[{"data":1,"prerenderedAt":326},["ShallowReactive",2],{"site-data":3,"article-117":143,"article-show-hot-117":171,"article-show-new-117":259},{"settings":4,"categorys":35,"tree":97,"models":118,"search_model_select":128,"nav_list":130},{"changefreq":5,"changyan_app_id":6,"changyan_app_key":6,"copy":7,"description":8,"editor":9,"file":6,"guest_feedback":10,"head_html":6,"icp":11,"index_banner":12,"index_banner_bg":13,"is_excel":14,"is_watermark":10,"keywords":15,"links":16,"logo":17,"lzcms_banner":6,"lzcms_banner_link":18,"member_register_enabled":14,"qq_app_id":6,"qq_app_key":6,"qr_code":6,"search_model":19,"site_closedreason":6,"site_idea":6,"site_idea1":20,"site_idea2":21,"site_idea3":22,"site_name":23,"site_statistice":6,"site_status":14,"site_url":18,"sitemap_model":19,"stationmaster_motto":24,"stationmaster_name":25,"stationmaster_occupation":26,"stationmaster_qq":27,"stationmaster_qqnet":28,"stationmaster_qqnet_code":29,"threshold":14,"title_add":30,"watermark":6,"watermark_alpha":31,"watermark_height":32,"watermark_locate":33,"watermark_width":34},"weekly","","版权所有 © \u003Ca class=\"site_url\" href=\"https://zhl123.com\">2026 zhl123.com\u003C/a>","linux、Python、mysql、docker、k8s技术交流","layedit","0","粤ICP备15054664号-1","/uploads/images/20181109/7a86191de8b8bb60e9c6b54d8b27c5cc.jpg","#xe604","1","linux、Python、mysql、docker、k8s","{\"1\":{\"id\":\"1\",\"link_url\":\"https://linux.org\",\"logo\":\"\",\"name\":\"linux\",\"sort\":\"0\",\"status\":\"1\"}}","/uploads/images/20181109/e7305012448aed257176dd591846f50a.png","https://zhl123.com","2","学无止境\n学习，探索，研究，从不了解到了解，从无知到掌握，到灵活运用，在不断的学习中加深认识。由浅入深，由表及里。","业精于勤\n“业精于勤荒于嬉”，精深的业技靠的是勤学、刻苦努力，靠的是争分夺秒的勤学苦练才会有精深的技术。得在认真，失在随便。","工匠精神\n精益求精，注重细节，追求完美和极致，不惜花费时间精力，孜孜不倦，反复改进产品，把99%提高到99.99%。","linux","业精于勤、学无止境、工匠精神","廖地金","高级Linux运维工程师","1256636645","592958303","\u003Ca target=\"_blank\" href=\"//shang.qq.com/wpa/qunwpa?idkey=09be7d1a682073783fd636102e666393169b8a8aac8f3393da1de57bcaa821a0\">\u003Cimg border=\"0\" src=\"//pub.idqqimg.com/wpa/images/group.png\" alt=\"Linux技术\" title=\"Linux技术\">\u003C/a>"," | Python | mysql | docker | k8s 技术交流","100","300","9","500",{"0":36,"17":51,"18":60,"19":63,"20":67,"21":71,"22":76,"25":80,"26":83,"27":89,"29":94},{"children":37},{"0":38,"25":43,"26":48},[39,40,41,42],25,21,22,26,[44,45,46,47],17,18,19,20,[49,50],27,29,{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},"index",1,"list","article",2,"文章模型","show","/article/lists?category_id=17",{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},"python","/article/lists?category_id=18",{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},"容器技术",3,"/article/lists?category_id=19",{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},"负载均衡",4,"/article/lists?category_id=20",{"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},"分享无价",0,5,"/article/lists?category_id=21",{"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},"随笔",6,"/article/lists?category_id=22",{"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},"学无止境","/article/lists?category_id=25",{"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},"picture","图集模型","关于",8,"/picture/lists?category_id=26",{"create_time":6,"description":6,"id":49,"image_url":6,"index_template":52,"is_cover":53,"is_menu":73,"keywords":6,"list_template":54,"model_code":90,"model_id":53,"model_name":91,"name":92,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":93},"page","单页模型","关于博主","/page/27",{"create_time":6,"description":6,"id":50,"image_url":6,"index_template":52,"is_cover":73,"is_menu":73,"keywords":6,"list_template":54,"model_id":73,"name":95,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":96},"留言","/feedback",[98,108,110,112],{"children":99,"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},[100,102,104,106],{"children":101,"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},[],{"children":103,"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},[],{"children":105,"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},[],{"children":107,"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},[],{"children":109,"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},[],{"children":111,"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},[],{"children":113,"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},[114,116],{"children":115,"create_time":6,"description":6,"id":49,"image_url":6,"index_template":52,"is_cover":53,"is_menu":73,"keywords":6,"list_template":54,"model_code":90,"model_id":53,"model_name":91,"name":92,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":93},[],{"children":117,"create_time":6,"description":6,"id":50,"image_url":6,"index_template":52,"is_cover":73,"is_menu":73,"keywords":6,"list_template":54,"model_id":73,"name":95,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":96},[],{"1":119,"2":120,"3":121,"4":122,"5":125},{"id":53,"index_template":52,"list_template":54,"name":91,"show_template":58,"status":73,"tablename":90},{"id":56,"index_template":52,"list_template":54,"name":57,"show_template":58,"status":73,"tablename":55},{"id":65,"index_template":52,"list_template":54,"name":85,"show_template":58,"status":73,"tablename":84},{"id":69,"index_template":52,"list_template":54,"name":123,"show_template":58,"status":73,"tablename":124},"链接模型","link",{"id":74,"index_template":52,"list_template":54,"name":126,"show_template":58,"status":73,"tablename":127},"下载模型","download",[129],{"id":56,"name":57,"tablename":55},[131,137,139,141],{"children":132,"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},[133,134,135,136],{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},{"children":138,"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},[],{"children":140,"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},[],{"children":142,"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},[],{"article":144,"breadcrumb":154,"category":158,"next":159,"prev":162,"second_categorys":165,"seo":170},{"id":145,"category_id":44,"title":146,"keywords":6,"description":147,"image_url":6,"content":148,"content_md":149,"url":150,"hits":151,"is_recommend":73,"is_top":73,"create_time":152,"update_time":153},117,"GitOps 落地实践：ArgoCD + Kustomize 实现声明式基础设施管理(一)","一、概述1.1 背景介绍GitOps 作为云原生时代的运维范式，将 Git 作为基础设施和应用配置的单一事实来源，通过声明式配置和自动化同步机制，实现了配置管理的版本控制、审计追溯和快速回滚。ArgoCD 作为 CNCF 毕业项目，提供了完整的 GitOps 工作流，支持多集群管理、RBAC 权限控制、SSO 集成等企业级特性。结合 Kustomize 的配置管理能力，能够优雅地解决多环境配置差异、敏感信息管理、配置复用等问题。在传统的 CI/CD 流程中，往往由 CI 工具直接执行 kubec","\u003Ch1 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__1\">\u003Cspan leaf=\"\">一、概述\u003C/span>\u003C/span>\u003C/h1>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__2\">\u003Cspan leaf=\"\">1.1 背景介绍\u003C/span>\u003C/span>\u003C/h3>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__3\">\u003Cspan leaf=\"\">GitOps 作为云原生时代的运维范式，将 Git 作为基础设施和应用配置的单一事实来源，通过声明式配置和自动化同步机制，实现了配置管理的版本控制、审计追溯和快速回滚。ArgoCD 作为 CNCF 毕业项目，提供了完整的 GitOps 工作流，支持多集群管理、RBAC 权限控制、SSO 集成等企业级特性。结合 Kustomize 的配置管理能力，能够优雅地解决多环境配置差异、敏感信息管理、配置复用等问题。\u003C/span>\u003C/p>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__4\">\u003Cspan leaf=\"\">在传统的 CI/CD 流程中，往往由 CI 工具直接执行 kubectl apply，这种推模式存在权限管理复杂、审计困难、状态漂移等问题。ArgoCD 采用拉模式，由运行在集群内的 Controller 主动从 Git 仓库拉取配置并应用，实现了部署权限的收敛和状态的持续同步。\u003C/span>\u003C/p>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__5\">\u003Cspan leaf=\"\">1.2 技术特点\u003C/span>\u003C/span>\u003C/h3>\u003Cul class=\"list-paddingleft-1 js_darkmode__6\">\u003Cli>\u003Csection class=\"js_darkmode__7\">\u003Cstrong class=\"js_darkmode__8\">声明式部署\u003C/strong>\u003Cspan leaf=\"\">：基于 Kubernetes 资源清单定义期望状态，ArgoCD 自动检测并消除实际状态与期望状态的偏差\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__9\">\u003Cstrong class=\"js_darkmode__10\">多集群管理\u003C/strong>\u003Cspan leaf=\"\">：单个 ArgoCD 实例可管理数百个 Kubernetes 集群，支持集群级别的 RBAC 和资源隔离\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__11\">\u003Cstrong class=\"js_darkmode__12\">自动同步策略\u003C/strong>\u003Cspan leaf=\"\">：支持手动同步、自动同步、自动修剪(Prune)、自愈(Self-Heal)等多种策略组合\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__13\">\u003Cstrong class=\"js_darkmode__14\">回滚与审计\u003C/strong>\u003Cspan leaf=\"\">：完整记录每次同步操作，支持一键回滚到任意历史版本，所有变更可追溯到 Git commit\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__15\">\u003Cstrong class=\"js_darkmode__16\">健康检查\u003C/strong>\u003Cspan leaf=\"\">：内置对 Deployment、StatefulSet、Service、Ingress 等资源的健康检查，支持自定义健康检查脚本\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__17\">\u003Cstrong class=\"js_darkmode__18\">SSO 集成\u003C/strong>\u003Cspan leaf=\"\">：支持 OAuth2、OIDC、SAML、LDAP 等多种认证方式，可与企业统一认证系统集成\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__19\">\u003Cstrong class=\"js_darkmode__20\">渐进式交付\u003C/strong>\u003Cspan leaf=\"\">：集成 Argo Rollouts 实现蓝绿部署、金丝雀发布、流量分析等高级发布策略\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__21\">\u003Cspan leaf=\"\">1.3 适用场景\u003C/span>\u003C/span>\u003C/h3>\u003Cul class=\"list-paddingleft-1 js_darkmode__22\">\u003Cli>\u003Csection class=\"js_darkmode__23\">\u003Cspan leaf=\"\">场景一：多环境配置管理，通过 Kustomize overlay 机制管理 dev/staging/prod 等环境的配置差异，避免重复维护相似配置\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__24\">\u003Cspan leaf=\"\">场景二：多集群应用分发，使用 ApplicationSet 批量创建 Application，实现应用在多个集群、多个命名空间的标准化部署\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__25\">\u003Cspan leaf=\"\">场景三：基础设施即代码，将集群基础组件(Ingress Controller、监控栈、日志收集等)以 GitOps 方式管理，实现集群配置的版本化\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__26\">\u003Cspan leaf=\"\">场景四：合规审计与权限管控，所有变更通过 Git PR 审批，部署操作由 ArgoCD 执行，开发人员无需直接访问生产集群\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__27\">\u003Cspan leaf=\"\">场景五：灾难恢复，集群配置存储在 Git，可快速在新集群重建全部应用，Recovery Time 从小时级降至分钟级\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__28\">\u003Cspan leaf=\"\">1.4 环境要求\u003C/span>\u003C/span>\u003C/h3>\u003Csection data-tool=\"mdnice编辑器\">\u003Ctable class=\"layui-table\">\u003Cthead>\u003Ctr>\u003Cth class=\"js_darkmode__29\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">组件\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__30\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">版本要求\u003C/span>\u003C/section>\u003C/th>\u003Cth class=\"js_darkmode__31\" style=\"text-align: left;\">\u003Csection>\u003Cspan leaf=\"\">说明\u003C/span>\u003C/section>\u003C/th>\u003C/tr>\u003C/thead>\u003Ctbody>\u003Ctr