4. GitOps with Argo CD

# The environment Argo CD deploys (lab 11). CI changes only the "images" entry below.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: boxoffice
resources:
  - ../../base
  - catalog-services.yaml
  - catalog-rollout.yaml
  - catalog-analysis.yaml
images:
  - name: boxoffice/catalog
    newName: ghcr.io/your-user/boxoffice-catalog   # your GitHub user, lowercase
    newTag: sha-0000000000000000000000000000000000000000   # written by .github/workflows/deploy.yaml
secretGenerator:
  - name: db-credentials             # lab only: use Sealed Secrets / External Secrets in real projects
    namespace: boxoffice
    literals:
      - DB_USER=boxoffice
      - DB_PASSWORD=boxoffice
patches:
  # the Rollout runs the pods from now on: the Deployment only lends it its pod template
  - target: { kind: Deployment, name: catalog }
    patch: |-
      - op: replace
        path: /spec/replicas
        value: 0
      - op: add
        path: /spec/template/spec/imagePullSecrets
        value: [{ name: ghcr-pull }]
      - op: add                      # expose /actuator/prometheus for the canary analysis
        path: /spec/template/spec/containers/0/env/-
        value: { name: MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE, value: "health,info,metrics,prometheus" }
      - op: add                      # publish the latency buckets (_bucket) that the p99 analysis needs
        path: /spec/template/spec/containers/0/env/-
        value: { name: MANAGEMENT_METRICS_DISTRIBUTION_PERCENTILESHISTOGRAM_HTTP_SERVER_REQUESTS, value: "true" }
  # the HPA now scales the Rollout
  - target: { kind: HorizontalPodAutoscaler, name: catalog }
    patch: |-
      - op: replace
        path: /spec/scaleTargetRef
        value: { apiVersion: argoproj.io/v1alpha1, kind: Rollout, name: catalog }

# Argo Rollouts points these two Services at the stable and the canary pods (it adds the
# rollouts-pod-template-hash to their selectors). Prometheus scrapes them, so every series
# carries service="catalog-stable" or service="catalog-canary".
apiVersion: v1
kind: Service
metadata:
  name: catalog-stable
  annotations:
    prometheus.io/scrape: "true"
spec:
  selector:
    app: catalog
  ports:
    - name: http
      port: 8082
      targetPort: http
---
apiVersion: v1
kind: Service
metadata:
  name: catalog-canary
  annotations:
    prometheus.io/scrape: "true"
spec:
  selector:
    app: catalog
  ports:
    - name: http
      port: 8082
      targetPort: http

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: catalog
spec:
  # no "replicas": the HPA owns it
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app: catalog
  workloadRef:                       # reuse the pod template of the Deployment in base/
    apiVersion: apps/v1
    kind: Deployment
    name: catalog
    scaleDown: never                 # Git already sets the Deployment to 0 replicas
  strategy:
    canary:
      stableService: catalog-stable
      canaryService: catalog-canary
      analysis:                      # runs in the background from the first step
        templates:
          - templateName: catalog-slo
        startingStep: 1
      steps:
        - setWeight: 25
        - pause: { duration: 2m }
        - setWeight: 50
        - pause: { duration: 2m }
        # after the last step the canary becomes the new stable

apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: catalog-slo
spec:
  metrics:
    - name: error-rate
      interval: 30s
      failureLimit: 1                # a second bad measurement aborts and rolls back
      successCondition: len(result) == 0 || isNaN(result[0]) || result[0] < 0.01
      provider:
        prometheus:
          address: http://prometheus.monitoring:9090
          query: |
            sum(rate(http_server_requests_seconds_count{service="catalog-canary", status=~"5.."}[1m]))
            /
            sum(rate(http_server_requests_seconds_count{service="catalog-canary"}[1m]))
    - name: p99-latency
      interval: 30s
      failureLimit: 1
      successCondition: len(result) == 0 || isNaN(result[0]) || result[0] < 0.5
      provider:
        prometheus:
          address: http://prometheus.monitoring:9090
          query: |
            histogram_quantile(0.99, sum by (le) (
              rate(http_server_requests_seconds_bucket{service="catalog-canary"}[1m])))