What are the GitOps / infrastructure-as-code practices for a CP4BA Workflow deployment (CR, secrets, environments)?

Question

We manage OpenShift with GitOps (Argo CD). How do we treat the CP4BA custom resource, the secrets and the per-environment differences of Workflow so that dev / test / prod are reproducible?

Answer 1

The whole platform configuration of a CP4BA workflow deployment is a small set of Kubernetes objects; treat them as code:

1. Repository layout: base/ with the operator subscription, the ICP4ACluster CR template, ConfigMaps (custom 100Custom.xml, Liberty config), NetworkPolicies; overlays/dev|test|prod/ (Kustomize) or Helm values with the differences: replicas and resources, database hosts, LDAP, route hostnames, image versions / appVersion, certificate secret names.
2. Secrets: never in Git in clear text - use Sealed Secrets, External Secrets Operator (Vault, AWS / Azure secret stores) or SOPS; the CR references secret names, so the names are in Git and the values come from the vault. The operator generates some secrets itself (admin passwords) - export them once and put them under management or let the operator keep them.
3. Sync waves: operator subscription first, then the CR; the operator takes 30-90 minutes to reconcile a new environment - Argo CD health checks must tolerate the Ready condition taking time (custom health check on .status.conditions).
4. Application layer is not GitOps'd through the CR: process app snapshots are promoted with the Operations REST (question on CI/CD) from the pipeline; but keep the twx and the environment values (env vars, EPVs, team bindings as JSON) in Git so that a fresh environment can be rebuilt end to end.
5. Upgrades: bump the operator channel and appVersion in an overlay, test in dev, promote by promoting the commit; database backups before the prod sync.

# overlays/prod/kustomization.yaml
resources: [ ../../base ]
patches:
- target: { kind: ICP4ACluster, name: icp4adeploy }
  patch: |-
    - op: replace
      path: /spec/baw_configuration/0/replicas
      value: 3
    - op: replace
      path: /spec/baw_configuration/0/database/server_name
      value: db2-prod.example.com
    - op: replace
      path: /spec/shared_configuration/sc_deployment_hostname_suffix
      value: apps.prod.example.com

Rules learnt the hard way: one namespace per environment (or per cluster for prod), never edit the CR in the console (Argo reverts it - and a manual edit hides in the next diff), pin image digests for prod, keep the license acceptance flag in the base, and store the operator's generated status.endpoints output as documentation, not as source.

References

• CP4BA documentation - installing with the operator, custom resource reference