class=\"js_darkmode__32\">\u003Ctd class=\"js_darkmode__33\">\u003Csection>\u003Cspan leaf=\"\">操作系统\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__34\">\u003Csection>\u003Cspan leaf=\"\">Linux 内核 4.x+\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__35\">\u003Csection>\u003Cspan leaf=\"\">推荐 Ubuntu 20.04/22.04 或 RHEL 8+\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__36\">\u003Ctd class=\"js_darkmode__37\">\u003Csection>\u003Cspan leaf=\"\">Kubernetes\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__38\">\u003Csection>\u003Cspan leaf=\"\">1.24+\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__39\">\u003Csection>\u003Cspan leaf=\"\">ArgoCD 2.9+ 要求 Kubernetes 1.24+\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__40\">\u003Ctd class=\"js_darkmode__41\">\u003Csection>\u003Cspan leaf=\"\">kubectl\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__42\">\u003Csection>\u003Cspan leaf=\"\">与 K8s 版本匹配\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__43\">\u003Csection>\u003Cspan leaf=\"\">用于初始安装和手动干预\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__44\">\u003Ctd class=\"js_darkmode__45\">\u003Csection>\u003Cspan leaf=\"\">Git 仓库\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__46\">\u003Csection>\u003Cspan leaf=\"\">GitHub/GitLab/Gitea\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__47\">\u003Csection>\u003Cspan leaf=\"\">支持 HTTPS/SSH 认证，建议配置 Webhook\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__48\">\u003Ctd class=\"js_darkmode__49\">\u003Csection>\u003Cspan leaf=\"\">Kustomize\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__50\">\u003Csection>\u003Cspan leaf=\"\">内置于 kubectl\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__51\">\u003Csection>\u003Cspan leaf=\"\">ArgoCD 内置 Kustomize 5.0+\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003Ctr class=\"js_darkmode__52\">\u003Ctd class=\"js_darkmode__53\">\u003Csection>\u003Cspan leaf=\"\">硬件配置\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__54\">\u003Csection>\u003Cspan leaf=\"\">2C4G(最小)\u003C/span>\u003C/section>\u003C/td>\u003Ctd class=\"js_darkmode__55\">\u003Csection>\u003Cspan leaf=\"\">生产环境推荐 4C8G，HA 部署需 3 副本\u003C/span>\u003C/section>\u003C/td>\u003C/tr>\u003C/tbody>\u003C/table>\u003C/section>\u003Chr class=\"js_darkmode__56\">\u003Ch2 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__57\">\u003Cspan leaf=\"\">二、详细步骤\u003C/span>\u003C/span>\u003C/h2>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__58\">\u003Cspan leaf=\"\">2.1 准备工作\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__59\">\u003Cspan leaf=\"\">2.1.1 系统检查\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__60\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__0 js_darkmode__61\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__62\">\u003Cspan class=\"js_darkmode__63\"># 验证 Kubernetes 集群状态\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl cluster-info\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get nodes\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl version --short\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__64\"># 检查集群资源配额\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl top nodes\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl describe quota --all-namespaces\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__65\"># 验证存储类（ArgoCD 需要持久化存储）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get storageclass\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__66\">\u003Cspan leaf=\"\">2.1.2 安装依赖\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__67\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__1 js_darkmode__68\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__69\">\u003Cspan class=\"js_darkmode__70\"># 创建 ArgoCD 命名空间\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl create namespace argocd\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__71\"># 安装 ArgoCD（使用官方稳定版本）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__72\"># 等待所有组件就绪\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl \u003C/span>\u003Cspan>wait\u003C/span>\u003Cspan leaf=\"\"> --\u003C/span>\u003Cspan>for\u003C/span>\u003Cspan leaf=\"\">=condition=available --timeout=600s \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  deployment/argocd-server \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  deployment/argocd-repo-server \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  deployment/argocd-dex-server \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  deployment/argocd-redis \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  -n argocd\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__73\"># 安装 ArgoCD CLI\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">VERSION=$(curl -s https://api.github.com/repos/argoproj/argo-cd/releases/latest | grep tag_name | cut -d \u003C/span>\u003Cspan>'\"'\u003C/span>\u003Cspan leaf=\"\"> -f 4)\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">curl -sSL -o argocd-linux-amd64 \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"https://github.com/argoproj/argo-cd/releases/download/\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${VERSION}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">/argocd-linux-amd64\"\u003C/span>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">sudo install -m 555 argocd-linux-amd64 /usr/\u003C/span>\u003Cspan>local\u003C/span>\u003Cspan leaf=\"\">/bin/argocd\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">rm argocd-linux-amd64\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__74\"># 验证安装\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd version\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__75\">\u003Cspan leaf=\"\">2.2 核心配置\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__76\">\u003Cspan leaf=\"\">2.2.1 暴露 ArgoCD API Server\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__77\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__2 js_darkmode__78\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__79\">\u003Cspan class=\"js_darkmode__80\"># 方式一：LoadBalancer（云环境推荐）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl patch svc argocd-server -n argocd -p \u003C/span>\u003Cspan>'{\"spec\": {\"type\": \"LoadBalancer\"}}'\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__81\"># 方式二：Ingress（内网环境推荐）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">cat <<EOF | kubectl apply -f -\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">apiVersion: networking.k8s.io/v1\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kind: Ingress\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  name: argocd-server-ingress\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  namespace: argocd\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  annotations:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    nginx.ingress.kubernetes.io/ssl-passthrough: \u003C/span>\u003Cspan>\"true\"\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    nginx.ingress.kubernetes.io/backend-protocol: \u003C/span>\u003Cspan>\"HTTPS\"\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  ingressClassName: nginx\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  rules:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  - host: argocd.example.com\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    http:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      paths:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      - path: /\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        pathType: Prefix\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        backend:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          service:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            name: argocd-server\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            port:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">              name: https\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  tls:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  - hosts:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    - argocd.example.com\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    secretName: argocd-server-tls\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">EOF\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__82\"># 方式三：端口转发（开发测试）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl port-forward svc/argocd-server -n argocd 8080:443\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__83\">\u003Cstrong class=\"js_darkmode__84\">说明\u003C/strong>\u003Cspan leaf=\"\">：生产环境建议使用 Ingress + TLS 证书，避免暴露 LoadBalancer 公网 IP。SSL Passthrough 保证端到端加密，ArgoCD Server 使用自签名证书或配置自定义证书。