┌─────────────┐
        │   Git 仓库   │  ← 真相（谁 Merge 了啥，有记录）
        └──────┬──────┘
               │  Argo CD 轮询 / Webhook
               ▼
        ┌─────────────┐
        │  K8s 集群    │  ← 实际运行的 Deployment / Service …
        └─────────────┘

镜像进 Harbor · 声明进 Git · 真相以 Git 为准 · Argo 负责落地

# 逻辑上等价于：
# 「把 git@xxx/manifests/overlays/prod 的内容，应用到 cluster-A 的 gpu-infer 命名空间」
spec:
  source:      # 从哪读
    repoURL: ...
    path: ...
  destination: # 写到哪
    server: ...
    namespace: ...
  syncPolicy:  # 怎么同步（手动/自动、是否自愈）

  用户 / CLI / CI
        │
        ▼
  argocd-server (UI :443)
        │
        ├─► repo-server ──► GitLab / 公网 Git
        │
        └─► application-controller ──► Kubernetes API

Git replicas:2   ──compare──►  Live replicas:1   → OutOfSync
       │                                              │
       └──────────────── Sync ────────────────────────┘
                              Live replicas:2 → Synced

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# 等待就绪
kubectl -n argocd get pods -w
# 期望 argocd-server / application-controller / repo-server 等 Running

# 取初始 admin 密码（仅首次）
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d && echo

# 本机临时访问 UI（另开终端）
kubectl -n argocd port-forward svc/argocd-server 8443:443
# 浏览器 https://localhost:8443  用户 admin

# Linux 示例
curl -sSL -o argocd https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
chmod +x argocd && sudo mv argocd /usr/local/bin/

argocd login localhost:8443 --username admin --password '<上一步密码>' --insecure
argocd version

argocd repo add https://gitlab.example.local/ai-platform/gpu-infer-manifests.git \
  --username gitlab-ci-token --password '<token>'

gpu-infer-manifests/
  base/
    deployment.yaml
    service.yaml
    kustomization.yaml
  overlays/
    lab/
      kustomization.yaml   # 实验：副本 1
    prod/
      kustomization.yaml   # 生产：副本 2、image tag

kubectl apply -f patches_cursor/基础设施_Argo_CD_原理与部署教程/03-application-demo.yaml

# 或 CLI
argocd app create demo-gpu-infer \
  --repo https://gitlab.example.local/ai-platform/gpu-infer-manifests.git \
  --path overlays/lab \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace gpu-infer \
  --sync-policy automated --self-heal

argocd app get demo-gpu-infer
argocd app sync demo-gpu-infer
argocd app wait demo-gpu-infer --health

kubectl -n gpu-infer get deploy,po
argocd app list
# SYNC STATUS = Synced, HEALTH = Healthy

kubectl -n gpu-infer scale deploy demo-nginx --replicas=3
argocd app get demo-gpu-infer
# 应显示 OutOfSync；若 selfHeal=true，稍等会回到 Git 中的副本数

浏览器
  ├─ GitLab UI     http://192.168.110.207:8929     (Docker)
  ├─ Argo CD UI    http://192.168.110.207:30080    (K3s NodePort)
  └─ demo-nginx    http://192.168.110.207:30088    (K3s NodePort)

GitLab 仓 root/argocd-manifests
        │  path: demo-nginx/
        ▼
Argo CD Application demo-nginx  ──Sync──►  NS argocd-demo

# 先同步脚本与 patches 到 207
python scripts_cursor/00_部署_workbuddy到207.py

# 安装演示环境（首次含拉 GitLab 镜像，可能 15～30 分钟）
python scripts_cursor/基础设施_Argo_CD_原理与部署教程/argocd_01_207部署演示.py

bash /opt/workbuddy/patches_cursor/基础设施_Argo_CD_原理与部署教程/install_207_demo.sh

Skipping /usr/local/bin/kubectl symlink to k3s, command exists in PATH at /usr/bin/kubectl

kubectl get nodes

couldn't get current server API group list: the server could not find the requested resource
Error from server (NotFound): the server could not find the requested resource

