ArgoCD 面试题

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: guestbook
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/argoproj/argocd-example-apps.git
    targetRevision: HEAD
    path: guestbook
  destination:
    server: https://kubernetes.default.svc
    namespace: guestbook
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    syncOptions:
      - CreateNamespace=true
      - PruneLast=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: production
  namespace: argocd
spec:
  description: Production Project
  sourceRepos:
    - https://github.com/team-a/*
  destinations:
    - namespace: prod-*
      server: https://kubernetes.default.svc
  clusterResourceWhitelist:
    - group: "*"
      kind: Namespace
  roles:
    - name: admin
      policies:
        - p, proj:production:admin, applications, *, production/*, allow

retry:
  limit: 5
  backoff:
    duration: 5s
    factor: 2
    maxDuration: 3m

metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "-5"

apiVersion: batch/v1
kind: Job
metadata:
  generateName: db-migrate-
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  template:
    spec:
      containers:
      - name: migration
        image: migrate-tool:latest
        command: ["./migrate"]
      restartPolicy: Never

argocd cluster add production-context --name prod-cluster --kubeconfig /path/to/kubeconfig
argocd cluster add staging-context --name staging-cluster

apiVersion: v1
kind: Secret
metadata:
  name: prod-cluster
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: cluster
type: Opaque
stringData:
  name: prod-cluster
  server: https://api.prod.example.com:6443
  config: |
    {
      "bearerToken": "<token>",
      "tlsClientConfig": {
        "insecure": false,
        "caData": "<base64-ca>"
      }
    }    

argocd.argoproj.io/secret-type: cluster
environment: production
region: us-east-1

p, <role/user>, <resource>, <action>, <object>, <effect>

p, role:dev-team, applications, sync, dev-project/*, allow
p, role:dev-team, applications, get, dev-project/*, allow
p, role:dev-team, applications, delete, dev-project/*, deny

g, user-alice, role:dev-team
g, user-bob, role:admin

data:
  url: https://argocd.example.com
  dex.config: |
    connectors:
    - type: gitlab
      id: gitlab
      name: GitLab
      config:
        clientID: $dex.gitlab.clientID
        clientSecret: $dex.gitlab.clientSecret
        baseURL: https://gitlab.example.com
    - type: ldap
      id: ldap
      name: LDAP
      config:
        host: ldap.example.com:389
        bindDN: cn=admin,dc=example,dc=com
        bindPW: $dex.ldap.bindPW
        usernamePrompt: Email
        userSearch:
          baseDN: ou=people,dc=example,dc=com
          filter: "(mail=%s)"    

data:
  url: https://argocd.example.com
  oidc.config: |
    name: Azure AD
    issuer: https://login.microsoftonline.com/<tenant-id>/v2.0
    clientID: $oidc.clientID
    clientSecret: $oidc.clientSecret
    requestedScopes: ["openid", "profile", "email", "groups"]    

argocd app rollback guestbook --id 15

return {
  health = {
    name = "MyCustomResource"
    -- Lua 函数返回 health status
  }
}

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: guestbook
spec:
  generators:
    - list:
        elements:
          - cluster: prod
            url: https://prod.example.com
          - cluster: staging
            url: https://staging.example.com
  template:
    metadata:
      name: "XQOPENclusterXQCLOSE-guestbook"
    spec:
      project: default
      source:
        repoURL: https://github.com/argocd/guestbook.git
        targetRevision: HEAD
        path: "overlays/XQOPENclusterXQCLOSE"
      destination:
        server: "XQOPENurlXQCLOSE"
        namespace: guestbook

generators:
  - git:
      repoURL: https://github.com/argocd/apps.git
      revision: HEAD
      directories:
        - path: "apps/*"

apiVersion: v1
kind: Secret
metadata:
  name: private-repo
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  type: git
  url: https://github.com/org/private-repo.git
  username: git-token
  password: <personal-access-token>

stringData:
  type: git
  url: git@github.com:org/private-repo.git
  sshPrivateKey: |
    -----BEGIN OPENSSH PRIVATE KEY-----
    ...
    -----END OPENSSH PRIVATE KEY-----    

stringData:
  type: helm
  url: oci://ghcr.io/org/charts
  enableOCI: true
  username: <user>
  password: <token>

stringData:
  webhook.github.secret: <github-webhook-token>
  webhook.gitlab.secret: <gitlab-webhook-token>
  webhook.bitbucket.secret: <bitbucket-uuid>
  webhook.bitbucketcloud.secret: <cloud-secret>

spec:
  source:
    repoURL: https://github.com/example/app.git
    path: overlays/production
    targetRevision: HEAD
    kustomize:
      namePrefix: prod-
      commonLabels:
        env: production
      images:
        - nginx:1.25.0

spec:
  source:
    repoURL: https://charts.example.com
    chart: nginx-ingress
    targetRevision: 4.0.0
    helm:
      releaseName: ingress-prod
      values: |
        controller:
          replicaCount: 3        
      valueFiles:
        - values-prod.yaml
      parameters:
        - name: controller.metrics.enabled
          value: "true"

argocd-application-controller:
  sharding:
    enabled: true
    numberOfShards: 4

graph TD
    A[main - 生产环境]
    B[release/ - 预发布环境]
    C[staging/ - 测试环境]
    D[develop/ - 开发环境]