\u003C/span>\u003C/p>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__85\">\u003Cspan leaf=\"\">2.2.2 初始化 ArgoCD\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__86\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__3 js_darkmode__87\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__88\">\u003Cspan class=\"js_darkmode__89\"># 获取初始 admin 密码\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">ARGOCD_PASSWORD=$(kubectl -n argocd get secret argocd-initial-admin-secret \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  -o jsonpath=\u003C/span>\u003Cspan>\"{.data.password}\"\u003C/span>\u003Cspan leaf=\"\"> | base64 -d)\u003C/span>\u003Cbr>\u003Cspan>echo\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"ArgoCD admin password: \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${ARGOCD_PASSWORD}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">\"\u003C/span>\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__90\"># 登录 ArgoCD\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd login argocd.example.com --username admin --password \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">\"\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">${ARGOCD_PASSWORD}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">\"\u003C/span>\u003C/span>\u003Cspan leaf=\"\"> --grpc-web\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__91\"># 修改 admin 密码\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd account update-password\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__92\"># 删除初始密码 Secret（安全加固）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl -n argocd delete secret argocd-initial-admin-secret\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__93\">\u003Cspan leaf=\"\">2.2.3 配置 Git 仓库凭证\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__94\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__4 js_darkmode__95\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__96\">\u003Cspan class=\"js_darkmode__97\"># 方式一：HTTPS 认证（使用 Personal Access Token）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd repo add https://github.com/your-org/your-repo.git \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --username git \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --password ghp_xxxxxxxxxxxxxxxxxxxx \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --name my-repo\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__98\"># 方式二：SSH 认证（推荐）\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__99\"># 生成 SSH 密钥对\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">ssh-keygen -t ed25519 -C \u003C/span>\u003Cspan>\"argocd@example.com\"\u003C/span>\u003Cspan leaf=\"\"> -f ~/.ssh/argocd_ed25519 -N \u003C/span>\u003Cspan>\"\"\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__100\"># 将公钥添加到 Git 仓库的 Deploy Keys\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">cat ~/.ssh/argocd_ed25519.pub\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__101\"># 添加私钥到 ArgoCD\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd repo add git@github.com:your-org/your-repo.git \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --ssh-private-key-path ~/.ssh/argocd_ed25519 \\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  --name my-repo\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__102\"># 验证仓库连接\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd repo list\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__103\">\u003Cstrong class=\"js_darkmode__104\">参数说明\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cul class=\"list-paddingleft-1 js_darkmode__105\">\u003Cli>\u003Csection class=\"js_darkmode__106\">\u003Ccode class=\"js_darkmode__107\">\u003Cspan leaf=\"\">--insecure-skip-server-verification\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：跳过 Git 服务器 TLS 验证（自签名证书场景）\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__108\">\u003Ccode class=\"js_darkmode__109\">\u003Cspan leaf=\"\">--proxy\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：配置代理服务器访问外部 Git 仓库\u003C/span>\u003C/section>\u003C/li>\u003Cli>\u003Csection class=\"js_darkmode__110\">\u003Ccode class=\"js_darkmode__111\">\u003Cspan leaf=\"\">--enable-lfs\u003C/span>\u003C/code>\u003Cspan leaf=\"\">：启用 Git LFS 支持大文件\u003C/span>\u003C/section>\u003C/li>\u003C/ul>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__112\">\u003Cspan leaf=\"\">2.3 启动和验证\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__113\">\u003Cspan leaf=\"\">2.3.1 创建 Application\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__114\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__5 js_darkmode__115\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__116\">\u003Cspan class=\"js_darkmode__117\"># application.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argoproj.io/v1alpha1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Application\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>guestbook\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan class=\"js_darkmode__118\"># Finalizer 确保删除 Application 时同步删除已部署资源\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>finalizers:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>resources-finalizer.argocd.argoproj.io\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>project:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>default\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>source:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan class=\"js_darkmode__119\"># Git 仓库地址\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>repoURL:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://github.com/argoproj/argocd-example-apps.git\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>targetRevision:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>HEAD\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>path:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>guestbook\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>destination:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>server:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://kubernetes.default.svc\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>default\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>syncPolicy:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>automated:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>prune:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>true\u003C/span>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan class=\"js_darkmode__120\"># 自动删除 Git 中不存在的资源\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>selfHeal:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>true\u003C/span>\u003Cspan leaf=\"\">   \u003C/span>\u003Cspan class=\"js_darkmode__121\"># 自动修复手动修改\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>allowEmpty:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>false\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>syncOptions:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>CreateNamespace=true\u003C/span>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan class=\"js_darkmode__122\"># 自动创建目标命名空间\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>retry:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>limit:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>backoff:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>duration:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5s\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>factor:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>2\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>maxDuration:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>3m\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__123\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__6 js_darkmode__124\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__125\">\u003Cspan class=\"js_darkmode__126\"># 应用配置\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl apply -f application.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__127\"># 查看 Application 状态\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app get guestbook\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__128\"># 查看同步历史\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app \u003C/span>\u003Cspan>history\u003C/span>\u003Cspan leaf=\"\"> guestbook\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__129\"># 手动触发同步\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app sync guestbook\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__130\"># 查看实时日志\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app logs guestbook --follow\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__131\">\u003Cspan leaf=\"\">2.3.2 功能验证\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__132\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__7 js_darkmode__133\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__134\">\u003Cspan class=\"js_darkmode__135\"># 验证 Application 健康状态\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app list\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__136\"># 预期输出：\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__137\"># NAME        CLUSTER                         NAMESPACE  PROJECT  STATUS  HEALTH   SYNCPOLICY\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__138\"># guestbook   https://kubernetes.default.svc  default    default  Synced  Healthy  Auto-Prune\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__139\"># 验证资源同步状态\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get all -n default -l app.kubernetes.io/instance=guestbook\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__140\"># 测试自愈功能（手动修改资源）\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl scale deployment guestbook-ui -n default --replicas=5\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__141\"># 等待 3 秒，ArgoCD 自动恢复副本数\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__142\"># 测试修剪功能（从 Git 删除资源）\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__143\"># 1. 从 Git 仓库删除某个 YAML 文件并提交\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__144\"># 2. 观察 ArgoCD 自动删除对应资源\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">argocd app \u003C/span>\u003Cspan>wait\u003C/span>\u003Cspan leaf=\"\"> guestbook --health\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Chr class=\"js_darkmode__145\">\u003Ch2 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__146\">\u003Cspan leaf=\"\">三、示例代码和配置\u003C/span>\u003C/span>\u003C/h2>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__147\">\u003Cspan leaf=\"\">3.1 完整配置示例\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__148\">\u003Cspan leaf=\"\">3.1.1 Kustomize 多环境配置结构\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__149\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__8 js_darkmode__150\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__151\">\u003Cspan class=\"js_darkmode__152\"># 仓库目录结构\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">├── base/\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   ├── kustomization.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   ├── deployment.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   ├── service.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   └── configmap.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">├── overlays/\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   ├── dev/\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   │   ├── kustomization.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   │   ├── replica-patch.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   │   └── configmap-patch.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   ├── staging/\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   │   ├── kustomization.