From 20d8146e8c16da29c170c83496beff738a3fc5e3 Mon Sep 17 00:00:00 2001 From: Janis Date: Thu, 16 Apr 2026 19:07:08 +0200 Subject: [PATCH] feat: add comprehensive documentation and deployment scripts - Created new documentation files including TROUBLESHOOTING.md, CONFIGURATION.md, and CONTRIBUTING.md. - Added deployment guide with automated and manual instructions. - Introduced new YAML configurations for Kubernetes resources and Helm charts. - Implemented a deployment script for setting up the GitOps infrastructure. --- .gitignore | 110 + ARCHITECTURE.md | 462 ++ CONFIGURATION.md | 130 + CONTRIBUTING.md | 349 ++ DEPLOYMENT_GUIDE.md | 556 +++ DOCUMENTATION_IMPROVEMENTS.md | 324 ++ DOCUMENTATION_INDEX.md | 0 Gitops.iml | 11 + Passwords.kdbx | Bin 0 -> 13957 bytes README.md | 694 +++ TROUBLESHOOTING.md | 0 argo-rollouts/eu-central-1/kube-devops.yaml | 4 + argo-rollouts/eu-central-1/kustomization.yaml | 4 + argocd/eu-central-1/kube-devops.yaml | 4 + argocd/eu-central-1/kustomization.yaml | 12 + argocd/eu-central-1/values.yaml | 4283 +++++++++++++++++ cert-manager/base/cert-manager-namespace.yaml | 4 + cert-manager/base/kustomization.yaml | 11 + cert-manager/base/values.yaml | 1494 ++++++ cert-manager/eu-central-1/cert-issuer.yaml | 14 + cert-manager/eu-central-1/kustomization.yaml | 5 + .../argo-rollouts/argo-rollouts.yaml | 31 + .../argo-apps/cert-manager/cert-manager.yaml | 18 + .../kargo-projects/orchestration.yaml | 19 + eu-central-1/argo-apps/kargo/kargo.yaml | 25 + eu-central-1/root-apps-app.yaml | 23 + .../orchestration-stack/kustomization.yaml | 8 + .../orchestration-stack/orch-project.yaml | 7 + .../orch-projectconfig.yaml | 9 + .../orch-promotion-template.yaml | 66 + .../orchestration-stack/orch-stage.yaml | 55 + .../orchestration-stack/orch-warehouse.yaml | 35 + kargo/base/kustomization.yaml | 5 + kargo/base/values.yaml | 946 ++++ kargo/eu-central-1/kustomization.yaml | 4 + kargo/eu-central-1/values.yaml | 950 ++++ scripts/deploy-to-cluster.sh | 60 + secrets/kustomization.yaml | 7 + 38 files changed, 10739 insertions(+) create mode 100644 .gitignore create mode 100644 ARCHITECTURE.md create mode 100644 CONFIGURATION.md create mode 100644 CONTRIBUTING.md create mode 100644 DEPLOYMENT_GUIDE.md create mode 100644 DOCUMENTATION_IMPROVEMENTS.md create mode 100644 DOCUMENTATION_INDEX.md create mode 100644 Gitops.iml create mode 100644 Passwords.kdbx create mode 100644 README.md create mode 100644 TROUBLESHOOTING.md create mode 100644 argo-rollouts/eu-central-1/kube-devops.yaml create mode 100644 argo-rollouts/eu-central-1/kustomization.yaml create mode 100644 argocd/eu-central-1/kube-devops.yaml create mode 100644 argocd/eu-central-1/kustomization.yaml create mode 100644 argocd/eu-central-1/values.yaml create mode 100644 cert-manager/base/cert-manager-namespace.yaml create mode 100644 cert-manager/base/kustomization.yaml create mode 100644 cert-manager/base/values.yaml create mode 100644 cert-manager/eu-central-1/cert-issuer.yaml create mode 100644 cert-manager/eu-central-1/kustomization.yaml create mode 100644 eu-central-1/argo-apps/argo-rollouts/argo-rollouts.yaml create mode 100644 eu-central-1/argo-apps/cert-manager/cert-manager.yaml create mode 100644 eu-central-1/argo-apps/kargo-projects/orchestration.yaml create mode 100644 eu-central-1/argo-apps/kargo/kargo.yaml create mode 100644 eu-central-1/root-apps-app.yaml create mode 100644 kargo-projects/orchestration-stack/kustomization.yaml create mode 100644 kargo-projects/orchestration-stack/orch-project.yaml create mode 100644 kargo-projects/orchestration-stack/orch-projectconfig.yaml create mode 100644 kargo-projects/orchestration-stack/orch-promotion-template.yaml create mode 100644 kargo-projects/orchestration-stack/orch-stage.yaml