# 推荐：永远用 k3s 自带客户端 + 官方 kubeconfig
export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
k3s kubectl get nodes
k3s kubectl get pods -A

export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
k3s kubectl -n argocd get applications
k3s kubectl -n argocd-demo get deploy,po,svc

# 写入登录环境（推荐）
echo 'export KUBECONFIG=/etc/rancher/k3s/k3s.yaml' >> ~/.bashrc
echo "alias kubectl='k3s kubectl'" >> ~/.bashrc
source ~/.bashrc

# 验证
kubectl get nodes

mv /usr/bin/kubectl /usr/bin/kubectl.bak.old
ln -sfn /usr/local/bin/k3s /usr/local/bin/kubectl
# 确认 which kubectl → /usr/local/bin/kubectl

systemctl status k3s
# 配置文件：/etc/rancher/k3s/k3s.yaml
# 卸载（慎用）：/usr/local/bin/k3s-uninstall.sh

export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
k3s kubectl -n argocd-demo get deploy,po
# Ready 应为 2/2

k3s kubectl -n argocd-demo scale deploy/demo-nginx --replicas=5
k3s kubectl -n argocd-demo get deploy -w
# 稍等：Self-Heal 会把副本拉回 Git 里的数字

argocd app list
argocd app get <app>
argocd app diff <app>
argocd app sync <app>
argocd app history <app>
argocd app rollback <app> <id>
kubectl -n argocd get applications

# 排障三板斧
argocd app get <app> --refresh
argocd app diff <app>
kubectl -n argocd logs deploy/argocd-application-controller --tail=100

apiVersion: v1
kind: Namespace
metadata:
  name: argocd
  labels:
  # 生产可单独拆管理集群；本教程装在被管集群内 argocd NS
    app.kubernetes.io/part-of: argocd

# Git 仓里应存的清单示例（路径：gpu-infer-manifests/base/deployment.yaml）
# Argo CD 只读 Git，不在这里 build 镜像
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-nginx
  namespace: gpu-infer
  labels:
    app: demo-nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo-nginx
  template:
    metadata:
      labels:
        app: demo-nginx
    spec:
      containers:
        - name: nginx
          image: harbor.example.local/library/nginx:1.27-alpine
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: demo-nginx
  namespace: gpu-infer
spec:
  selector:
    app: demo-nginx
  ports:
    - port: 80
      targetPort: 80

# 最小 Application：把 Git 某路径同步到本集群 gpu-infer 命名空间
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: demo-gpu-infer
  namespace: argocd
  # 建议加 finalizer，删 Application 时可级联清资源（生产慎用 prune）
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default
  source:
    repoURL: https://gitlab.example.local/ai-platform/gpu-infer-manifests.git
    targetRevision: main
    path: overlays/lab
    # Helm 时改用：
    # helm:
    #   valueFiles:
    #     - values-lab.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: gpu-infer
  syncPolicy:
    automated:
      prune: false
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ApplyOutOfSyncOnly=true

# 生产建议：用 AppProject 限制「能同步哪些 Git 仓 / 哪些集群 / 哪些 NS」
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: gpu-infer
  namespace: argocd
spec:
  description: GPU 推理工作负载 GitOps 项目
  sourceRepos:
    - https://gitlab.example.local/ai-platform/*
    - https://gitlab.example.local/ai-platform/gpu-infer-manifests.git
  destinations:
    - namespace: gpu-infer
      server: https://kubernetes.default.svc
    - namespace: gpu-infer-*
      server: https://kubernetes.default.svc
  clusterResourceWhitelist:
    - group: ""
      kind: Namespace
  namespaceResourceWhitelist:
    - group: apps
      kind: Deployment
    - group: ""
      kind: Service
    - group: networking.k8s.io
      kind: Ingress