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   │   └── resources-patch.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│   └── prod/\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│       ├── kustomization.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│       ├── replica-patch.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│       ├── hpa.yaml\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">│       └── pdb.yaml\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__153\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__9 js_darkmode__154\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__155\">\u003Cspan class=\"js_darkmode__156\"># base/kustomization.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>kustomize.config.k8s.io/v1beta1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Kustomization\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>resources:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>deployment.yaml\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>service.yaml\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>configmap.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>commonLabels:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>app:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>managed-by:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>images:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>newName:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>registry.example.com/myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>newTag:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>latest\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__157\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__10 js_darkmode__158\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__159\">\u003Cspan class=\"js_darkmode__160\"># base/deployment.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>apps/v1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Deployment\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>replicas:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>1\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>selector:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>matchLabels:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>app:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>template:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>labels:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>app:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>containers:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>image:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>ports:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>containerPort:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>8080\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>resources:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>requests:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>cpu:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>100m\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>memory:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>128Mi\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>limits:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>cpu:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>500m\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>memory:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>512Mi\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>envFrom:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>configMapRef:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp-config\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>livenessProbe:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>httpGet:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>path:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>/health\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>port:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>8080\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>initialDelaySeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>30\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>periodSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>10\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>readinessProbe:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>httpGet:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>path:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>/ready\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>port:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>8080\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>initialDelaySeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>periodSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__161\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__11 js_darkmode__162\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__163\">\u003Cspan class=\"js_darkmode__164\"># overlays/prod/kustomization.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>kustomize.config.k8s.io/v1beta1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Kustomization\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp-prod\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>bases:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>../../base\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>patchesStrategicMerge:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>replica-patch.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>resources:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>hpa.yaml\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>pdb.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>images:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>newTag:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>v1.2.3\u003C/span>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan class=\"js_darkmode__165\"># 生产环境固定版本\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan>configMapGenerator:\u003C/span>\u003Cbr>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp-config\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>behavior:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>merge\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>literals:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>LOG_LEVEL=info\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ENVIRONMENT=production\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>DB_POOL_SIZE=50\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__166\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__12 js_darkmode__167\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__168\">\u003Cspan class=\"js_darkmode__169\"># overlays/prod/replica-patch.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>apps/v1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Deployment\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>replicas:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>template:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>containers:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>resources:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>requests:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>cpu:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>500m\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>memory:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>1Gi\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>limits:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>cpu:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>2000m\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>memory:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>4Gi\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__170\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__13 js_darkmode__171\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__172\">\u003Cspan class=\"js_darkmode__173\"># overlays/prod/hpa.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>autoscaling/v2\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>HorizontalPodAutoscaler\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>scaleTargetRef:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>apps/v1\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Deployment\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>minReplicas:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>5\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>maxReplicas:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>20\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>metrics:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Resource\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>resource:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>cpu\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>target:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Utilization\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>averageUtilization:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>70\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Resource\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>resource:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>memory\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>target:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Utilization\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>averageUtilization:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>80\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>behavior:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>scaleDown:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>stabilizationWindowSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>300\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>policies:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Percent\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>value:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>50\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>periodSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>60\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>scaleUp:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>stabilizationWindowSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>0\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>policies:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Percent\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>value:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>100\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>periodSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>30\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Pods\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>value:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>4\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>periodSeconds:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>30\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>selectPolicy:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Max\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__174\">\u003Cspan