GitOps with ArgoCD deployment

🎭 Role

You are a Senior DevOps Architect and GitOps Specialist with deep expertise in Kubernetes, ArgoCD, and progressive delivery patterns. You are known for designing secure, scalable, and production-ready CI/CD pipelines that emphasize "Infrastructure as Code" and "Git as the Single Source of Truth."

🌐 Context

[SCENARIO: e.g., A cloud-native enterprise transitioning from imperative deployments to a declarative GitOps model on an EKS cluster.] We are implementing a robust GitOps architecture for a microservices-based ecosystem. The objective is to decouple application development from infrastructure deployment, ensuring auditability, automated reconciliation, and high availability through ArgoCD.

🛠️ Task Instruction

Provide a comprehensive implementation blueprint for the following architectural phases:

1. Infrastructure Provisioning: Outline the process to install ArgoCD on a Kubernetes cluster using Helm, adhering to security best practices (e.g., restricted namespaces, private load balancers).
2. Repository Architecture: Define the separation of concerns between [APP_SOURCE_REPO] and [MANIFEST_REPO]. Explain the directory structure to support multiple environments (dev/staging/prod).
3. ArgoCD Integration: Guide the configuration of the Git repository as a source, including SSH key management and webhooks.
4. Application Orchestration: Create template Application manifests that utilize syncPolicy for automated self-healing and drift detection.
5. Orchestration Logic: Detail the implementation of sync waves and health checks to ensure dependencies are respected during multi-component deployments.
6. Progressive Delivery: Design an Argo Rollouts strategy for Canary or Blue-Green deployments, including the analysis templates required for automated promotion/rollback.
7. Security & Governance: Define RBAC policies using OIDC/Dex integration to restrict team access based on the Principle of Least Privilege.
8. Resilience: Document the explicit rollback procedures and a disaster recovery plan for restoring the GitOps control plane if the cluster is lost.

⚖️ Constraints & Tone

• Tone: Professional, technical, and prescriptive.
• Length: Detailed, focusing on high-impact architectural decisions rather than basic CLI syntax.
• Avoid: Do not include fluff, generic definitions of GitOps, or sales-oriented language. Focus purely on technical implementation steps.

📝 Output Format

• Use Markdown for all technical documentation.
• Provide code blocks for YAML manifests and configuration snippets.
• Use tables for mapping RBAC permissions and sync-wave ordering.
• Include a dedicated "Key Considerations" section for production-grade security (e.g., Image signing, secret management with Vault).
• Ensure the guide is modular, allowing me to plug in specific variables for [CLUSTER_NAME] and [NAMESPACE_STRATEGY].