Manifest backup — Git as the source of truth

The manifest backup is the Git as the source of truth. The GitOps workflow, the version control, the rollback are the components. This lesson walks the manifest backup, the GitOps workflow, the rollback, and the production patterns.

Git as the source of truth

The Git as the source of truth:

flowchart LR
    A[Git] --> B[GitOps controller]
    B --> C[Cluster]
    C --> D[Actual state]
    B --> D
    D --> A

The Git is the source of truth.

The GitOps workflow

The GitOps workflow:

flowchart LR
    A[Developer] --> B[Git]
    B --> C[GitOps controller]
    C --> D[Cluster]
    D --> A[Feedback]

The GitOps workflow is the development cycle.

The Argo CD

The Argo CD:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/my-org/my-app
    targetRevision: HEAD
    path: manifests/
  destination:
    server: https://kubernetes.default.svc
    namespace: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

The Argo CD is the canonical GitOps controller.

The Flux

The Flux:

apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: GitRepository
metadata:
  name: my-app
  namespace: flux-system
spec:
  interval: 10m
  url: https://github.com/my-org/my-app
  ref:
    branch: main

The Flux is the alternative GitOps controller.

The GitOps rollback

The GitOps rollback:

# Substitute your own value before running (the commit to undo):
COMMIT=9f3c1d2a7b4e5f60a1b2c3d4e5f60718293a4b5c

# Roll back the Git commit
git revert "$COMMIT"
git push origin main

# The GitOps controller applies the rollback
# The cluster is rolled back to the previous state

The GitOps rollback is the Git revert.

The GitOps reconciliation

The GitOps reconciliation:

sequenceDiagram
    participant Git
    participant Controller as GitOps controller
    participant Cluster
    Controller->>Git: detect change
    Git-->>Controller: new commit
    Controller->>Cluster: apply manifest
    Cluster-->>Controller: deployment result
    Controller->>Git: report status

The reconciliation is the GitOps loop.

The branch protection

The branch protection:

# GitHub branch protection for the main branch
# Require pull request reviews before merging
# Require status checks to pass before merging
# Require signed commits
# Require linear history

The branch protection is the GitOps safety net.

The signed commits

The signed commits:

# Sign the commit
git commit -S -m "Deploy my-app v1.0.0"

# The commit just created; substitute another hash to verify a different one
COMMIT=$(git rev-parse HEAD)

# Verify the commit
git verify-commit "$COMMIT"

The signed commits are the GitOps verification.

The disaster recovery

The disaster recovery:

# Re-clone the Git repository
git clone https://github.com/my-org/my-app

# The GitOps controller applies the manifests
# The cluster is reconstituted from the manifests

The disaster recovery is the Git clone.

The GitOps production patterns

The GitOps production patterns:

flowchart LR
    A[Git] --> B[Pull request]
    B --> C[Review]
    C --> D[Merge]
    D --> E[GitOps controller]
    E --> F[Cluster]

The pattern is the production discipline.

The cross-course references

• The GitOps course covers the Argo CD and Flux.
• The Git course covers the branching, the review.
• The Disaster Recovery course covers the recovery strategy.

Quiz

Production discipline

• Use Git as the source of truth. The manifest version control.
• Use the GitOps controller. Argo CD or Flux.
• Configure the branch protection. The main branch.
• Use signed commits. The audit trail.
• Configure the rollback. Git revert.
• Document the manifest backup. The workflow, the rollback.

The manifest backup is the GitOps source of truth. Operating it well is the Git repository, the GitOps controller, the branch protection, and the production patterns.