aigroup-workflow 2.2.1 → 2.2.3

package/skills/infra/kubernetes-specialist/references/gitops.md

@@ -1,530 +1,530 @@
-# GitOps
-
----
-
-## GitOps Principles
-
-1. **Declarative** - Entire system described declaratively
-2. **Versioned and immutable** - Desired state stored in Git
-3. **Pulled automatically** - Agents pull state from Git
-4. **Continuously reconciled** - Agents ensure actual matches desired
-
-## ArgoCD Installation
-
-```bash
-# Create namespace
-kubectl create namespace argocd
-
-# Install ArgoCD
-kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
-
-# Wait for pods
-kubectl wait --for=condition=Ready pods --all -n argocd --timeout=300s
-
-# Get initial admin password
-kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d
-
-# Install CLI
-brew install argocd
-
-# Login
-argocd login localhost:8080 --username admin --password <password>
-
-# Access UI
-kubectl port-forward svc/argocd-server -n argocd 8080:443
-```
-
-## ArgoCD Application
-
-```yaml
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: myapp
-  namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/myorg/myapp-manifests.git
-    targetRevision: main
-    path: overlays/production
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: production
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-      allowEmpty: false
-    syncOptions:
-      - CreateNamespace=true
-      - PrunePropagationPolicy=foreground
-      - PruneLast=true
-    retry:
-      limit: 5
-      backoff:
-        duration: 5s
-        factor: 2
-        maxDuration: 3m
-  revisionHistoryLimit: 10
-```
-
-## ArgoCD ApplicationSet
-
-```yaml
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: myapp-environments
-  namespace: argocd
-spec:
-  generators:
-    - list:
-        elements:
-          - cluster: dev
-            namespace: development
-            revision: develop
-          - cluster: staging
-            namespace: staging
-            revision: main
-          - cluster: prod
-            namespace: production
-            revision: main
-  template:
-    metadata:
-      name: 'myapp-{{cluster}}'
-    spec:
-      project: default
-      source:
-        repoURL: https://github.com/myorg/myapp-manifests.git
-        targetRevision: '{{revision}}'
-        path: 'overlays/{{cluster}}'
-      destination:
-        server: https://kubernetes.default.svc
-        namespace: '{{namespace}}'
-      syncPolicy:
-        automated:
-          prune: true
-          selfHeal: true
-```
-
-## ArgoCD with Helm
-
-```yaml
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: myapp-helm
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://charts.example.com
-    chart: myapp
-    targetRevision: 1.2.0
-    helm:
-      releaseName: myapp
-      valueFiles:
-        - values-production.yaml
-      values: |
-        replicaCount: 5
-        image:
-          tag: v2.0.0
-      parameters:
-        - name: service.type
-          value: LoadBalancer
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: production
-```
-
-## ArgoCD Project
-
-```yaml
-apiVersion: argoproj.io/v1alpha1
-kind: AppProject
-metadata:
-  name: production
-  namespace: argocd
-spec:
-  description: Production applications
-  sourceRepos:
-    - 'https://github.com/myorg/*'
-    - 'https://charts.example.com'
-  destinations:
-    - namespace: production
-      server: https://kubernetes.default.svc
-    - namespace: production-*
-      server: https://kubernetes.default.svc
-  clusterResourceWhitelist:
-    - group: ''
-      kind: Namespace
-  namespaceResourceBlacklist:
-    - group: ''
-      kind: ResourceQuota
-    - group: ''
-      kind: LimitRange
-  roles:
-    - name: developer
-      description: Developer access
-      policies:
-        - p, proj:production:developer, applications, get, production/*, allow
-        - p, proj:production:developer, applications, sync, production/*, allow
-      groups:
-        - developers
-```
-
-## Flux Installation
-
-```bash
-# Install Flux CLI
-brew install fluxcd/tap/flux
-
-# Check prerequisites
-flux check --pre
-
-# Bootstrap Flux (GitHub)
-flux bootstrap github \
-  --owner=myorg \
-  --repository=fleet-infra \
-  --branch=main \
-  --path=clusters/production \
-  --personal
-
-# Bootstrap Flux (GitLab)