leaf=\"\">3.1.2 ApplicationSet 批量管理\u003C/span>\u003C/span>\u003C/h4>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__175\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__14 js_darkmode__176\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__177\">\u003Cspan class=\"js_darkmode__178\"># applicationset.yaml - 多集群部署\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argoproj.io/v1alpha1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ApplicationSet\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>myapp-multi-cluster\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>generators:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>matrix:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>generators:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>git:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>repoURL:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://github.com/your-org/your-repo.git\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>revision:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>HEAD\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>directories:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>path:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>overlays/*\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>clusters:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>selector:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">            \u003C/span>\u003Cspan>matchLabels:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">              \u003C/span>\u003Cspan>environment:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>production\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>template:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">'myapp-\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{path.basename}}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">-\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{name}}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">'\u003C/span>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>project:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>default\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>source:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>repoURL:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://github.com/your-org/your-repo.git\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>targetRevision:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>HEAD\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>path:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">'\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{path}}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">'\u003C/span>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>destination:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>server:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">'\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{server}}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">'\u003C/span>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">'myapp-\u003C/span>\u003Cspan>\u003Cspan leaf=\"\">{{path.basename}}\u003C/span>\u003C/span>\u003Cspan leaf=\"\">'\u003C/span>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>syncPolicy:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>automated:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>prune:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>true\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">          \u003C/span>\u003Cspan>selfHeal:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>true\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>syncOptions:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">        \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>CreateNamespace=true\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch3 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__179\">\u003Cspan leaf=\"\">3.2 实际应用案例\u003C/span>\u003C/span>\u003C/h3>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__180\">\u003Cspan leaf=\"\">案例一：配置敏感信息管理\u003C/span>\u003C/span>\u003C/h4>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__181\">\u003Cstrong class=\"js_darkmode__182\">场景描述\u003C/strong>\u003Cspan leaf=\"\">：使用 Sealed Secrets 或 External Secrets Operator 管理数据库密码、API Key 等敏感信息，避免明文存储在 Git 仓库。\u003C/span>\u003C/p>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__183\">\u003Cstrong class=\"js_darkmode__184\">实现代码\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__185\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__15 js_darkmode__186\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__187\">\u003Cspan class=\"js_darkmode__188\"># 安装 Sealed Secrets Controller\u003C/span>\u003Cbr>\u003Cspan>kubectl\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>apply\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>-f\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.24.0/controller.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__189\"># 创建 Secret 并加密\u003C/span>\u003Cbr>\u003Cspan>echo\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>-n\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>'my-db-password'\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>|\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>kubectl\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>create\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>secret\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>generic\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>db-credentials\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>--dry-run=client\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>--from-file=password=/dev/stdin\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\\\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-o\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>yaml\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>|\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\\\u003C/span>\u003Cbr>\u003Cspan>kubeseal\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>-o\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>yaml\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>>\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>sealed-secret.yaml\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan class=\"js_darkmode__190\"># sealed-secret.yaml（可安全提交到 Git）\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>bitnami.com/v1alpha1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>SealedSecret\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>db-credentials\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>default\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>encryptedData:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>password:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>AgBy3i4OJSWK+PiTySYZZA9rO43cGDEq...\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>template:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>db-credentials\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">      \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>default\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>type:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Opaque\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__191\">\u003Cstrong class=\"js_darkmode__192\">运行结果\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__193\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__16 js_darkmode__194\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__195\">\u003Cspan class=\"js_darkmode__196\"># ArgoCD 同步后自动解密为 Secret\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">kubectl get secret db-credentials -o jsonpath=\u003C/span>\u003Cspan>'{.data.password}'\u003C/span>\u003Cspan leaf=\"\"> | base64 -d\u003C/span>\u003Cbr>\u003Cspan class=\"js_darkmode__197\"># 输出：my-db-password\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Ch4 data-tool=\"mdnice编辑器\">\u003Cspan class=\"js_darkmode__198\">\u003Cspan leaf=\"\">案例二：RBAC 权限配置\u003C/span>\u003C/span>\u003C/h4>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__199\">\u003Cstrong class=\"js_darkmode__200\">场景描述\u003C/strong>\u003Cspan leaf=\"\">：为开发团队配置只读权限，仅允许查看 dev 环境应用状态，禁止同步操作；为运维团队配置全部环境的管理权限。