# 可选：内网暴露 Argo CD UI（生产务必 HTTPS + SSO）
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: argocd-server
  namespace: argocd
  annotations:
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  ingressClassName: nginx
  rules:
    - host: argocd.gpu-k8s.example.local
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: argocd-server
                port:
                  number: 443

#!/bin/bash
# 207 单点 K3s + Docker GitLab + Argo CD 演示（可重复执行，尽量幂等）
set -euo pipefail

DEMO_ROOT=/opt/argocd-demo
GITLAB_NAME=gitlab-argocd-demo
GITLAB_URL=http://192.168.110.207:8929
GITLAB_ROOT_PASSWORD="${GITLAB_ROOT_PASSWORD:-ArgoDemo207!}"
MANIFESTS_REPO=argocd-manifests
KUBECONFIG=/etc/rancher/k3s/k3s.yaml
export KUBECONFIG
KC="k3s kubectl"

log() { echo "[$(date '+%H:%M:%S')] $*"; }

install_k3s() {
  if command -v k3s >/dev/null 2>&1 && [ -f "$KUBECONFIG" ]; then
    log "k3s 已存在，跳过安装"
    $KC get nodes || true
    return
  fi
  log "安装 k3s（国内镜像；禁用 traefik，避免占用 80 与 Dify 冲突）"
  curl -sfL https://rancher-mirror.rancher.cn/k3s/k3s-install.sh | \
    INSTALL_K3S_MIRROR=cn \
    INSTALL_K3S_EXEC="server --disable traefik --write-kubeconfig-mode 644" sh -
  sleep 10
  $KC wait --for=condition=Ready node --all --timeout=180s
  $KC get nodes
}

start_gitlab() {
  mkdir -p "$DEMO_ROOT/gitlab/config" "$DEMO_ROOT/gitlab/logs" "$DEMO_ROOT/gitlab/data"
  if docker ps -a --format '{{.Names}}' | grep -qx "$GITLAB_NAME"; then
    if ! docker ps --format '{{.Names}}' | grep -qx "$GITLAB_NAME"; then
      log "启动已有 GitLab 容器"
      docker start "$GITLAB_NAME"
    else
      log "GitLab 容器已在运行"
    fi
  else
    log "拉取并启动 GitLab CE（优先国内镜像代理）"
    local IMG="gitlab/gitlab-ce:16.11.10-ce.0"
    local MIRROR_IMG="docker.m.daocloud.io/gitlab/gitlab-ce:16.11.10-ce.0"
    if ! docker image inspect "$IMG" >/dev/null 2>&1; then
      if docker pull "$MIRROR_IMG"; then
        docker tag "$MIRROR_IMG" "$IMG"
      else
        log "国内镜像失败，再试 Docker Hub…"
        docker pull "$IMG"
      fi
    fi
    docker run -d --name "$GITLAB_NAME" \
      --hostname 192.168.110.207 \
      --restart unless-stopped \
      -p 8929:8929 -p 2224:22 \
      -v "$DEMO_ROOT/gitlab/config:/etc/gitlab" \
      -v "$DEMO_ROOT/gitlab/logs:/var/log/gitlab" \
      -v "$DEMO_ROOT/gitlab/data:/var/opt/gitlab" \
      --shm-size 256m \
      -e GITLAB_ROOT_PASSWORD="$GITLAB_ROOT_PASSWORD" \
      -e GITLAB_OMNIBUS_CONFIG="external_url '${GITLAB_URL}'; nginx['listen_port'] = 8929; gitlab_rails['gitlab_shell_ssh_port'] = 2224;" \
      "$IMG"
  fi
}