create mode 100644 kargo-projects/orchestration-stack/orch-warehouse.yaml create mode 100644 kargo/base/kustomization.yaml create mode 100644 kargo/base/values.yaml create mode 100644 kargo/eu-central-1/kustomization.yaml create mode 100644 kargo/eu-central-1/values.yaml create mode 100644 scripts/deploy-to-cluster.sh create mode 100644 secrets/kustomization.yaml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..f2643bb --- /dev/null +++ b/.gitignore @@ -0,0 +1,110 @@ +# Created by https://www.toptal.com/developers/gitignore/api/helm,intellij+all +# Edit at https://www.toptal.com/developers/gitignore?templates=helm,intellij+all + +### Helm ### +# Chart dependencies +**/charts/*.tgz + +### Intellij+all ### +# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider +# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839 + +# User-specific stuff +.idea/**/workspace.xml +.idea/**/tasks.xml +.idea/**/usage.statistics.xml +.idea/**/dictionaries +.idea/**/shelf + +# AWS User-specific +.idea/**/aws.xml + +# Generated files +.idea/**/contentModel.xml + +# Sensitive or high-churn files +.idea/**/dataSources/ +.idea/**/dataSources.ids +.idea/**/dataSources.local.xml +.idea/**/sqlDataSources.xml +.idea/**/dynamic.xml +.idea/**/uiDesigner.xml +.idea/**/dbnavigator.xml + +# Gradle +.idea/**/gradle.xml +.idea/**/libraries + +# Gradle and Maven with auto-import +# When using Gradle or Maven with auto-import, you should exclude module files, +# since they will be recreated, and may cause churn. Uncomment if using +# auto-import. +# .idea/artifacts +# .idea/compiler.xml +# .idea/jarRepositories.xml +# .idea/modules.xml +# .idea/*.iml +# .idea/modules +# *.iml +# *.ipr + +# CMake +cmake-build-*/ + +# Mongo Explorer plugin +.idea/**/mongoSettings.xml + +# File-based project format +*.iws + +# IntelliJ +out/ + +# mpeltonen/sbt-idea plugin +.idea_modules/ + +# JIRA plugin +atlassian-ide-plugin.xml + +# Cursive Clojure plugin +.idea/replstate.xml + +# SonarLint plugin +.idea/sonarlint/ + +# Crashlytics plugin (for Android Studio and IntelliJ) +com_crashlytics_export_strings.xml +crashlytics.properties +crashlytics-build.properties +fabric.properties + +# Editor-based Rest Client +.idea/httpRequests + +# Android studio 3.1+ serialized cache file +.idea/caches/build_file_checksums.ser + +### Intellij+all Patch ### +# Ignore everything but code style settings and run configurations +# that are supposed to be shared within teams. + +.idea/* + +!.idea/codeStyles +!.idea/runConfigurations + +# End of https://www.toptal.com/developers/gitignore/api/helm,intellij+all + +# Disable charts +/cert-manager/base/charts/ +/argocd/base/charts/ +/argo-rollouts/base/charts/ +/kargo/base/charts/ +/kargo/base/kargo-admin-password.yaml +/cert.pem +### Sealed Secrets ### +/scripts/sealed-key.yaml + +# Unsealed Secret files (templates for kubeseal) +secrets/** +!secrets/kustomization.yaml \ No newline at end of file diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md new file mode 100644 index 0000000..95c6b74 --- /dev/null +++ b/ARCHITECTURE.md @@ -0,0 +1,462 @@ +# Architecture Overview + +This document provides a detailed technical architecture of the GitOps infrastructure. + +## System Architecture + +### High-Level Design + +``` +┌─────────────────────────────────────────────────────────────────┐ +│ Git Repository │ +│ (This GitOps Repository) │ +│ - Infrastructure as Code │ +│ - Application Manifests │ +│ - Configuration & Secrets │ +└──────────────────────────────┬──────────────────────────────────┘ + │ + ┌────────────┴────────────┐ + ▼ ▼ + ┌──────────────────┐ ┌──────────────────┐ + │ Kubernetes │ │ Webhook Triggers│ + │ API Server │ │ (GitHub/Gitea) │ + └────────┬─────────┘ └──────────────────┘ + │ + ┌────────────┼────────────────┐ + │ │ │ + ▼ ▼ ▼ +┌─────────┐ ┌──────────┐ ┌──────────────┐ +│ ArgoCD │ │ Kargo │ │ Cert-Manager │ +│ Server │ │ Controller + │ └─────────┘ └──────────┘ └──────────────┘ + │ + │ Monitors & Syncs + │ + ▼ +┌──────────────────────────────────────────┐ +│ Kubernetes Cluster Resources │ +│ - Deployments │ +│ - Services │ +│ - ConfigMaps & Secrets │ +│ - Ingresses │ +│ - Custom Resources (Kargo, Rollouts) │ +└──────────────────────────────────────────┘ +``` + +## Component Architecture + +### 1. Argo CD + +**Purpose**: GitOps continuous deployment orchestration + +**Components**: +- **API Server**: RESTful API for CLI and UI +- **Repository Server**: Handles Git operations and manifests +- **Application Controller**: Reconciles desired vs. actual state +- **Redis**: Caching and session storage +- **Webhook Receiver**: Listens for Git push events + +**Data Flow**: +1. Repository Server pulls latest manifests from Git +2. Application Controller compares desired vs actual state +3. Controller creates/updates/deletes Kubernetes resources +4. API Server provides status and management interface + +**Default Configuration**: +- Single replica for development +- Redis for in-memory caching +- Kustomize with Helm support +- Automated pruning and self-healing enabled + +### 2. Cert-Manager + +**Purpose**: Automated certificate lifecycle management + +**Components**: +- **Webhook**: Validates Certificate and Issuer resources +- **Controller**: Watches for certificate requests +- **Issuers**: Define how certificates are obtained (self-signed, Let's Encrypt, etc.) +- **Cert-Manager**: Core reconciliation logic + +**Certificate Flow**: +1. Certificate CRD is created in Kubernetes +2. Cert-Manager controller watches for changes +3. Controller contacts issuer to obtain certificate +4. Certificate and private key stored in Kubernetes Secret +5. Controller monitors expiry and auto-renews + +**Issuers in Use**: +- Self-signed CA: For internal cluster certificates +- Can be extended with Let's Encrypt (ACME) for public certificates + +### 3. Kargo + +**Purpose**: Progressive delivery and multi-stage promotion + +**Components**: +- **API Server**: Provides REST API and gRPC endpoints +- **Controller**: Reconciles Kargo resources (Promotions, Stages, Warehouses) +- **Webhooks Server**: Internal validating webhooks +- **External Webhooks Server**: Handles external event triggers +- **Management Controller**: Manages Projects and Namespaces +- **Garbage Collector**: Cleans up old Promotions and Freight + +**Key Resources**: +- **Warehouse**: Source of deployable artifacts (containers, Helm charts) +- **Freight**: Represents a deployment candidate with specific versions +- **Stage**: Deployment target with promotion rules +- **Promotion**: Represents moving Freight from one Stage to another + +**Promotion Flow**: +``` +Warehouse (Source) + ↓ +Freight (Versions) + ↓ +Stage 1 (Dev) + ↓ +Promotion to Stage 2 (Staging) → Approval/Analysis + ↓ +Stage 2 (Staging) + ↓ +Promotion to Stage 3 (Production) → Analysis/Verification + ↓ +Stage 3 (Production) +``` + +### 4. Argo Rollouts + +**Purpose**: Progressive deployment strategies (Canary, Blue-Green) + +**Components**: +- **Rollouts Controller**: Manages Rollout resources +- **Analysis Engine**: Evaluates deployment health via metrics +- **Progressive Deployment**: Gradually shifts traffic to new version + +**Deployment Strategies**: +- **Canary**: Gradually shift traffic (e.g., 5% → 50% → 100%) +- **Blue-Green**: Maintain two active environments, switch traffic +- **Traffic Shifting**: Use service mesh integration (Istio/SMI) + +## Data Flow Diagrams + +### GitOps Sync Flow + +``` +┌──────────────┐ +│ Git Commit │ +└──────┬───────┘ + │ + ├─→ GitHub Webhook + │ + └─→ Argo CD Webhook Receiver + │ + ├─→ Repository Server: Fetch Latest Manifests + │ + ├─→ Parse & Validate (Kustomize/Helm) + │ + └─→ Application Controller + │ + ├─→ Compare: Git State vs. Cluster State + │ + ├─→ Generate Diff + │ + └─→ Apply Changes to Cluster + │ + └─→ Update Application Status +``` + +### Kargo Promotion Flow + +``` +┌─────────────────┐ +│ New Artifact │ +│ Published │ +└────────┬────────┘ + │ + └─→ Webhook Event + │ + └─→ Kargo API + │ + ├─→ Create Freight + │ + └─→ Check Stage Promotions + │ + ├─→ Auto-Promotion Enabled? + │ ├─ Yes → Create Promotion + │ └─ No → Wait for Manual Approval + │ + └─→ Kargo Controller Reconciles + │ + ├─→ Update Argo CD Applications + │ + ├─→ Monitor Health + │ + ├─→ Run Analysis (via Argo Rollouts) + │ + └─→ Approve/Reject Next Promotion +``` + +## Security Architecture + +### Multi-Layer Security + +``` +┌─────────────────────────────────────────────────────────┐ +│ 1. Git Repository Security │ +│ - SSH key authentication │ +│ - Branch protection rules │ +│ - Code review requirements │ +└─────────────────────────────────────────────────────────┘ + ↓ +┌─────────────────────────────────────────────────────────┐ +│ 2. Secrets Encryption │ +│ - Sealed Secrets (bitnami-labs) │ +│ - Encrypted at rest in Git │ +│ - Decrypted only in cluster │ +└─────────────────────────────────────────────────────────┘ + ↓ +┌─────────────────────────────────────────────────────────┐ +│ 3. RBAC (Role-Based Access Control) │ +│ - Argo CD projects limit access │ +│ - Kargo OIDC integration │ +│ - Kubernetes RBAC policies │ +└─────────────────────────────────────────────────────────┘ + ↓ +┌─────────────────────────────────────────────────────────┐ +│ 4. Network Security │ +│ - Namespace isolation │ +│ - Network policies │ +│ - TLS for all communications │ +└─────────────────────────────────────────────────────────┘ + ↓ +┌─────────────────────────────────────────────────────────┐ +│ 5. Pod Security │ +│ - Non-root users │ +│ - Read-only filesystems │ +│ - Security contexts │ +└─────────────────────────────────────────────────────────┘ +``` + +## State Management + +### What State is Stored Where + +``` +┌────────────────────────────────────────┐ +│ Git Repository │ +├────────────────────────────────────────┤ +│ ✓ Infrastructure manifests │ +│ ✓ Application configurations │ +│ ✓ Sealed secrets │ +│ ✓ Kustomize overlays │ +│ ✓ Helm values │ +│ ✗ Cluster runtime state │ +│ ✗ User credentials (plaintext) │ +└────────────────────────────────────────┘ + +┌────────────────────────────────────────┐ +│ Kubernetes Cluster (etcd) │ +├────────────────────────────────────────┤ +│ ✓ Applied manifests │ +│ ✓ Running resource state │ +│ ✓ Sealed secrets (encrypted) │ +│ ✓ Argo CD applications │ +│ ✓ Kargo Promotions/Freight │ +│ ✗ Git history │ +└────────────────────────────────────────┘ + +┌────────────────────────────────────────┐ +│ External Storage │ +├────────────────────────────────────────┤ +│ ✓ Container registries │ +│ ✓ Helm repositories │ +│ ✓ Git repository │ +│ ✓ Certificate authority keys │ +│ ✗ Sensitive credentials (plaintext) │ +└────────────────────────────────────────┘ +``` + +## Scalability Considerations + +### Horizontal Scaling + +**Argo CD**: +- Multiple application-controller replicas for sharding +- Multiple server replicas for load distribution +- Shared Redis for session management + +**Kargo**: +- Multiple controller replicas for resource sharding +- Multiple API server replicas behind load balancer +- Webhook servers scale independently + +### Vertical Scaling + +**Resource Limits by Component**: + +``` +Argo CD Controller: + - Requests: 250m CPU, 256Mi Memory + - Limits: 500m CPU, 