\u003C/span>\u003C/p>\u003Cp data-tool=\"mdnice编辑器\" class=\"js_darkmode__201\">\u003Cstrong class=\"js_darkmode__202\">实现步骤\u003C/strong>\u003Cspan leaf=\"\">：\u003C/span>\u003C/p>\u003Col class=\"list-paddingleft-1 js_darkmode__203\">\u003Cli>\u003Csection class=\"js_darkmode__204\">\u003Cspan leaf=\"\">创建 AppProject 隔离资源\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__205\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__17 js_darkmode__206\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__207\">\u003Cspan class=\"js_darkmode__208\"># project-dev.yaml\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argoproj.io/v1alpha1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>AppProject\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev-project\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan>spec:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>description:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Development\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>environment\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>project\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>sourceRepos:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>'https://github.com/your-org/*'\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>destinations:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>'dev-*'\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>server:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://kubernetes.default.svc\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>clusterResourceWhitelist:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>''\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Namespace\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespaceResourceWhitelist:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>'apps'\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Deployment\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>''\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Service\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>group:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>''\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ConfigMap\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>roles:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>developer\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>description:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>Read-only\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>access\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>to\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>apps\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>policies:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>p,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>proj:dev-project:developer,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>applications,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>get,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev-project/*,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>allow\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>p,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>proj:dev-project:developer,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>logs,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>get,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev-project/*,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>allow\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>groups:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>-\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev-team\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Col class=\"list-paddingleft-1 js_darkmode__209\" start=\"2\">\u003Cli>\u003Csection class=\"js_darkmode__210\">\u003Cspan leaf=\"\">配置 ArgoCD RBAC\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__211\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__18 js_darkmode__212\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__213\">\u003Cspan class=\"js_darkmode__214\"># argocd-rbac-cm ConfigMap\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>v1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ConfigMap\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd-rbac-cm\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan>data:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>policy.default:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>role:readonly\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>policy.csv:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">|\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    # 运维团队全部权限\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    g, ops-team, role:admin\u003C/span>\u003Cbr>\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan class=\"js_darkmode__215\"># 开发团队限制权限\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>p,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>role:developer,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>applications,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>get,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>*/*,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>allow\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>p,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>role:developer,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>applications,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>sync,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev-project/*,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>allow\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>p,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>role:developer,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>logs,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>get,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>*/*,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>allow\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>g,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>dev-team,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>role:developer\u003C/span>\u003Cbr>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan class=\"js_darkmode__216\"># 禁止删除生产应用\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    \u003C/span>\u003Cspan>p,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>role:developer,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>applications,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>delete,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>prod-project/*,\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>deny\u003C/span>\u003Cbr>\u003C/code>\u003C/pre>\u003Col class=\"list-paddingleft-1 js_darkmode__217\" start=\"3\">\u003Cli>\u003Csection class=\"js_darkmode__218\">\u003Cspan leaf=\"\">集成 OIDC SSO（以 Keycloak 为例）\u003C/span>\u003C/section>\u003C/li>\u003C/ol>\u003Cpre data-tool=\"mdnice编辑器\" class=\"js_darkmode__219\">\u003Cspan data-cacheurl=\"\" data-remoteid=\"\" data-lazy-bgimg=\"https://mmbiz.qpic.cn/mmbiz_svg/vtnuMBibofcZATzCe7PsSEv0icicaBiccYwMleH3MZcNOqopQtIiauqbyba8ibOgZMWh5pATeHUkXz3zPZCRJTiaSpQ5RGLEGvJtxlD/640?wx_fmt=svg&from=appmsg\" class=\"js_darkmode__bg__19 js_darkmode__220\" data-fail=\"0\">\u003C/span>\u003Ccode class=\"js_darkmode__221\">\u003Cspan class=\"js_darkmode__222\"># argocd-cm ConfigMap\u003C/span>\u003Cbr>\u003Cspan>apiVersion:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>v1\u003C/span>\u003Cbr>\u003Cspan>kind:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>ConfigMap\u003C/span>\u003Cbr>\u003Cspan>metadata:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>name:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd-cm\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>namespace:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>argocd\u003C/span>\u003Cbr>\u003Cspan>data:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>url:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>https://argocd.example.com\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">  \u003C/span>\u003Cspan>oidc.config:\u003C/span>\u003Cspan leaf=\"\"> \u003C/span>\u003Cspan>\u003Cspan leaf=\"\">|\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    name: Keycloak\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    issuer: https://keycloak.example.com/realms/master\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    clientID: argocd\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    clientSecret: $oidc.keycloak.clientSecret\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    requestedScopes:\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    - openid\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    - profile\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    - email\u003C/span>\u003Cbr>\u003Cspan leaf=\"\">    - groups\u003C/span>\u003Cbr>\u003C/span>\u003C/code>\u003C/pre>\u003Ch2 data-tool=\"mdnice编辑器\">\u003Cbr>\u003C/h2>","# 一、概述\n\n### 1.1 背景介绍\n\nGitOps 作为云原生时代的运维范式，将 Git 作为基础设施和应用配置的单一事实来源，通过声明式配置和自动化同步机制，实现了配置管理的版本控制、审计追溯和快速回滚。ArgoCD 作为 CNCF 毕业项目，提供了完整的 GitOps 工作流，支持多集群管理、RBAC 权限控制、SSO 集成等企业级特性。结合 Kustomize 的配置管理能力，能够优雅地解决多环境配置差异、敏感信息管理、配置复用等问题。\n\n在传统的 CI/CD 流程中，往往由 CI 工具直接执行 kubectl apply，这种推模式存在权限管理复杂、审计困难、状态漂移等问题。ArgoCD 采用拉模式，由运行在集群内的 Controller 主动从 Git 仓库拉取配置并应用，实现了部署权限的收敛和状态的持续同步。\n\n### 1.2 技术特点\n\n- 声明式部署：基于 Kubernetes 资源清单定义期望状态，ArgoCD 自动检测并消除实际状态与期望状态的偏差\n- 多集群管理：单个 ArgoCD 实例可管理数百个 Kubernetes 集群，支持集群级别的 RBAC 和资源隔离\n- 自动同步策略：支持手动同步、自动同步、自动修剪(Prune)、自愈(Self-Heal)等多种策略组合\n- 回滚与审计：完整记录每次同步操作，支持一键回滚到任意历史版本，所有变更可追溯到 Git commit\n- 健康检查：内置对 Deployment、StatefulSet、Service、Ingress 等资源的健康检查，支持自定义健康检查脚本\n- SSO 集成：支持 OAuth2、OIDC、SAML、LDAP 等多种认证方式，可与企业统一认证系统集成\n- 渐进式交付：集成 Argo Rollouts 实现蓝绿部署、金丝雀发布、流量分析等高级发布策略\n\n### 1.3 适用场景\n\n- 场景一：多环境配置管理，通过 Kustomize overlay 机制管理 dev/staging/prod 等环境的配置差异，避免重复维护相似配置\n- 场景二：多集群应用分发，使用 ApplicationSet 批量创建 Application，实现应用在多个集群、多个命名空间的标准化部署\n- 场景三：基础设施即代码，将集群基础组件(Ingress Controller、监控栈、日志收集等)以 GitOps 方式管理，实现集群配置的版本化\n- 场景四：合规审计与权限管控，所有变更通过 Git PR 审批，部署操作由 ArgoCD 执行，开发人员无需直接访问生产集群\n- 场景五：灾难恢复，集群配置存储在 Git，可快速在新集群重建全部应用，Recovery Time 从小时级降至分钟级\n\n### 1.4 环境要求\n\n组件\n\n版本要求\n\n说明\n\n操作系统\n\nLinux 内核 4.x+\n\n推荐 Ubuntu 20.04/22.04 或 RHEL 8+\n\nKubernetes\n\n1.24+\n\nArgoCD 2.9+ 要求 Kubernetes 1.24+\n\nkubectl\n\n与 K8s 版本匹配\n\n用于初始安装和手动干预\n\nGit 仓库\n\nGitHub/GitLab/Gitea\n\n支持 HTTPS/SSH 认证，建议配置 Webhook\n\nKustomize\n\n内置于 kubectl\n\nArgoCD 内置 Kustomize 5.0+\n\n硬件配置\n\n2C4G(最小)\n\n生产环境推荐 4C8G，HA 部署需 3 副本\n\n---\n\n## 二、详细步骤\n\n### 2.1 准备工作\n\n#### 2.1.1 系统检查\n\n```\n# 验证 Kubernetes 集群状态kubectl cluster-infokubectl get nodeskubectl version --short# 检查集群资源配额kubectl top nodeskubectl describe quota --all-namespaces# 验证存储类（ArgoCD 需要持久化存储）kubectl get storageclass\n```\n\n#### 2.1.2 安装依赖\n\n```\n# 创建 ArgoCD 命名空间kubectl create namespace argocd# 安装 ArgoCD（使用官方稳定版本）kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml# 等待所有组件就绪kubectl wait --for=condition=available --timeout=600s \\  deployment/argocd-server \\  deployment/argocd-repo-server \\  deployment/argocd-dex-server \\  deployment/argocd-redis \\  -n argocd# 安装 ArgoCD CLIVERSION=$(curl -s https://api.github.com/repos/argoproj/argo-cd/releases/latest | grep tag_name | cut -d '\"' -f 4)curl -sSL -o argocd-linux-amd64 \"https://github.com/argoproj/argo-cd/releases/download/${VERSION}/argocd-linux-amd64\"sudo install -m 555 argocd-linux-amd64 /usr/local/bin/argocdrm argocd-linux-amd64# 验证安装argocd version\n```\n\n### 2.2 核心配置\n\n#### 2.2.1 暴露 ArgoCD API Server\n\n```\n# 方式一：LoadBalancer（云环境推荐）kubectl patch svc argocd-server -n argocd -p '{\"spec\": {\"type\": \"LoadBalancer\"}}'# 方式二：Ingress（内网环境推荐）cat\n```\n\n**说明**\n：生产环境建议使用 Ingress + TLS 证书，避免暴露 LoadBalancer 公网 IP。