1 Kubernetes accepts human commands.
Argo rejects human authority.
🧩 Task 2: Manual Image Change (Hotfix Attempt)
kubectl -n grade edit deployment grade-submission-api
Enter fullscreen mode
Exit fullscreen mode
Change:
image: nginx:latest
Enter fullscreen mode
Exit fullscreen mode
Emergency hotfixes without Git are temporary illusions.
kubectl -n grade delete pod -l app=grade-submission-api
Enter fullscreen mode
Exit fullscreen mode
Kubernetes heals pods.
Argo heals configuration.
FAILURE, ROLLBACK, SYNC CONTROL
🧩 Task 4: Break App via Git (Controlled Failure)
throw new Error("Production crash");
Enter fullscreen mode
Exit fullscreen mode
Commit & push.
GitOps does NOT prevent bugs.
It makes them traceable.
🧩 Task 5: Diagnose via Argo CD UI
Inside app view:
Show:
Argo CD shows what is broken, not why code is bad.
🧩 Task 6: Rollback Using Git Only
git revert <bad_commit> git push
Enter fullscreen mode
Exit fullscreen mode
Rollback is Git history, not kubectl.
🧩 Task 7: Disable Auto-Sync (Manual Control Mode)
Edit Application:
syncPolicy: {}
Enter fullscreen mode
Exit fullscreen mode
Apply change.
Now:
Click SYNC manually.
Mode
Use
Auto-sync
Dev
Manual
Prod
PRODUCTION SAFETY & GOVERNANCE
🧩 Task 8: Prune (Delete via Git)
Delete deployment from GitOps repo:
git rm deployment.yaml git commit -m "remove app" git push
Enter fullscreen mode
Exit fullscreen mode
If it’s not in Git, it must not exist.
🧩 Task 9: Re-Add Deployment (Recovery)
Restore file:
git checkout HEAD~1 deployment.yaml git commit -m "restore app" git push
Enter fullscreen mode
Exit fullscreen mode
Git is both destruction and recovery.
🧩 Task 10: Add Resource via Git Only
Add Service manifest.
Commit & push.
Git is the only deployment interface.
🧩 Task 11: Simulate Unauthorized Change
kubectl -n grade delete svc <service-name>
Enter fullscreen mode
Exit fullscreen mode
Argo enforces compliance automatically.
🧩 Task 12: Governance Discussion (No Commands)
Discuss:
“How would you safely deploy a hotfix in production?”
Expected answer:
“You are no longer deploying applications.
You are managing desired state.”
✅ GitOps authority
✅ Drift detection
✅ Self-healing
✅ Rollback via Git
✅ Production safety
✅ Enterprise patterns
second project:
MODULE 1 — Argo Rollouts (Progressive Delivery)
Show that:
This is next-level DevOps.
Traditional Deployment:
Argo Rollouts:
“Kubernetes deploys pods.
Argo Rollouts deploys risk-controlled releases.”
Lab 1.1 — Install Argo Rollouts
kubectl create namespace argo-rollouts kubectl apply -n argo-rollouts \ -f https://raw.githubusercontent.com/argoproj/argo-rollouts/stable/manifests/install.yaml
Enter fullscreen mode
Exit fullscreen mode
Verify:
kubectl get pods -n argo-rollouts
Enter fullscreen mode
Exit fullscreen mode
Lab 1.2 — Convert Deployment → Rollout (GitOps)
In GitOps repo, replace Deployment with Rollout.
apiVersion: argoproj.io/v1alpha1 kind: Rollout metadata: name: grade-submission-api namespace: grade spec: replicas: 3 strategy: canary: steps: - setWeight: 20 - pause: { duration: 30 } - setWeight: 50 - pause: {} selector: matchLabels: app: grade-submission-api template: metadata: labels: app: grade-submission-api spec: containers: - name: app image: ghcr.io/jumptotechschooldevops/k8s-ci-build:PLACEHOLDER
Enter fullscreen mode
Exit fullscreen mode
Commit & push.
Lab 1.3 — Observe Rollout via Argo CD
Show:
Use CLI:
kubectl argo rollouts get rollout grade-submission-api -n grade
Enter fullscreen mode
Exit fullscreen mode
Resume:
kubectl argo rollouts promote grade-submission-api -n grade
Enter fullscreen mode
Exit fullscreen mode
Interview takeaway:
“We use Argo CD for GitOps and Argo Rollouts for progressive delivery.”
MODULE 2 — Helm + Argo CD (Real-World GitOps)
Show that:
Helm:
Argo CD:
Correct mental model:
“Helm renders.
Argo enforces.”
Lab 2.1 — Helm-Based GitOps Repo
Restructure GitOps repo:
grade-api-gitops/ ├── chart/ │ ├── Chart.yaml │ ├── values.yaml │ └── templates/ │ └── rollout.yaml
Enter fullscreen mode
Exit fullscreen mode
Put Rollout YAML into templates/.
Lab 2.2 — Argo Application with Helm Source
spec: source: repoURL: https://github.com/jumptotechschooldevops/grade-api-gitops targetRevision: main path: chart helm: valueFiles: - values.yaml
Enter fullscreen mode
Exit fullscreen mode
Apply:
kubectl apply -f grade-api-app.yaml
Enter fullscreen mode
Exit fullscreen mode
Lab 2.3 — Change Values Only (No YAML Change)
Change image tag via CI → GitOps values.yaml.
Observe:
Interview sentence:
“Helm handles templating, Argo CD handles reconciliation.”
MODULE 3 — RBAC LOCK-DOWN (PRODUCTION SAFETY LAB)
Show:
This is platform engineering.
Lab 3.1 — Create Read-Only Kubernetes Role
apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: read-only namespace: grade rules: - apiGroups: ["", "apps"] resources: ["pods", "deployments", "services"] verbs: ["get", "list", "watch"]
Enter fullscreen mode
Exit fullscreen mode
Bind it:
kind: RoleBinding subjects: - kind: User name: dev-user roleRef: kind: Role name: read-only
Enter fullscreen mode
Exit fullscreen mode
Lab 3.2 — Prove kubectl Is Blocked
kubectl -n grade scale deployment grade-submission-api --replicas=5
Enter fullscreen mode
Exit fullscreen mode
Result:
Error: forbidden
Enter fullscreen mode
Exit fullscreen mode
Explain:
Even if Argo didn’t exist, humans are locked out.
Lab 3.3 — Argo CD RBAC (App-Level)
Edit argocd-rbac-cm:
policy.csv: | p, role:readonly, applications, get, *, allow p, role:readonly, applications, sync, *, deny
Enter fullscreen mode
Exit fullscreen mode
Map users to role.
Lab 3.4 — Demo UI Restrictions
Log in as:
Show:
But:
Interview sentence:
“In production, engineers don’t deploy — Argo does.”
Topic
Skill Level
Argo CD Dashboard
Core GitOps
Drift & Self-Healing
Mid
Rollouts
Advanced
Helm + Argo
Senior
RBAC Lockdown
Platform
Governance
Staff/Lead
For further actions, you may consider blocking this person and/or reporting abuse
Залишити відповідь