green with automatic promotion
- **Prod**: Blue-green with manual promotion (requires `kubectl argo rollouts promote`)
## Makefile Targets
| Target | Description |
|--------|-------------|
| `make bootstrap` | Bootstrap ArgoCD and App-of-Apps |
| `make apply-infra` | Apply all infrastructure ArgoCD Applications |
| `make apply-apps` | Apply all app manifests directly |
| `make validate` | Validate all YAML with kubeconform |
| `make diff` | Show ArgoCD sync diff |
| `make terraform-plan` | Run Terraform plan for EKS |
| `make terraform-apply` | Apply Terraform for EKS |
| `make clean` | Remove all GitOps-managed resources |
## CI/CD Pipelines
- **CI** (`.github/workflows/ci.yml`): kubeconform validation, kubectl dry-run, Terraform validate/fmt
- **Security** (`.github/workflows/security.yml`): Gitleaks secret scanning, Trivy config scan, Checkov IaC scan
## Prerequisites
- `kubectl` v1.30+
- `kubeconform` v0.6.6+
- `argocd` CLI (for `make diff`)
- `terraform` v1.5+ (for EKS bootstrap)
- `kind` (for local development)
- AWS CLI configured (for EKS)
## License
MIT License - see [LICENSE](LICENSE) for details.