SSL Passthrough 保证端到端加密，ArgoCD Server 使用自签名证书或配置自定义证书。\n\n#### 2.2.2 初始化 ArgoCD\n\n```\n# 获取初始 admin 密码ARGOCD_PASSWORD=$(kubectl -n argocd get secret argocd-initial-admin-secret \\  -o jsonpath=\"{.data.password}\" | base64 -d)echo \"ArgoCD admin password: ${ARGOCD_PASSWORD}\"# 登录 ArgoCDargocd login argocd.example.com --username admin --password \"${ARGOCD_PASSWORD}\" --grpc-web# 修改 admin 密码argocd account update-password# 删除初始密码 Secret（安全加固）kubectl -n argocd delete secret argocd-initial-admin-secret\n```\n\n#### 2.2.3 配置 Git 仓库凭证\n\n```\n# 方式一：HTTPS 认证（使用 Personal Access Token）argocd repo add https://github.com/your-org/your-repo.git \\  --username git \\  --password ghp_xxxxxxxxxxxxxxxxxxxx \\  --name my-repo# 方式二：SSH 认证（推荐）# 生成 SSH 密钥对ssh-keygen -t ed25519 -C \"argocd@example.com\" -f ~/.ssh/argocd_ed25519 -N \"\"# 将公钥添加到 Git 仓库的 Deploy Keyscat ~/.ssh/argocd_ed25519.pub# 添加私钥到 ArgoCDargocd repo add git@github.com:your-org/your-repo.git \\  --ssh-private-key-path ~/.ssh/argocd_ed25519 \\  --name my-repo# 验证仓库连接argocd repo list\n```\n\n**参数说明**\n：\n\n- --insecure-skip-server-verification：跳过 Git 服务器 TLS 验证（自签名证书场景）\n- --proxy：配置代理服务器访问外部 Git 仓库\n- --enable-lfs：启用 Git LFS 支持大文件\n\n### 2.3 启动和验证\n\n#### 2.3.1 创建 Application\n\n```\n# application.yamlapiVersion: argoproj.io/v1alpha1kind: Applicationmetadata:  name: guestbook  namespace: argocd  # Finalizer 确保删除 Application 时同步删除已部署资源  finalizers:  - resources-finalizer.argocd.argoproj.iospec:  project: default  source:    # Git 仓库地址    repoURL: https://github.com/argoproj/argocd-example-apps.git    targetRevision: HEAD    path: guestbook  destination:    server: https://kubernetes.default.svc    namespace: default  syncPolicy:    automated:      prune: true      # 自动删除 Git 中不存在的资源      selfHeal: true   # 自动修复手动修改      allowEmpty: false    syncOptions:    - CreateNamespace=true  # 自动创建目标命名空间    retry:      limit: 5      backoff:        duration: 5s        factor: 2        maxDuration: 3m\n```\n\n```\n# 应用配置kubectl apply -f application.yaml# 查看 Application 状态argocd app get guestbook# 查看同步历史argocd app history guestbook# 手动触发同步argocd app sync guestbook# 查看实时日志argocd app logs guestbook --follow\n```\n\n#### 2.3.2 功能验证\n\n```\n# 验证 Application 健康状态argocd app list# 预期输出：# NAME        CLUSTER                         NAMESPACE  PROJECT  STATUS  HEALTH   SYNCPOLICY# guestbook   https://kubernetes.default.svc  default    default  Synced  Healthy  Auto-Prune# 验证资源同步状态kubectl get all -n default -l app.kubernetes.io/instance=guestbook# 测试自愈功能（手动修改资源）kubectl scale deployment guestbook-ui -n default --replicas=5# 等待 3 秒，ArgoCD 自动恢复副本数# 测试修剪功能（从 Git 删除资源）# 1. 从 Git 仓库删除某个 YAML 文件并提交# 2. 观察 ArgoCD 自动删除对应资源argocd app wait guestbook --health\n```\n\n---\n\n## 三、示例代码和配置\n\n### 3.1 完整配置示例\n\n#### 3.1.1 Kustomize 多环境配置结构\n\n```\n# 仓库目录结构├── base/│   ├── kustomization.yaml│   ├── deployment.yaml│   ├── service.yaml│   └── configmap.yaml├── overlays/│   ├── dev/│   │   ├── kustomization.yaml│   │   ├── replica-patch.yaml│   │   └── configmap-patch.yaml│   ├── staging/│   │   ├── kustomization.yaml│   │   └── resources-patch.yaml│   └── prod/│       ├── kustomization.yaml│       ├── replica-patch.yaml│       ├── hpa.yaml│       └── pdb.yaml\n```\n\n```\n# base/kustomization.yamlapiVersion: kustomize.config.k8s.io/v1beta1kind: Kustomizationresources:- deployment.yaml- service.yaml- configmap.yamlcommonLabels:  app: myapp  managed-by: argocdnamespace: myappimages:- name: myapp  newName: registry.example.com/myapp  newTag: latest\n```\n\n```\n# base/deployment.yamlapiVersion: apps/v1kind: Deploymentmetadata:  name: myappspec:  replicas: 1  selector:    matchLabels:      app: myapp  template:    metadata:      labels:        app: myapp    spec:      containers:      - name: myapp        image: myapp        ports:        - containerPort: 8080        resources:          requests:            cpu: 100m            memory: 128Mi          limits:            cpu: 500m            memory: 512Mi        envFrom:        - configMapRef:            name: myapp-config        livenessProbe:          httpGet:            path: /health            port: 8080          initialDelaySeconds: 30          periodSeconds: 10        readinessProbe:          httpGet:            path: /ready            port: 8080          initialDelaySeconds: 5          periodSeconds: 5\n```\n\n```\n# overlays/prod/kustomization.yamlapiVersion: kustomize.config.k8s.io/v1beta1kind: Kustomizationnamespace: myapp-prodbases:- ../../basepatchesStrategicMerge:- replica-patch.yamlresources:- hpa.yaml- pdb.yamlimages:- name: myapp  newTag: v1.2.3  # 生产环境固定版本configMapGenerator:- name: myapp-config  behavior: merge  literals:  - LOG_LEVEL=info  - ENVIRONMENT=production  - DB_POOL_SIZE=50\n```\n\n```\n# overlays/prod/replica-patch.yamlapiVersion: apps/v1kind: Deploymentmetadata:  name: myappspec:  replicas: 5  template:    spec:      containers:      - name: myapp        resources:          requests:            cpu: 500m            memory: 1Gi          limits:            cpu: 2000m            memory: 4Gi\n```\n\n```\n# overlays/prod/hpa.yamlapiVersion: autoscaling/v2kind: HorizontalPodAutoscalermetadata:  name: myappspec:  scaleTargetRef:    apiVersion: apps/v1    kind: Deployment    name: myapp  minReplicas: 5  maxReplicas: 20  metrics:  - type: Resource    resource:      name: cpu      target:        type: Utilization        averageUtilization: 70  - type: Resource    resource:      name: memory      target:        type: Utilization        averageUtilization: 80  behavior:    scaleDown:      stabilizationWindowSeconds: 300      policies:      - type: Percent        value: 50        periodSeconds: 60    scaleUp:      stabilizationWindowSeconds: 0      policies:      - type: Percent        value: 100        periodSeconds: 30      - type: Pods        value: 4        periodSeconds: 30      selectPolicy: Max\n```\n\n#### 3.1.2 ApplicationSet 批量管理\n\n```\n# applicationset.yaml - 多集群部署apiVersion: argoproj.io/v1alpha1kind: ApplicationSetmetadata:  name: myapp-multi-cluster  namespace: argocdspec:  generators:  - matrix:      generators:      - git:          repoURL: https://github.com/your-org/your-repo.git          revision: HEAD          directories:          - path: overlays/*      - clusters:          selector:            matchLabels:              environment: production  template:    metadata:      name: 'myapp-{{path.basename}}-{{name}}'    spec:      project: default      source:        repoURL: https://github.com/your-org/your-repo.git        targetRevision: HEAD        path: '{{path}}'      destination:        server: '{{server}}'        namespace: 'myapp-{{path.basename}}'      syncPolicy:        automated:          prune: true          selfHeal: true        syncOptions:        - CreateNamespace=true\n```\n\n### 3.2 实际应用案例\n\n#### 案例一：配置敏感信息管理\n\n**场景描述**\n：使用 Sealed Secrets 或 External Secrets Operator 管理数据库密码、API Key 等敏感信息，避免明文存储在 Git 仓库。\n\n**实现代码**\n：\n\n```\n# 安装 Sealed Secrets Controllerkubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.24.0/controller.yaml# 创建 Secret 并加密echo -n 'my-db-password' | kubectl create secret generic db-credentials \\  --dry-run=client \\  --from-file=password=/dev/stdin \\  -o yaml | \\kubeseal -o yaml > sealed-secret.yaml# sealed-secret.yaml（可安全提交到 Git）apiVersion: bitnami.com/v1alpha1kind: SealedSecretmetadata:  name: db-credentials  namespace: defaultspec:  encryptedData:    password: AgBy3i4OJSWK+PiTySYZZA9rO43cGDEq...  template:    metadata:      name: db-credentials      namespace: default    type: Opaque\n```\n\n**运行结果**\n：\n\n```\n# ArgoCD 同步后自动解密为 Secretkubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d# 输出：my-db-password\n```\n\n#### 案例二：RBAC 权限配置\n\n**场景描述**\n：为开发团队配置只读权限，仅允许查看 dev 环境应用状态，禁止同步操作；为运维团队配置全部环境的管理权限。\n\n**实现步骤**\n：\n\n1. 创建 AppProject 隔离资源\n\n```\n# project-dev.yamlapiVersion: argoproj.io/v1alpha1kind: AppProjectmetadata:  name: dev-project  namespace: argocdspec:  description: Development environment project  sourceRepos:  - 'https://github.com/your-org/*'  destinations:  - namespace: 'dev-*'    server: https://kubernetes.default.svc  clusterResourceWhitelist:  - group: ''    kind: Namespace  namespaceResourceWhitelist:  - group: 'apps'    kind: Deployment  - group: ''    kind: Service  - group: ''    kind: ConfigMap  roles:  - name: developer    description: Read-only access to dev apps    policies:    - p, proj:dev-project:developer, applications, get, dev-project/*, allow    - p, proj:dev-project:developer, logs, get, dev-project/*, allow    groups:    - dev-team\n```\n\n1. 配置 ArgoCD RBAC\n\n```\n# argocd-rbac-cm ConfigMapapiVersion: v1kind: ConfigMapmetadata:  name: argocd-rbac-cm  namespace: argocddata:  policy.default: role:readonly  policy.csv: |    # 运维团队全部权限    g, ops-team, role:admin    # 开发团队限制权限    p, role:developer, applications, get, */*, allow    p, role:developer, applications, sync, dev-project/*, allow    p, role:developer, logs, get, */*, allow    g, dev-team, role:developer    # 禁止删除生产应用    p, role:developer, applications, delete, prod-project/*, deny\n```\n\n1. 