-flux bootstrap gitlab \
-  --owner=myorg \
-  --repository=fleet-infra \
-  --branch=main \
-  --path=clusters/production
-```
-
-## Flux GitRepository
-
-```yaml
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: myapp
-  namespace: flux-system
-spec:
-  interval: 1m
-  url: https://github.com/myorg/myapp-manifests
-  ref:
-    branch: main
-  secretRef:
-    name: github-credentials
-  ignore: |
-    # Exclude files
-    .git/
-    *.md
-```
-
-## Flux Kustomization
-
-```yaml
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: myapp
-  namespace: flux-system
-spec:
-  interval: 10m
-  targetNamespace: production
-  sourceRef:
-    kind: GitRepository
-    name: myapp
-  path: ./overlays/production
-  prune: true
-  timeout: 2m
-  healthChecks:
-    - apiVersion: apps/v1
-      kind: Deployment
-      name: myapp
-      namespace: production
-  postBuild:
-    substitute:
-      environment: production
-      replicas: "5"
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-vars
-```
-
-## Flux HelmRepository
-
-```yaml
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: bitnami
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://charts.bitnami.com/bitnami
----
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: redis
-  namespace: production
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: redis
-      version: '17.x'
-      sourceRef:
-        kind: HelmRepository
-        name: bitnami
-        namespace: flux-system
-  values:
-    architecture: standalone
-    auth:
-      enabled: true
-      existingSecret: redis-credentials
-    master:
-      persistence:
-        size: 10Gi
-```
-
-## Flux ImageUpdateAutomation
-
-```yaml
-apiVersion: image.toolkit.fluxcd.io/v1beta1
-kind: ImageRepository
-metadata:
-  name: myapp
-  namespace: flux-system
-spec:
-  image: myregistry.io/myapp
-  interval: 1m
-  secretRef:
-    name: registry-credentials
----
-apiVersion: image.toolkit.fluxcd.io/v1beta1
-kind: ImagePolicy
-metadata:
-  name: myapp
-  namespace: flux-system
-spec:
-  imageRepositoryRef:
-    name: myapp
-  policy:
-    semver:
-      range: '>=1.0.0'
----
-apiVersion: image.toolkit.fluxcd.io/v1beta1
-kind: ImageUpdateAutomation
-metadata:
-  name: myapp
-  namespace: flux-system
-spec:
-  interval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: myapp
-  git:
-    checkout:
-      ref:
-        branch: main
-    commit:
-      author:
-        email: fluxcdbot@users.noreply.github.com
-        name: fluxcdbot
-      messageTemplate: 'Update image to {{.NewTag}}'
-    push:
-      branch: main
-  update:
-    path: ./overlays/production
-    strategy: Setters
-```
-
-## Progressive Delivery with Flagger
-
-```yaml
-# Install Flagger
-kubectl apply -k github.com/fluxcd/flagger/kustomize/istio
-
----
-apiVersion: flagger.app/v1beta1
-kind: Canary
-metadata:
-  name: myapp
-  namespace: production
-spec:
-  targetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: myapp
-  progressDeadlineSeconds: 600
-  service:
-    port: 80
-    targetPort: 8080
-    gateways:
-      - myapp-gateway
-    hosts:
-      - myapp.example.com
-  analysis:
-    interval: 1m
-    threshold: 5
-    maxWeight: 50
-    stepWeight: 10
-    metrics:
-      - name: request-success-rate
-        thresholdRange:
-          min: 99
-        interval: 1m
-      - name: request-duration
-        thresholdRange:
-          max: 500
-        interval: 1m
-    webhooks:
-      - name: load-test
-        url: http://flagger-loadtester.test/
-        timeout: 5s
-        metadata:
-          cmd: "hey -z 1m -q 10 -c 2 http://myapp-canary.production:80/"
-```
-
-## Sealed Secrets
-
-```bash
-# Install controller
-kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.24.0/controller.yaml
-
-# Install kubeseal CLI
-brew install kubeseal
-
-# Create sealed secret
-kubectl create secret generic db-credentials \
-  --from-literal=username=admin \
-  --from-literal=password=secret123 \
-  --dry-run=client -o yaml | \
-  kubeseal --format yaml > sealed-db-credentials.yaml
-
-# Apply sealed secret
-kubectl apply -f sealed-db-credentials.yaml
-```
-
-```yaml
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: db-credentials
-  namespace: production
-spec:
-  encryptedData:
-    username: AgBy8h...encrypted...