graph TD
    A[overlays/]
    B[base/]
    A1[production/]
    A2[staging/]
    A3[development/]
    A --> A1
    A --> A2
    A --> A3

generators:
  - list:
      elements:
        - env: dev
          namespace: app-dev
          cluster: https://dev.example.com
        - env: staging
          namespace: app-staging
          cluster: https://staging.example.com
        - env: prod
          namespace: app-prod
          cluster: https://prod.example.com
template:
  spec:
    source:
      path: "overlays/XQOPENenvXQCLOSE"
    destination:
      namespace: "XQOPENnamespaceXQCLOSE"
      server: "XQOPENclusterXQCLOSE"

data:
  template.app-sync-succeeded: |
    message: Application XQOPEN.app.metadata.nameXQCLOSE 同步成功
    slacks:
      attachments: |
        [{"title": "部署完成", "text": "XQOPEN.app.metadata.nameXQCLOSE", "color": "good"}]    

  trigger.on-sync-succeeded: |
    - description: Sync 成功
      send:
        - app-sync-succeeded
      when: app.status.sync.status == 'Synced'    

  service.slack.prod-alerts: |
    token: $slack-token
    channels: #prod-deployments    

  subscriptions: |
    - recipients:
        - slack:prod-alerts
      triggers:
        - on-sync-succeeded
        - on-sync-failed
      applications:
        - name: production-*    

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: app-rollout
spec:
  replicas: 10
  strategy:
    canary:
      steps:
        - setWeight: 20
        - pause: {duration: 60}
        - setWeight: 50
        - pause: {duration: 60}
        - setWeight: 80
        - pause: {duration: 30}
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - name: app
          image: myapp:v2

strategy:
  blueGreen:
    activeService: app-active
    previewService: app-preview
    autoPromotionEnabled: true
    scaleDownDelaySeconds: 300

data:
  resource.customizations: |
    argoproj.io/Rollout:
      health.lua: |
        hs = {}
        hs.status = "Progressing"
        hs.message = ""
        if obj.status ~= nil then
          if obj.status.currentStepIndex == obj.status.stepCount - 1 and obj.status.phase == "Healthy" then
            hs.status = "Healthy"
            return hs
          end
          if obj.status.phase == "Degraded" then
            hs.status = "Degraded"
            return hs
          end
        end
        return hs    

data:
  resource.exclusions: |
    - apiGroups:
      - velero.io
      kinds:
      - Backup
      - Restore
    - apiGroups:
      - ""
      kinds:
      - "*"
      clusters:
      - https://api.prod.example.com:6443    

spec:
  source:
    repoURL: https://github.com/example/manifests.git
    targetRevision: HEAD
    path: base
  sources:
    - repoURL: https://github.com/example/manifests.git
      targetRevision: HEAD
      path: overlays/prod
      ref: prod
    - repoURL: https://github.com/example/extra-config.git
      targetRevision: HEAD
      path: infra

spec:
  syncPolicy:
    syncOptions:
      - CreateNamespace=true

syncOptions:
  - PruneLast=true

syncOptions:
  - Replace=true

data:
  audit.enabled: "true"
  audit.log.format: json
  audit.log.path: /var/log/argocd/audit.log
  audit.log.maxsize: 100
  audit.log.maxbackup: 5

metadata:
  annotations:
    argocd-image-updater.argoproj.io/image-list: myapp=gcr.io/project/app
    argocd-image-updater.argoproj.io/myapp.update-strategy: semver
    argocd-image-updater.argoproj.io/myapp.helm.image-name: image.repository
    argocd-image-updater.argoproj.io/myapp.helm.image-tag: image.tag

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: multi-cluster-app
spec:
  generators:
    - clusters:
        selector:
          matchLabels:
            environment: production
  template:
    metadata:
      name: "XQOPENnameXQCLOSE-guestbook"
    spec:
      project: production
      source:
        repoURL: https://github.com/example/guestbook.git
        targetRevision: HEAD
        path: "overlays/XQOPENnameXQCLOSE"
      destination:
        server: "XQOPENserverXQCLOSE"
        namespace: guestbook
      syncPolicy:
        automated:
          prune: true
          selfHeal: true

helm repo add argo https://argoproj.github.io/argo-helm
helm install argocd argo/argo-cd \
  --namespace argocd \
  --create-namespace \
  --set server.service.type=LoadBalancer \
  --set configs.params.server.insecure=true

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

data:
  admin.enabled: "false"
  server.insecure: "false"
  users.anonymous.enabled: "false"

update-manifest:
  stage: deploy
  image: alpine/git
  script:
    - git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/org/manifests.git
    - cd manifests
    - sed -i "s|image: myapp:.*|image: myapp:${CI_COMMIT_SHORT_SHA}|" overlays/prod/deployment.yaml
    - git config user.email "ci@example.com"
    - git config user.name "CI Pipeline"
    - git add .
    - git commit -m "Update image to ${CI_COMMIT_SHORT_SHA}"
    - git push https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/org/manifests.git

argocd app get my-app -o yaml              # Application 完整状态
argocd app diff my-app --hard-refresh       # 强制刷新缓存后比对差异
argocd app sync my-app --dry-run --prune    # 预演 Sync 操作
kubectl logs -n argocd deploy/argocd-application-controller  # Controller 日志
kubectl logs -n argocd deploy/argocd-repo-server             # Repository Server 日志
kubectl logs -n argocd deploy/argocd-server                  # API Server 日志