wait_gitlab() {
  log "等待 GitLab HTTP 就绪（最长 25 分钟）"
  for i in $(seq 1 150); do
    if curl -sf -o /dev/null "$GITLAB_URL/users/sign_in" 2>/dev/null; then
      log "GitLab Web 已响应 (${i}*10s)"
      # 再等 rails 完全可用
      sleep 30
      return 0
    fi
    if (( i % 6 == 0 )); then
      log "仍在等待 GitLab… ${i}*10s  docker: $(docker inspect -f '{{.State.Health.Status}}' "$GITLAB_NAME" 2>/dev/null || docker inspect -f '{{.State.Status}}' "$GITLAB_NAME")"
    fi
    sleep 10
  done
  log "ERROR: GitLab 超时未就绪"; docker logs "$GITLAB_NAME" --tail 40; exit 1
}

ensure_gitlab_project() {
  log "创建 GitLab 公开项目 root/${MANIFESTS_REPO}"
  docker exec "$GITLAB_NAME" bash -lc "gitlab-rails runner \"
u = User.find_by_username('root') || User.find_by(username: 'root')
raise 'no root user' unless u
p = Project.find_by_full_path('root/${MANIFESTS_REPO}')
unless p
  p = Projects::CreateService.new(u, {
    name: '${MANIFESTS_REPO}',
    path: '${MANIFESTS_REPO}',
    namespace_id: u.namespace.id,
    visibility_level: Gitlab::VisibilityLevel::PUBLIC
  }).execute
  raise (p.respond_to?(:errors) ? p.errors.full_messages.join(', ') : p.inspect) unless p.is_a?(Project) && p.persisted?
end
puts 'project_ok id=' + p.id.to_s
\"" || log "WARN: rails runner 创建项目失败，若仓库已存在可忽略"
}

push_manifests() {
  command -v git >/dev/null || apt-get install -y git
  local src="$DEMO_ROOT/manifests-src"
  local work="$DEMO_ROOT/manifests-git"
  rm -rf "$work"
  mkdir -p "$work"
  # 只把 demo-nginx 清单放进 Git（Application YAML 由 kubectl 单独 apply）
  cp -a "$src/demo-nginx" "$work/"
  cd "$work"
  git init -b main
  git config user.email "argocd-demo@207.local"
  git config user.name "argocd-demo"
  git add -A
  git commit -m "argocd demo manifests $(date '+%Y%m%d_%H%M%S')" || true
  git remote add origin "http://root:${GITLAB_ROOT_PASSWORD}@192.168.110.207:8929/root/${MANIFESTS_REPO}.git"
  # 首次 push 可能遇到空仓延迟，重试几次
  for i in 1 2 3 4 5; do
    if git push -u origin main --force; then
      log "manifests 已 push 到 GitLab"
      return 0
    fi
    log "push 失败，重试 $i …"
    sleep 10
  done
  exit 1
}

install_argocd() {
  log "安装 Argo CD"
  $KC create namespace argocd --dry-run=client -o yaml | $KC apply -f -
  local ARGO_YAML="$DEMO_ROOT/argocd-install.yaml"
  if [ ! -s "$ARGO_YAML" ]; then
    log "下载 Argo CD install.yaml（优先 ghproxy）"
    curl -sfL -o "$ARGO_YAML" \
      https://ghproxy.net/https://raw.githubusercontent.com/argoproj/argo-cd/v2.12.3/manifests/install.yaml \
      || curl -sfL -o "$ARGO_YAML" \
      https://cdn.jsdelivr.net/gh/argoproj/argo-cd@v2.12.3/manifests/install.yaml \
      || curl -sfL -o "$ARGO_YAML" \
      https://raw.githubusercontent.com/argoproj/argo-cd/v2.12.3/manifests/install.yaml
  fi
  $KC apply -n argocd -f "$ARGO_YAML"
  $KC wait --for=condition=available deployment/argocd-server -n argocd --timeout=900s
  $KC wait --for=condition=available deployment/argocd-repo-server -n argocd --timeout=900s
  $KC wait --for=condition=available statefulset/argocd-application-controller -n argocd --timeout=900s 2>/dev/null \
    || $KC wait --for=condition=available deployment/argocd-application-controller -n argocd --timeout=900s 2>/dev/null \
    || true
  $KC patch configmap argocd-cmd-params-cm -n argocd --type merge -p '{"data":{"server.insecure":"true"}}' 2>/dev/null || \
    $KC create configmap argocd-cmd-params-cm -n argocd --from-literal=server.insecure=true --dry-run=client -o yaml | $KC apply -f -
  $KC patch svc argocd-server -n argocd -p '{"spec":{"type":"NodePort","ports":[{"name":"http","port":80,"protocol":"TCP","targetPort":8080,"nodePort":30080},{"name":"https","port":443,"protocol":"TCP","targetPort":8080,"nodePort":30443}]}}'
  $KC rollout restart deployment/argocd-server -n argocd
  $KC wait --for=condition=available deployment/argocd-server -n argocd --timeout=300s
}