-    password: AgCtr2...encrypted...
-  template:
-    type: Opaque
-    metadata:
-      labels:
-        app: myapp
-```
-
-## SOPS with Age
-
-```bash
-# Install SOPS
-brew install sops
-
-# Generate age key
-age-keygen -o age.agekey
-
-# Create SOPS config
-cat > .sops.yaml << EOF
-creation_rules:
-  - path_regex: .*\.enc\.yaml$
-    encrypted_regex: ^(data|stringData)$
-    age: age1...publickey...
-EOF
-
-# Encrypt secret
-sops --encrypt --in-place secrets.enc.yaml
-
-# Configure Flux decryption
-kubectl create secret generic sops-age \
-  --namespace=flux-system \
-  --from-file=age.agekey
-```
-
-```yaml
-# Flux Kustomization with SOPS
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: myapp
-  namespace: flux-system
-spec:
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age
-  # ... rest of spec
-```
-
-## Repository Strategies
-
-### Mono-repo
-```
-fleet-repo/
-├── apps/
-│   ├── myapp/
-│   │   ├── base/
-│   │   └── overlays/
-│   └── another-app/
-├── infrastructure/
-│   ├── cert-manager/
-│   └── ingress-nginx/
-└── clusters/
-    ├── dev/
-    ├── staging/
-    └── production/
-```
-
-### Multi-repo
-```
-# App repos (one per app)
-myapp-manifests/
-├── base/
-└── overlays/
-
-# Infrastructure repo
-infrastructure/
-├── cert-manager/
-└── ingress-nginx/
-
-# Fleet repo (references others)
-fleet-infra/
-├── apps.yaml      # Points to app repos
-└── infra.yaml     # Points to infra repo
-```
-
-## ArgoCD vs Flux Comparison
-
-| Feature | ArgoCD | Flux |
-|---------|--------|------|
-| UI | Built-in web UI | Third-party (Weave GitOps) |
-| Multi-tenancy | AppProject | Namespaced resources |
-| Helm | Native support | HelmController |
-| Image automation | ArgoCD Image Updater | Native ImagePolicy |
-| Notifications | ArgoCD Notifications | Alerts/Receivers |
-| RBAC | Built-in | Kubernetes RBAC |
-| Architecture | Centralized | Distributed |
-
-## Best Practices
-
-1. **Use separate repos** for app code and manifests
-2. **Protect main branch** with required reviews
-3. **Use sealed secrets or SOPS** for sensitive data
-4. **Enable auto-sync with prune** for drift correction
-5. **Set up notifications** for sync failures
-6. **Use ApplicationSets/Kustomizations** for multi-environment
-7. **Implement progressive delivery** for safe rollouts
-8. **Version your Helm charts** semantically
-9. **Keep manifests DRY** with Kustomize overlays
-10. **Monitor reconciliation metrics** and alerts
+# GitOps
+
+---
+
+## GitOps Principles
+
+1. **Declarative** - Entire system described declaratively
+2. **Versioned and immutable** - Desired state stored in Git
+3. **Pulled automatically** - Agents pull state from Git
+4. **Continuously reconciled** - Agents ensure actual matches desired
+
+## ArgoCD Installation
+
+```bash
+# Create namespace
+kubectl create namespace argocd
+
+# Install ArgoCD
+kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
+
+# Wait for pods
+kubectl wait --for=condition=Ready pods --all -n argocd --timeout=300s
+
+# Get initial admin password
+kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d
+
+# Install CLI
+brew install argocd
+
+# Login
+argocd login localhost:8080 --username admin --password <password>
+
+# Access UI
+kubectl port-forward svc/argocd-server -n argocd 8080:443
+```
+
+## ArgoCD Application
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: myapp
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/myorg/myapp-manifests.git
+    targetRevision: main
+    path: overlays/production
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: production
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+      allowEmpty: false
+    syncOptions:
+      - CreateNamespace=true
+      - PrunePropagationPolicy=foreground
+      - PruneLast=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m
+  revisionHistoryLimit: 10
+```
+
+## ArgoCD ApplicationSet
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: myapp-environments
+  namespace: argocd
+spec:
+  generators:
+    - list:
+        elements:
+          - cluster: dev
+            namespace: development
+            revision: develop
+          - cluster: staging
+            namespace: staging
+            revision: main
+          - cluster: prod
+            namespace: production
+            revision: main
+  template:
+    metadata:
+      name: 'myapp-{{cluster}}'
+    spec:
+      project: default
+      source:
+        repoURL: https://github.com/myorg/myapp-manifests.git
+        targetRevision: '{{revision}}'
+        path: 'overlays/{{cluster}}'
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: '{{namespace}}'
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+```
+
+## ArgoCD with Helm
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: myapp-helm
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://charts.example.com
+    chart: myapp
+    targetRevision: 1.2.0
+    helm:
+      releaseName: myapp
+      valueFiles:
+        - values-production.yaml
+      values: |
+        replicaCount: 5
+        image:
+          tag: v2.0.0
+      parameters:
+        - name: service.type
+          value: LoadBalancer
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: production
+```
+
+## ArgoCD Project
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: production
+  namespace: argocd
+spec:
+  description: Production applications
+  sourceRepos:
+    - 'https://github.com/myorg/*'
+    - 'https://charts.example.com'
+  destinations:
+    - namespace: production
+      server: https://kubernetes.default.svc
+    - namespace: production-*
+      server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+    - group: ''
+      kind: Namespace
+  namespaceResourceBlacklist:
+    - group: ''
+      kind: ResourceQuota
+    - group: ''
+      kind: LimitRange
+  roles:
+    - name: developer
+      description: Developer access
+      policies:
+        - p, proj:production:developer, applications, get, production/*, allow
+        - p, proj:production:developer, applications, sync, production/*, allow
+      groups:
+        - developers
+```
+
+## Flux Installation
+
+```bash
+# Install Flux CLI
+brew install fluxcd/tap/flux
+
+# Check prerequisites
+flux check --pre
+
+# Bootstrap Flux (GitHub)
+flux bootstrap github \
+  --owner=myorg \
+  --repository=fleet-infra \
+  --branch=main \
+  --path=clusters/production \
+  --personal
+
+# Bootstrap Flux (GitLab)
+flux bootstrap gitlab \
+  --owner=myorg \
+  --repository=fleet-infra \
+  --branch=main \
+  --path=clusters/production
+```
+
+## Flux GitRepository
+
+```yaml
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: myapp
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://github.com/myorg/myapp-manifests
+  ref:
+    branch: main
+  secretRef:
+    name: github-credentials
+  ignore: |
+    # Exclude files
+    .git/
+    *.md
+```
+
+## Flux Kustomization
+
+```yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: myapp
+  namespace: flux-system
+spec:
+  interval: 10m
+  targetNamespace: production
+  sourceRef:
+    kind: GitRepository
+    name: myapp
+  path: ./overlays/production
+  prune: true
+  timeout: 2m
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: myapp
+      namespace: production
+  postBuild:
+    substitute:
+      environment: production
+      replicas: "5"
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-vars
+```
+
+## Flux HelmRepository
+
+```yaml
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: bitnami
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://charts.bitnami.com/bitnami
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: production
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: redis
+      version: '17.x'
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  values:
+    architecture: standalone
+    auth:
+      enabled: true
+      existingSecret: redis-credentials
+    master:
+      persistence:
+        size: 10Gi
+```
+
+## Flux ImageUpdateAutomation
+
+```yaml
+apiVersion: image.toolkit.fluxcd.io/v1beta1
+kind: ImageRepository
+metadata:
+  name: myapp
+  namespace: flux-system
+spec:
+  image: myregistry.io/myapp
+  interval: 1m
+  secretRef:
+    name: registry-credentials
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta1
+kind: ImagePolicy
+metadata:
+  name: myapp
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: myapp
+  policy:
+    semver:
+      range: '>=1.0.0'
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta1
+kind: ImageUpdateAutomation
+metadata:
+  name: myapp
+  namespace: flux-system
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: myapp
+  git:
+    checkout:
+      ref:
+        branch: main
+    commit:
+      author:
+        email: fluxcdbot@users.noreply.github.com
+        name: fluxcdbot
+      messageTemplate: 'Update image to {{.NewTag}}'
+    push:
+      branch: main
+  update:
+    path: ./overlays/production
+    strategy: Setters
+```
+
+## Progressive Delivery with Flagger
+
+```yaml
+# Install Flagger
+kubectl apply -k github.com/fluxcd/flagger/kustomize/istio
+
+---
+apiVersion: flagger.app/v1beta1
+kind: Canary
+metadata:
+  name: myapp
+  namespace: production
+spec:
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: myapp
+  progressDeadlineSeconds: 600
+  service:
+    port: 80
+    targetPort: 8080
+    gateways:
+      - myapp-gateway
+    hosts:
+      - myapp.example.com
+  analysis:
+    interval: 1m
+    threshold: 5
+    maxWeight: 50
+    stepWeight: 10
+    metrics:
+      - name: request-success-rate
+        thresholdRange:
+          min: 99
+        interval: 1m
+      - name: request-duration
+        thresholdRange:
+          max: 500
+        interval: 1m
+    webhooks:
+      - name: load-test
+        url: http://flagger-loadtester.test/
+        timeout: 5s
+        metadata:
+          cmd: "hey -z 1m -q 10 -c 2 http://myapp-canary.production:80/"
+```
+
+## Sealed Secrets
+
+```bash
+# Install controller
+kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.24.0/controller.yaml
+
+# Install kubeseal CLI
+brew install kubeseal
+
+# Create sealed secret
+kubectl create secret generic db-credentials \
+  --from-literal=username=admin \
+  --from-literal=password=secret123 \
+  --dry-run=client -o yaml | \
+  kubeseal --format yaml > sealed-db-credentials.yaml
+
+# Apply sealed secret
+kubectl apply -f sealed-db-credentials.yaml
+```
+
+```yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: db-credentials
+  namespace: production
+spec:
+  encryptedData:
+    username: AgBy8h...encrypted...
+    password: AgCtr2...encrypted...
+  template:
+    type: Opaque
+    metadata:
+      labels:
+        app: myapp
+```
+
+## SOPS with Age
+
+```bash
+# Install SOPS
+brew install sops
+
+# Generate age key
+age-keygen -o age.agekey
+
+# Create SOPS config
+cat > .sops.yaml << EOF
+creation_rules:
+  - path_regex: .*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1...publickey...
+EOF
+
+# Encrypt secret
+sops --encrypt --in-place secrets.enc.yaml
+
+# Configure Flux decryption
+kubectl create secret generic sops-age \
+  --namespace=flux-system \
+  --from-file=age.agekey
+```
+
+```yaml
+# Flux Kustomization with SOPS
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: myapp
+  namespace: flux-system
+spec:
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  # ... rest of spec
+```
+
+## Repository Strategies
+
+### Mono-repo
+```
+fleet-repo/
+├── apps/
+│   ├── myapp/
+│   │   ├── base/
+│   │   └── overlays/
+│   └── another-app/
+├── infrastructure/
+│   ├── cert-manager/
+│   └── ingress-nginx/
+└── clusters/
+    ├── dev/
+    ├── staging/
+    └── production/
+```
+
+### Multi-repo
+```
+# App repos (one per app)
+myapp-manifests/
+├── base/
+└── overlays/
+
+# Infrastructure repo
+infrastructure/
+├── cert-manager/
+└── ingress-nginx/
+
+# Fleet repo (references others)
+fleet-infra/
+├── apps.yaml      # Points to app repos
+└── infra.yaml     # Points to infra repo
+```
+
+## ArgoCD vs Flux Comparison
+
+| Feature | ArgoCD | Flux |
+|---------|--------|------|
+| UI | Built-in web UI | Third-party (Weave GitOps) |
+| Multi-tenancy | AppProject | Namespaced resources |
+| Helm | Native support | HelmController |
+| Image automation | ArgoCD Image Updater | Native ImagePolicy |
+| Notifications | ArgoCD Notifications | Alerts/Receivers |
+| RBAC | Built-in | Kubernetes RBAC |
+| Architecture | Centralized | Distributed |
+
+## Best Practices
+
+1. **Use separate repos** for app code and manifests
+2. **Protect main branch** with required reviews
+3. **Use sealed secrets or SOPS** for sensitive data
+4. **Enable auto-sync with prune** for drift correction
+5. **Set up notifications** for sync failures
+6. **Use ApplicationSets/Kustomizations** for multi-environment
+7. **Implement progressive delivery** for safe rollouts
+8. **Version your Helm charts** semantically
+9. **Keep manifests DRY** with Kustomize overlays
+10. **Monitor reconciliation metrics** and alerts