DevOps / Infrastructure2026

Side Project Ops (GitOps Platform)

An ArgoCD App-of-Apps GitOps repository that centrally manages Kubernetes deployments for all side projects via automated CI/CD pipelines.

Project Overview

A GitOps monorepo that serves as the single source of truth for all Kubernetes deployments across multiple side projects. Uses ArgoCD's App-of-Apps pattern: a single root application bootstraps all child application definitions, which in turn manage their namespace, Kustomize manifests, and Sealed Secrets. Projects currently managed include chat-app, gf-soap (frontend/backend/admin), lazybacktest (frontend/backend), personal-site, and hexo-blog. CI pipelines in source repos build Docker images, push to GHCR, then commit the new image tag here to trigger ArgoCD auto-sync.

Technical Challenges & Solutions

App-of-Apps Bootstrap

Managing dozens of ArgoCD Application manifests individually becomes unwieldy. Needed a scalable pattern for adding new projects without manual ArgoCD UI interaction.

Solution:

Implemented the App-of-Apps pattern: a single root ArgoCD Application watches the apps/ directory and automatically creates/updates child Applications. Adding a new project requires only adding an Application YAML to apps/ and committing — ArgoCD handles the rest.

Secret Management in Git

Storing Kubernetes Secrets (database passwords, API keys) in a Git repository is a security risk.

Solution:

Used kubeseal (Bitnami Sealed Secrets) to encrypt secrets with the cluster's public key before committing. The encrypted SealedSecret YAML is safe to store publicly; only the cluster's controller can decrypt it at deploy time.

Private Registry Image Pulls

K3s pods need to pull Docker images from private GHCR repositories across all namespaces.

Solution:

Created a shared ghcr-pull-secret Kubernetes Secret (sealed) and configured it as imagePullSecrets in each deployment's Kustomize patch, allowing all projects to pull from private GHCR without storing credentials in plain text.

Architecture

Repository structure: apps/ (ArgoCD Application YAMLs), projects/<name>/<component>/ (Kustomize manifests). Root app (root-app.yaml) watches the apps/ directory. kubeseal encrypts secrets into SealedSecret objects safe to commit. Private GHCR images use a shared ghcr-pull-secret. A _template/ directory enables rapid onboarding of new projects.

Learnings

Building this GitOps platform gave me a practical understanding of the ArgoCD App-of-Apps pattern and the full GitOps workflow cycle: code push → Docker build → GHCR push → tag commit → ArgoCD sync → rolling update. Managing secrets with kubeseal made me appreciate the importance of keeping encrypted secrets in Git for auditability.

Tech Stack

GitOps & CD

ArgoCDApp-of-Apps Pattern

Container Orchestration

K3sKustomize

Secret Management

kubesealBitnami Sealed Secrets

Deployment

GitHub ActionsGHCRDocker