configure_argocd_repo_and_app() {
  log "注册 GitLab 仓库并创建 Application"
  $KC -n argocd delete secret gitlab-argocd-manifests --ignore-not-found
  $KC apply -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: gitlab-argocd-manifests
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  type: git
  url: ${GITLAB_URL}/root/${MANIFESTS_REPO}.git
  username: root
  password: ${GITLAB_ROOT_PASSWORD}
  insecure: "true"
EOF
  $KC apply -f "$DEMO_ROOT/argocd-application-demo-nginx.yaml"
  sleep 20
  $KC -n argocd get applications -o wide
  $KC -n argocd-demo get deploy,po,svc 2>/dev/null || true
}

print_summary() {
  local admin_pw
  admin_pw=$($KC -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' 2>/dev/null | base64 -d || echo "(已改过密码)")
  cat > "$DEMO_ROOT/访问说明.txt" <<EOF
=== 207 Argo CD + GitLab 演示 ===
GitLab:    ${GITLAB_URL}  用户 root  密码 ${GITLAB_ROOT_PASSWORD}
           项目: ${GITLAB_URL}/root/${MANIFESTS_REPO}
Argo CD:   http://192.168.110.207:30080  用户 admin  初始密码 ${admin_pw}
Demo 应用: http://192.168.110.207:30088  (demo-nginx NodePort)
kubeconfig: export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
玩法:
  1) 打开 GitLab 改 demo-nginx/deployment.yaml 的 replicas（如 1→2）-> Commit
  2) Argo UI 看 OutOfSync -> Sync（或等 automated selfHeal）
  3) k3s kubectl -n argocd-demo get po
  4) 人肉改副本: k3s kubectl -n argocd-demo scale deploy/demo-nginx --replicas=5
     稍等看 Self-Heal 拉回 Git 中的副本数
EOF
  cat "$DEMO_ROOT/访问说明.txt"
}

main() {
  install_k3s
  start_gitlab
  wait_gitlab
  ensure_gitlab_project
  push_manifests
  install_argocd
  configure_argocd_repo_and_app
  print_summary
  log "DONE"
}

main "$@"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-nginx
  labels:
    app: demo-nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo-nginx
  template:
    metadata:
      labels:
        app: demo-nginx
    spec:
      containers:
        - name: nginx
          image: nginx:1.27-alpine
          ports:
            - containerPort: 80
          readinessProbe:
            httpGet:
              path: /
              port: 80
            initialDelaySeconds: 3
            periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: demo-nginx
  labels:
    app: demo-nginx
spec:
  type: NodePort
  selector:
    app: demo-nginx
  ports:
    - name: http
      port: 80
      targetPort: 80
      nodePort: 30088

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: demo-nginx
  namespace: argocd
spec:
  project: default
  source:
    repoURL: http://192.168.110.207:8929/root/argocd-manifests.git
    targetRevision: main
    path: demo-nginx
  destination:
    server: https://kubernetes.default.svc
    namespace: argocd-demo
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true