Lab: reconcile MicroBank from a local overlay

Prerequisites

Start after the Kubernetes lab passes its transaction check. Keep its infrastructure and private Secret under their existing owners. This Application will manage only the two API Deployments and Services. Use a practice branch in a Git repository you control that the local controller can read; a local unpushed commit is not reachable automatically.

1. Create a base and one overlay

mkdir -p infra/study/gitops/base infra/study/gitops/overlays/local
cp infra/study/k8s/apps.json infra/study/gitops/base/apps.json

Save infra/study/gitops/base/kustomization.yaml:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - apps.json

Save infra/study/gitops/overlays/local/kustomization.yaml:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: microbank
resources:
  - ../../base
commonAnnotations:
  learning.learnwithsk.dev/environment: local

kubectl kustomize infra/study/gitops/overlays/local > evidence/local-rendered.yaml
kubectl --context kind-microbank-advanced diff -k infra/study/gitops/overlays/local

A diff exit status of 1 normally means differences, not a failed deployment. Inspect all objects. Commit and push the manifest files to your own practice branch through your normal review workflow; exclude Secrets, .local/, state, and case evidence. Record that reachable commit hash.

2. Install a reviewed Core release

Select a compatible Argo CD release from official release notes. Download that exact release's Core manifest, inspect its resources, and record its checksum before applying to this disposable cluster:

: "${ARGOCD_VERSION:?Select an explicit reviewed release tag}"
curl --fail --location --output .local/argocd-core.yaml \
  "https://raw.githubusercontent.com/argoproj/argo-cd/$ARGOCD_VERSION/manifests/core-install.yaml"
shasum -a 256 .local/argocd-core.yaml
kubectl --context kind-microbank-advanced create namespace argocd
kubectl --context kind-microbank-advanced apply -n argocd --server-side -f .local/argocd-core.yaml
kubectl --context kind-microbank-advanced -n argocd get pods

Wait for the controller and repository components to be ready before continuing. Measure their memory use. Use the official troubleshooting guide if the repository server cannot reach Git. Configure private-repository credentials through Argo CD's supported mechanism only if needed; never embed them in the repository URL below.

3. Restrict the destination and source

Save .local/argocd-application.yaml and replace both repository URLs and REPLACE_WITH_REACHABLE_COMMIT. This is a template to complete before applying:

apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: microbank-local
  namespace: argocd
spec:
  sourceRepos:
    - https://github.com/REPLACE_OWNER/REPLACE_REPO.git
  destinations:
    - server: https://kubernetes.default.svc
      namespace: microbank
  clusterResourceWhitelist: []
  namespaceResourceWhitelist:
    - group: apps
      kind: Deployment
    - group: ""
      kind: Service
    - group: ""
      kind: ConfigMap
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: microbank-local
  namespace: argocd
spec:
  project: microbank-local
  source:
    repoURL: https://github.com/REPLACE_OWNER/REPLACE_REPO.git
    targetRevision: REPLACE_WITH_REACHABLE_COMMIT
    path: infra/study/gitops/overlays/local
  destination:
    server: https://kubernetes.default.svc
    namespace: microbank

No automatic sync, pruning, cascade finalizer, or cluster-wide resource permission is requested by this Application. Its project is an application boundary; it does not reduce the installed controller's own cluster permissions.

kubectl --context kind-microbank-advanced apply -f .local/argocd-application.yaml
kubectl --context kind-microbank-advanced -n argocd get application microbank-local -o yaml
kubectl --context kind-microbank-advanced -n argocd patch application microbank-local \
  --type merge --patch '{"operation":{"sync":{"prune":false}}}'
kubectl --context kind-microbank-advanced -n argocd get application microbank-local

Inspect .status.operationState, conditions, and resource results to confirm the sync completed; accepting the patch only starts the operation. Restart the API port-forwards if Pods were replaced and verify the saved case.

4. Demonstrate one reviewable change

Change the overlay's learning annotation, render it, commit/push, and update targetRevision to that new commit. Apply the updated Application and request another manual sync. Compare the intended revision, observed annotation, and unchanged artifact identity. Then practise a single image change with the matching image loaded into kind before syncing it.

For a harmless drift exercise, temporarily edit that annotation in the live Pod template and observe the diff before restoring the Git value. Never add database resources to the first pruning exercise.

Checkpoint and ownership handoff

Retain both revisions, rendered diff, actual sync result, and transaction verification. Before the later Rollouts lab, delete only this Application without a cascade finalizer so its resources remain. Inspect metadata.finalizers first; if a resource-deletion finalizer is present, use the documented non-cascading deletion procedure instead. Do not let this Deployment manifest recreate Ledger while the Rollouts exercise owns it.

Explain the two versions of the same change

The overlay diff is the author-facing edit; the rendered diff is what Kubernetes will receive. For the annotation exercise, verify that the rendered change has the expected namespace and resources and that the image remains the intended one. A Pod-template annotation can still replace Pods, so repeat the saved-case check after the sync.

If Argo CD reports a repository error, verify the reachable revision and controller credentials before changing Kubernetes workloads. If sync completes but the case fails, move to the application path. Keep these failures separate in the record; the next module instruments that observation path.

Sources

Kustomize↗, Core installation↗, project restrictions↗, and Application deletion↗.