集成 OIDC SSO（以 Keycloak 为例）\n\n```\n# argocd-cm ConfigMapapiVersion: v1kind: ConfigMapmetadata:  name: argocd-cm  namespace: argocddata:  url: https://argocd.example.com  oidc.config: |    name: Keycloak    issuer: https://keycloak.example.com/realms/master    clientID: argocd    clientSecret: $oidc.keycloak.clientSecret    requestedScopes:    - openid    - profile    - email    - groups\n```\n\n##","/article/117",310,"2026-01-06 11:45:03","2026-01-06 11:48:56",[155,156,157],{"id":39,"name":81,"url":82},{"id":44,"name":23,"url":59},{"id":145,"name":146,"url":150},{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"title":160,"url":161},"GitOps 落地实践：ArgoCD + Kustomize 实现声明式基础设施管理(二)","/article/118",{"title":163,"url":164},"在CentOS 7中添加命令自动补全功能","/article/113",[166,167,168,169],{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},{"description":147,"keywords":6,"title":146},[172,181,188,197,206,215,224,233,242,250],{"id":173,"category_id":44,"title":174,"keywords":175,"description":176,"image_url":6,"url":177,"hits":178,"is_recommend":73,"is_top":73,"create_time":179,"update_time":180},101,"开启 HTTPS 并获得 ssllabs 满分的过程","开启,获得,满分,过程","准备工作确保你要申请证书的域名都解析到了这台服务器上，且能直接通过域名访问。使用官网推荐的CertBot获取证书。在CertBot官网选择一下环境(比如我选Nginx on Ubuntu 17.04)就可以看到入门教程了。安装CertBot12345apt-get updateapt-get install software-properties-commonadd-apt-repository ppa:certbot/certbotapt-get updateapt-get","/article/101",18546,"2019-11-26 16:12:11","2019-11-26 16:23:16",{"id":182,"category_id":44,"title":163,"keywords":183,"description":184,"image_url":6,"url":164,"hits":185,"is_recommend":73,"is_top":73,"create_time":186,"update_time":187},113,"命令自动补全,centos","在CentOS 7中，默认情况下并不会安装命令补全包，需要手动安装才能使用命令补全功能。以下是在CentOS 7中安装命令补全包的方法：1. bash-completion：这是一个针对Bash shell的命令补全软件包，可以提供对系统命令、用户自定义命令和文件路径的自动补全功能。可以通过以下命令安装：```sudo yum install bash-completion```安装完成后，需要在/etc/profile配置文件中添加以下内容：```if [ -f /etc/bash_compl",14948,"2023-05-16 10:54:01","2023-05-16 10:57:28",{"id":189,"category_id":44,"title":190,"keywords":191,"description":192,"image_url":6,"url":193,"hits":194,"is_recommend":53,"is_top":73,"create_time":195,"update_time":196},94,"Centos7 安装 openvas ","openvas,开放式漏洞评估系统，installing openvas centos-7","一、描述OpenVAS，即开放式漏洞评估系统，是一个用于评估目标漏洞的杰出框架。功能十分强大，最重要的是，它是“开源”的——就是免费的意思啦～它与著名的Nessus“本是同根生”，在Nessus商业化之后仍然坚持开源，号称“当前最好用的开源漏洞扫描工具”。最新版的Kali Linux(kali 3.0)不再自带OpenVAS了，所以我们要自己部署OpenVAS漏洞检测系统。其核心部件是一个服务器，包括一套网络漏洞测试程序，可以检测远程系统和应用程序中的安全问题。但是它的最常用用途是检测目标网络或","/article/94",14690,"2019-01-14 17:43:42","2019-01-14 18:16:36",{"id":198,"category_id":44,"title":199,"keywords":200,"description":201,"image_url":6,"url":202,"hits":203,"is_recommend":73,"is_top":73,"create_time":204,"update_time":205},99,"Centos7 利用iptables防止nmap工具防端口扫描","iptables","一、Nmap介绍       Nmap（NetworkMapper）是一款开放源代码的网络探测和安全审核工具。它用于快速扫描一个网络和一台主机开放的端口，还能使用TCP/IP协议栈特征探测远程主机的操作系统类型。nmap支持很多扫描技术，例如：UDP、TCPconnect()、TCPSYN(半开扫描)、ftp代理(bounce攻击)、反向标志、ICMP、FIN、ACK扫描、圣诞树(XmasTree)、SYN扫描和null扫描。Nmap最初是用于Unix系统","/article/99",14415,"2019-07-09 21:27:00","2019-07-09 21:57:53",{"id":207,"category_id":46,"title":208,"keywords":209,"description":210,"image_url":6,"url":211,"hits":212,"is_recommend":73,"is_top":73,"create_time":213,"update_time":214},61,"Docker 推荐的启动方式","推荐,启动,方式","# cat DockerfileFROM openjdk:8-alpineWORKDIR /ADD ./target/*.jar app.jarEXPOSE 9999COPY docker-entrypoint.sh /RUN chmod +x /docker-entrypoint.shENTRYPOINT [“/docker-entrypoint.sh”]CMD [“java”,”-server”,”-Duser.timezone=GMT+08″,”-jar”,”/app.jar”]# cat","/article/61",14347,"2018-10-22 13:55:47","2018-10-22 13:56:10",{"id":216,"category_id":44,"title":217,"keywords":218,"description":219,"image_url":6,"url":220,"hits":221,"is_recommend":73,"is_top":73,"create_time":222,"update_time":223},107,"Acme.sh 给 SSL 证书自动续期失败的解决方法","HTTP/1.1 200 OK,Server: Bayou Tech Web Srv 1.0,Content-Encoding: none,Content-Length: 5,Content-Type","一、Acme.sh 自动续期失败的症状问题描述如下，续期的时候，提示如下错误：root@dc:~# \"/data/acme.sh\"/acme.sh --cron --home \"/data/acme.sh\" > /dev/null[Sun Nov 10 23:52:17 CST 2020] Error, can not get domain token entry example.com[Sun Nov 10 23:52:17 CST 2020] Please check log file","/article/107",12618,"2021-09-03 10:44:18","2021-09-03 10:46:23",{"id":225,"category_id":44,"title":226,"keywords":227,"description":228,"image_url":6,"url":229,"hits":230,"is_recommend":53,"is_top":73,"create_time":231,"update_time":232},93,"ELK+Filebeat+Kafka+ZooKeeper 构建海量日志分析平台","Filebeat,Kafka","一、说明1.Filebeat是一个日志文件托运工具，在你的服务器上安装客户端后，filebeat会监控日志目录或者指定的日志文件，追踪读取这些文件（追踪文件的变化，不停的读）2.Kafka是一种高吞吐量的分布式发布订阅消息系统，它可以处理消费者规模的网站中的所有动作流数据3.Logstash是一根具备实时数据传输能力的管道，负责将数据信息从管道的输入端传输到管道的输出端；与此同时这根管道还可以让你根据自己的需求在中间加上滤网，Logstash提供里很多功能强大的滤网以满足你的各种应用场景4.El","/article/93",12190,"2018-12-24 16:40:08","2018-12-26 11:53:38",{"id":234,"category_id":46,"title":235,"keywords":236,"description":237,"image_url":6,"url":238,"hits":239,"is_recommend":53,"is_top":73,"create_time":240,"update_time":241},81,"kubernetes 1.12.1 高可用安装之部署Dashboard","安装Dashboard","创建Dashboard需要CoreDNS部署成功之后再安装Dashboard。[root@master01 ~]# wget https://zhl123.com/download/k8s/Dashboard.tgz[root@master01 ~]# tar xf Dashboard.tgz[root@master01 ~]# kubectl create -f Dashboard/[root@master01 Dashboard]# kubectl get svc -n kube-syste","/article/81",12037,"2018-10-26 09:54:41","2018-10-26 16:59:19",{"id":243,"category_id":44,"title":244,"keywords":6,"description":245,"image_url":6,"url":246,"hits":247,"is_recommend":73,"is_top":73,"create_time":248,"update_time":249},100,"用 Nginx 给 Cookie 增加 Secure 和 HttpOnly","在 nginx 的 location 中配置12# 只支持 proxy 模式下设置，SameSite 不需要可删除，如果想更安全可以把 SameSite 设置为 Strictproxy_cookie_path / \"/; httponly; secure; SameSite=Lax\";示例1234567891011121314151617181920212223242526server {    listen 443 ssl http2;    server_name www.zhl123.cn","/article/100",11848,"2019-11-26 16:10:57","2019-11-26 16:23:45",{"id":251,"category_id":44,"title":252,"keywords":253,"description":254,"image_url":6,"url":255,"hits":256,"is_recommend":73,"is_top":73,"create_time":257,"update_time":258},41,"Tomcat 安全配置与性能优化","tomcat，性能优化","1. JVM 1.1. 使用 Server JRE 替代JDK。 服务器上不要安装JDK，请使用 Server JRE. 服务器上根本不需要编译器，代码应该在Release服务器上完成编译打包工作。 理由：一旦服务器被控制，可以防止在其服务器上编译其他恶意代码并植入到你的程序中。 1.2. JAVA_OPTS export JAVA_OPTS=\"-server -Xms512m -Xmx4096m  -XX:PermSize=64M -","/article/41",11623,"2016-09-01 17:06:36","2018-10-18 17:06:58",[260,268,276,284,292,300,306,307,316,325],{"id":261,"category_id":40,"title":262,"keywords":6,"description":263,"image_url":6,"url":264,"hits":265,"is_recommend":73,"is_top":73,"create_time":266,"update_time":267},123,"Agent Skill 精选集：最值得收藏的 Agent Skills Top 10","如果你正在用 Claude Code 或 Codex，一定对 Agent Skills 不陌生。通过安装 Agent Skills，你可以让这些 AI 助手变得更强——不用每次都解释你的需求，它们直接就知道该怎么做。最近有人在 GitHub 上做了一个采样调查，统计了哪些 Skills 的质量最佳和最受欢迎。我整理了这份 Top 10 榜单，加上使用场景和适合人群，帮你快速找到最有用的那几个。Top 10 最受欢迎的 Agent Skills1. Skil","/article/123",270,"2026-01-19 18:49:12","2026-01-19 18:52:01",{"id":269,"category_id":44,"title":270,"keywords":6,"description":271,"image_url":6,"url":272,"hits":273,"is_recommend":73,"is_top":73,"create_time":274,"update_time":275},122,"Nginx性能调优18条黄金法则：支撑10万并发的配置模板","一、概述1.1 背景介绍说实话，Nginx调优这事儿我踩过无数坑。记得2019年双11，我们电商平台流量暴涨，Nginx直接扛不住了，QPS从平时的2万飙升到8万，响应时间从50ms飙到了2秒，最后还是靠临时加机器扛过去的。那次事故之后，我花了大半年时间专门研究Nginx的性能极限，总结出了这20条黄金法则。Nginx作为目前最流行的Web服务器和反向代理，官方数据显示单机可以轻松处理10万+的并发连接。但实际生产环境中，很多同学拿到默认配置就直接上了，结果发现连1万并发都扛不住。问题不在Ngi","/article/122",337,"2026-01-12 11:11:50","2026-01-12 11:12:28",{"id":277,"category_id":46,"title":278,"keywords":6,"description":279,"image_url":6,"url":280,"hits":281,"is_recommend":73,"is_top":73,"create_time":282,"update_time":283},121,"Docker 镜像优化与安全扫描：将镜像体积压缩 70%","1. 适用场景 & 前置条件项目要求适用场景容器化应用镜像体积过大（> 500MB），构建时间长（> 10分钟），存在安全漏洞（CVE高危）OSRHEL/CentOS 7.9+ 或 Ubuntu 20.04+内核Linux Kernel 3.10+软件版本Docker 20.10+ 或 Podman 3.0+，Trivy 0.40+（安全扫描工具）资源规格2C4G（最小）/ 4C8G（推荐），磁盘 50GB+（存储镜像与缓存）网络可访问 Docker Hub/阿里云镜像仓库（","/article/121",309,"2026-01-06 11:54:35","2026-01-06 12:01:59",{"id":285,"category_id":44,"title":286,"keywords":6,"description":287,"image_url":6,"url":288,"hits":289,"is_recommend":73,"is_top":73,"create_time":290,"update_time":291},120,"用 Prometheus Recording Rules 把告警噪声砍掉 70%(二)","五、故障排查和监控5.1 故障排查◆ 5.1.1 日志查看# 查看 Prometheus 日志中的规则评估错误journalctl -u prometheus | grep -i \"rule\" | tail -50# 查看规则评估耗时curl -s http://localhost:9090/api/v1/rules | jq '.data.groups[].rules[] | select(.health != \"ok\")'# Kubernet","/article/120",282,"2026-01-06 11:53:50","2026-01-06 11:54:33",{"id":293,"category_id":44,"title":294,"keywords":6,"description":295,"image_url":6,"url":296,"hits":297,"is_recommend":73,"is_top":73,"create_time":298,"update_time":299},119,"用 Prometheus Recording Rules 把告警噪声砍掉 70%(一)","一、概述1.1 背景介绍在大规模微服务架构下，Prometheus 告警系统往往会陷入一个尴尬的境地：告警太多，运维团队开始选择性忽略；告警太少，真正的故障又可能漏掉。我在某电商平台负责监控体系建设时，团队每天要处理超过 2000 条告警，其中 70% 以上是重复的、关联的或者短暂抖动产生的噪声。Recording Rules 是 Prometheus 提供的预计算机制，可以将复杂的查询表达式预先计算并存储为新的时间序列。通过合理设计 Recording Rules，我们不仅能显著降低 Prom","/article/119",301,"2026-01-06 11:51:58","2026-01-06 11:53:45",{"id":301,"category_id":44,"title":160,"keywords":6,"description":302,"image_url":6,"url":161,"hits":303,"is_recommend":73,"is_top":73,"create_time":304,"update_time":305},118,"四、最佳实践和注意事项4.1 最佳实践4.1.1 性能优化优化点一：减少 Git 轮询频率# argocd-cm ConfigMapapiVersion: v1kind: ConfigMapmetadata:  name: argocd-cm  namespace: argocddata:  timeout.reconciliation: 300s  # 默认 180",305,"2026-01-06 11:49:00","2026-01-06 11:49:34",{"id":145,"category_id":44,"title":146,"keywords":6,"description":147,"image_url":6,"url":150,"hits":151,"is_recommend":73,"is_top":73,"create_time":152,"update_time":153},{"id":308,"category_id":40,"title":309,"keywords":310,"description":311,"image_url":6,"url":312,"hits":313,"is_recommend":73,"is_top":73,"create_time":314,"update_time":315},116,"运维部门年度2025工作总结与2026工作规划应该如何写？","运维部门年度2025工作总结,2026工作规划","2025年，运维部在公司“数字化转型深化”战略引领下，以“稳定为基、效率为纲、安全为盾、创新为翼”为核心导向，全面支撑核心业务系统运行、推动技术架构迭代、强化团队能力建设。 全年实现核心业务系统可用性99.985%，较2024年提升0.02个百分点；故障平均恢复时间（MTTR）从42分钟压缩至29分钟，下降31%；云资源成本同比降低16.8%，自动化运维覆盖率从65%提升至83%，未发生重大生产安全事故，圆满完成年度目标。现将全年工作及2026年规划汇报如下：2025年核心工作成果（数","/article/116",297,"2026-01-06 11:20:58","2026-01-06 11:44:04",{"id":317,"category_id":40,"title":318,"keywords":319,"description":320,"image_url":6,"url":321,"hits":322,"is_recommend":73,"is_top":73,"create_time":323,"update_time":324},115,"Kubernetes 100个常用命令","100 个 Kubectl 命令","这篇文章是关于使用 Kubectl 进行 Kubernetes 诊断的指南。列出了 100 个 Kubectl 命令，这些命令对于诊断 Kubernetes 集群中的问题非常有用。这些问题包括但不限于：• 集群信息• Pod 诊断• 服务诊断• 部署诊断• 网络诊断• 持久卷和持久卷声明诊断• 资源使用情况• 安全和授权• 节点故障排除• 其他诊断命令：文章还提到了许多其他命令，如资源扩展和自动扩","/article/115",3642,"2023-11-02 14:09:30","2023-11-02 14:10:05",{"id":182,"category_id":44,"title":163,"keywords":183,"description":184,"image_url":6,"url":164,"hits":185,"is_recommend":73,"is_top":73,"create_time":186,"update_time":187},1784716028275]