512Mi Memory + +Argo CD Server: + - Requests: 125m CPU, 128Mi Memory + - Limits: 250m CPU, 256Mi Memory + +Cert-Manager: + - Requests: 100m CPU, 64Mi Memory + - Limits: 200m CPU, 128Mi Memory + +Kargo API: + - Requests: 100m CPU, 128Mi Memory + - Limits: 500m CPU, 512Mi Memory +``` + +## High Availability Setup + +### Production Configuration + +``` +┌─────────────────────────────────────────────────────────┐ +│ Multi-Zone Kubernetes Cluster │ +│ (3+ availability zones) │ +│ │ +│ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ +│ │ Zone A │ │ Zone B │ │ Zone C │ │ +│ │ Master │ │ Master │ │ Master │ │ +│ │ Worker │ │ Worker │ │ Worker │ │ +│ └──────────┘ └──────────┘ └──────────┘ │ +│ │ +│ Distributed Storage: │ +│ - etcd replicated across zones │ +│ - PVC/PV with cross-zone replication │ +└─────────────────────────────────────────────────────────┘ +``` + +### Component Redundancy + +- Argo CD: 2-3 replicas of each component +- Cert-Manager: 2-3 controller replicas +- Kargo: 2-3 API server replicas, 2-3 controller replicas +- Redis: Redis-HA with 3 sentinels + +## Disaster Recovery + +### Backup Strategy + +``` +Daily Backups: +┌─────────────────────────────────────────────────┐ +│ Git Repository Commits │ +│ (Automatically backed up by Git hosting) │ +├─────────────────────────────────────────────────┤ +│ Kubernetes etcd │ +│ (velero or native etcd backup) │ +├─────────────────────────────────────────────────┤ +│ Sealing Keys for Sealed Secrets │ +│ (Secured storage, NOT in Git) │ +└─────────────────────────────────────────────────┘ +``` + +### Recovery Procedures + +1. **Git Corruption**: Use distributed copies, restore from backups +2. **etcd Corruption**: Restore from latest backup +3. **Secrets Key Loss**: Complete cluster recreation needed +4. **Application State**: Redeploy from Git (source of truth) + +## Monitoring & Observability + +### Key Metrics to Monitor + +``` +Argo CD Metrics: +- Application sync status +- Reconciliation lag +- Git repository fetch rate +- API server response times + +Cert-Manager Metrics: +- Certificate renewal status +- Certificate expiry tracking +- Issuer availability + +Kargo Metrics: +- Promotion success rate +- Stage health +- Freight warehouse size +- Webhook latency + +System Metrics: +- Pod CPU/Memory usage +- Node capacity +- PVC utilization +- Network I/O +``` + +### Integration Points + +- **Prometheus**: Scrape metrics from `/metrics` endpoints +- **Grafana**: Visualize metrics and dashboards +- **AlertManager**: Send alerts for critical issues +- **Logs**: Aggregate logs from all components + +## Integration with External Systems + +### Git Integration + +``` +Supported Git Providers: +├─ GitHub (via SSH) +├─ GitLab (via SSH) +├─ Gitea (via SSH) +└─ Self-hosted Git + +Authentication: +├─ SSH keys (primary) +├─ HTTPS with personal tokens +└─ SSH agent forwarding +``` + +### CI/CD Pipeline Integration + +``` +Build Pipeline → Container Registry → Webhook → Kargo + ↓ + Create Freight + ↓ + Promote to Stages + ↓ + Update Argo CD Applications +``` + +## Network Architecture + +### Kubernetes Network Design + +``` +┌────────────────────────────────────────────────────┐ +│ Cluster Network │ +│ │ +│ ┌──────────────┐ ┌──────────────┐ │ +│ │ Namespace │ │ Namespace │ │ +│ │ argocd │ │ cert-manager │ │ +│ │ │ │ │ │ +│ │ Service: │ │ Service: │ │ +│ │ 10.0.0.0/24 │ │ 10.0.1.0/24 │ │ +│ └──────────────┘ └──────────────┘ │ +│ │ +│ Pod CIDR: 10.1.0.0/16 │ +│ Service CIDR: 10.0.0.0/12 │ +│ │ +│ DNS: CoreDNS for internal resolution │ +│ Ingress: Optional external access │ +└────────────────────────────────────────────────────┘ +``` + +--- + +**Last Updated**: 2026-04-16 +**Version**: 1.0 + diff --git a/CONFIGURATION.md b/CONFIGURATION.md new