Gitops

I needed VPN access to Azure resources across multiple subscriptions. The requirement was simple: secure access without managing additional credentials, no PSKs floating around, and everything infrastructure-as-code. Here’s how I built it. The Problem The Azure environment spans many subscriptions with overlapping IP ranges - a legacy of growth. We had: SQL Managed Instances requiring private connectivity Public SQL databases needing IP whitelisting Development teams needing ad-hoc access Zero appetite for managing VPN credentials separately from Azure AD Traditional VPN solutions would require: ...

GitOps Fundamentals Core Principles Declarative Infrastructure Version Controlled Changes Automated Reconciliation Self-healing Systems Implementation Patterns ArgoCD Application Configuration apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: production-app spec: project: default source: repoURL: https://github.com/org/app-config.git targetRevision: HEAD path: environments/production destination: server: https://kubernetes.default.svc namespace: production syncPolicy: automated: prune: true selfHeal: true Workflow Patterns Multi-Environment Setup # environments/base/kustomization.yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - deployment.yaml - service.yaml - ingress.yaml # environments/production/kustomization.yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization bases: - ../base patchesStrategicMerge: - production-patches.yaml Security Practices RBAC Configuration apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: gitops-deployer rules: - apiGroups: ["apps"] resources: ["deployments"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] Production Example # Complete GitOps application setup apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: full-stack-app namespace: argocd spec: project: production source: repoURL: https://github.com/org/app-config.git targetRevision: main path: environments/production directory: recurse: true destination: server: https://kubernetes.default.svc namespace: production syncPolicy: automated: prune: true selfHeal: true syncOptions: - CreateNamespace=true retry: limit: 5 backoff: duration: 5s factor: 2 maxDuration: 3m These patterns ensure reliable, automated deployment workflows. ...

Progressive Delivery with ArgoCD Blue-Green Deployments apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: blue-green-app spec: source: plugin: name: argocd-rollouts repoURL: https://github.com/org/app.git targetRevision: HEAD path: rollouts/ destination: server: https://kubernetes.default.svc namespace: production --- apiVersion: argoproj.io/v1alpha1 kind: Rollout metadata: name: blue-green-rollout spec: replicas: 3 strategy: blueGreen: activeService: active-service previewService: preview-service autoPromotionEnabled: false template: spec: containers: - name: app image: app:1.0 Multi-Cluster Management Cluster Configuration apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: name: multi-cluster-apps spec: generators: - clusters: {} template: metadata: name: '{{name}}-app' spec: project: default source: repoURL: https://github.com/org/app-configs.git targetRevision: HEAD path: environments/{{name}} destination: server: '{{server}}' namespace: production Sync Strategies Selective Sync apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: selective-sync-app annotations: argocd.argoproj.io/sync-wave: "5" spec: syncPolicy: automated: prune: true selfHeal: true syncOptions: - CreateNamespace=true - PruneLast=true - ApplyOutOfSyncOnly=true source: directory: recurse: true exclude: 'excluded-patterns/**' Production Example # Complete production deployment setup apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: production-deployment annotations: notifications.argoproj.io/subscribe.on-sync-succeeded.slack: production-deploys spec: project: production source: repoURL: https://github.com/org/production-config.git targetRevision: main path: overlays/production directory: recurse: true jsonnet: extVars: - name: environment value: production destination: server: https://kubernetes.default.svc namespace: production syncPolicy: automated: prune: true selfHeal: true syncOptions: - CreateNamespace=true - ServerSideApply=true retry: limit: 5 backoff: duration: 5s factor: 2 maxDuration: 3m ignoreDifferences: - group: apps kind: Deployment jsonPointers: - /spec/replicas

If you have a custom domain and want a professional website without ongoing hosting costs, consider building a static website delivered through a Content Delivery Network (CDN). This approach offers excellent performance, high availability, and simple maintenance. My website uses this architecture, with the domain registration as my only recurring cost. Prerequisites Before getting started, you’ll need: A domain name A Git account (GitHub, GitLab, or similar) Basic command line familiarity About 1-2 hours for initial setup Domain Registration Your choice of domain registrar can significantly impact your annual costs. For supported top-level domains (TLDs), Cloudflare’s Domain Registration service (https://www.cloudflare.com/products/registrar/) stands out by charging only wholesale prices without markup or hidden fees. ...