file mode 100644 index 0000000..c7f08da --- /dev/null +++ b/CONFIGURATION.md @@ -0,0 +1,130 @@ +# Configuration Guide + +Guide for configuring and customizing the GitOps infrastructure. + +## Customizing Component Versions + +Edit Helm chart versions in kustomization.yaml files: + +```yaml +# argocd/eu-central-1/kustomization.yaml +helmCharts: +- name: argo-cd + repo: https://argoproj.github.io/argo-helm + version: 5.x.x # Update version + releaseName: argocd +``` + +## Resource Configuration + +Modify resource limits in values.yaml: + +```yaml +# argocd/eu-central-1/values.yaml +controller: + resources: + requests: + cpu: 250m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi +``` + +## OIDC Authentication Setup + +Update argocd-cm ConfigMap: + +```yaml +oidc.config: | + name: Azure AD + issuer: https://login.microsoftonline.com//v2.0 + clientID: + clientSecret: $oidc.clientSecret +``` + +## Adding New Regions + +1. Create new directory: `/` +2. Copy and adapt configuration from `eu-central-1/` +3. Update domain names and region-specific values +4. Create new root application + +## Secrets Configuration + +Using Sealed Secrets pattern: + +```bash +# Create secret +kubectl create secret generic my-secret \ + --from-literal=password=mysecret \ + --dry-run=client -o yaml > my-secret.yaml + +# Seal it +kubeseal -f my-secret.yaml -w my-sealed-secret.yaml + +# Commit sealed version +git add my-sealed-secret.yaml +``` + +## Network Policies + +Configure NetworkPolicy for security: + +```yaml +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: argocd-allow-ingress + namespace: argocd +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: argocd-server + policyTypes: + - Ingress +``` + +## Certificate Configuration + +Update cert issuer for custom domains: + +```yaml +# cert-manager/eu-central-1/cert-issuer.yaml +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: custom-issuer + namespace: kube-devops +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: admin@example.com + privateKeySecretRef: + name: letsencrypt-key +``` + +## Kargo Customization + +Configure Kargo projects and stages: + +```yaml +# kargo-projects/orchestration-stack/orch-stage.yaml +apiVersion: kargo.akuity.io/v1alpha1 +kind: Stage +metadata: + name: prod + namespace: orchestration-kargo +spec: + subscriptions: + upstreamStages: + - name: staging + promotionMechanisms: + argocd: + appUpdates: + - appName: production-app +``` + +--- +**Last Updated**: 2026-04-16 + diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..86ff642 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,349 @@ +# Development and Contribution Guide + +Guidelines for developing and contributing to the GitOps repository. + +## Repository Workflow + +### Setting Up Local Development + +```bash +# Clone the repository +git clone git@git.janis-eccarius.de:NowChess/GitOps.git +cd GitOps + +# Create feature branch +git checkout -b feature/my-feature + +# Install development tools +brew install kubectl helm kustomize # macOS +sudo apt-get install kubectl helm kustomize # Linux +``` + +### Making Changes + +1. **Validate locally**: +```bash +# Build manifests without applying +kustomize build | kubectl apply --dry-run=client -f - + +# Render templates +helm template -f values.yaml + +# Validate manifests +kubeval +``` + +2. **Test changes**: +```bash +# Apply to test cluster +kustomize build | kubectl apply -f - + +# Monitor deployment +kubectl get pods -A -w + +# Check logs +kubectl logs -n -l -f +``` + +3. **Commit changes**: +```bash +git add . +git commit -m "feat: describe your change" +git push origin feature/my-feature +``` + +## Commit Message Guidelines + +Follow semantic versioning in commit messages: + +``` +(): + + + +