# argo 네임스페이스 생성
kubectl create namespace argo

# Argo Workflows 설치 (최신 버전 확인 후 사용)
kubectl apply -n argo -f https://github.com/argoproj/argo-workflows/releases/download/v3.5.4/install.yaml

# 설치 확인
kubectl get pods -n argo

# macOS (Homebrew)
brew install argo

# Linux
curl -sLO https://github.com/argoproj/argo-workflows/releases/download/v3.5.4/argo-linux-amd64.gz
gunzip argo-linux-amd64.gz
chmod +x argo-linux-amd64
sudo mv argo-linux-amd64 /usr/local/bin/argo

# 버전 확인
argo version

# 포트 포워딩
kubectl -n argo port-forward deployment/argo-server 2746:2746

# 브라우저에서 접근
# https://localhost:2746

# argo-server deployment 수정
kubectl patch deployment argo-server \
  -n argo \
  --type='json' \
  -p='[{"op": "replace", "path": "/spec/template/spec/containers/0/args", "value": ["server", "--auth-mode=server"]}]'

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: hello-world-
spec:
  entrypoint: hello-world
  templates:
  - name: hello-world
    container:
      image: alpine:3.18
      command: [echo]
      args: ["안녕하세요! Argo Workflows 첫 실행!"]

# 워크플로우 실행
kubectl apply -f hello-world.yaml -n argo

# 또는 argo CLI로 실행
argo submit hello-world.yaml -n argo --watch

# 워크플로우 목록 확인
argo list -n argo

# 로그 확인
argo logs @latest -n argo

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: sequential-pipeline-
spec:
  entrypoint: main-steps
  templates:
  - name: main-steps
    steps:
    - - name: step-1-checkout
        template: git-checkout
    - - name: step-2-build
        template: docker-build
    - - name: step-3-test
        template: run-tests
    - - name: step-4-deploy
        template: k8s-deploy

  - name: git-checkout
    container:
      image: alpine/git:latest
      command: [sh, -c]
      args: ["echo '코드 체크아웃 완료!'"]

  - name: docker-build
    container:
      image: docker:24-dind
      command: [sh, -c]
      args: ["echo 'Docker 이미지 빌드 완료!'"]

  - name: run-tests
    container:
      image: node:20-alpine
      command: [sh, -c]
      args: ["echo '테스트 통과!'"]

  - name: k8s-deploy
    container:
      image: bitnami/kubectl:latest
      command: [sh, -c]
      args: ["echo '쿠버네티스 배포 완료!'"]

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: dag-pipeline-
spec:
  entrypoint: ci-cd-dag
  templates:
  - name: ci-cd-dag
    dag:
      tasks:
      # 1단계: 코드 체크아웃 (시작점)
      - name: checkout
        template: git-clone
        arguments:
          parameters:
          - name: repo-url
            value: "https://github.com/myorg/myapp.git"

      # 2단계: 빌드 (checkout 완료 후)
      - name: build
        dependencies: [checkout]
        template: docker-build

      # 3단계: 단위 테스트와 통합 테스트 병렬 실행
      - name: unit-test
        dependencies: [build]
        template: run-unit-tests

      - name: integration-test
        dependencies: [build]
        template: run-integration-tests

      # 4단계: 보안 스캔도 병렬로!
      - name: security-scan
        dependencies: [build]
        template: trivy-scan

      # 5단계: 모든 테스트 통과 후 스테이징 배포
      - name: deploy-staging
        dependencies: [unit-test, integration-test, security-scan]
        template: k8s-deploy
        arguments:
          parameters:
          - name: environment
            value: "staging"

      # 6단계: 스테이징 검증 후 프로덕션 배포
      - name: deploy-production
        dependencies: [deploy-staging]
        template: k8s-deploy
        arguments:
          parameters:
          - name: environment
            value: "production"

  # 템플릿 정의들
  - name: git-clone
    inputs:
      parameters:
      - name: repo-url
    container:
      image: alpine/git:latest
      command: [sh, -c]
      args: ["git clone {{inputs.parameters.repo-url}} /workspace && echo '클론 완료'"]
      volumeMounts:
      - name: workspace
        mountPath: /workspace
    volumes:
    - name: workspace
      emptyDir: {}

  - name: docker-build
    container:
      image: gcr.io/kaniko-project/executor:latest
      args:
      - --context=dir:///workspace
      - --destination=myregistry/myapp:{{workflow.name}}
      - --cache=true

  - name: run-unit-tests
    container:
      image: node:20-alpine
      command: [sh, -c]
      args: ["cd /workspace && npm test -- --testPathPattern=unit"]

  - name: run-integration-tests
    container:
      image: node:20-alpine
      command: [sh, -c]
      args: ["cd /workspace && npm test -- --testPathPattern=integration"]

  - name: trivy-scan
    container:
      image: aquasec/trivy:latest
      command: [trivy]
      args: ["image", "--exit-code", "1", "--severity", "HIGH,CRITICAL", "myregistry/myapp:{{workflow.name}}"]

  - name: k8s-deploy
    inputs:
      parameters:
      - name: environment
    container:
      image: bitnami/kubectl:latest
      command: [sh, -c]
      args: ["kubectl set image deployment/myapp myapp=myregistry/myapp:{{workflow.name}} -n {{inputs.parameters.environment}}"]

apiVersion: v1
kind: ConfigMap
metadata:
  name: workflow-controller-configmap
  namespace: argo
data:
  artifactRepository: |
    s3:
      bucket: my-argo-artifacts
      endpoint: s3.amazonaws.com
      accessKeySecret:
        name: my-s3-credentials
        key: accessKey
      secretKeySecret:
        name: my-s3-credentials
        key: secretKey

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: artifact-pipeline-
spec:
  entrypoint: artifact-dag
  templates:
  - name: artifact-dag
    dag:
      tasks:
      - name: build-step
        template: build-and-package
      - name: test-step
        dependencies: [build-step]
        template: test-with-artifact
        arguments:
          artifacts:
          - name: build-output
            from: "{{tasks.build-step.outputs.artifacts.build-result}}"

  # 빌드 스텝: 아티팩트 출력
  - name: build-and-package
    container:
      image: maven:3.9-eclipse-temurin-17
      command: [sh, -c]
      args: ["mvn package -DskipTests && echo '빌드 완료'"]
    outputs:
      artifacts:
      - name: build-result
        path: /workspace/target/myapp.jar
        s3:
          key: "{{workflow.name}}/build/myapp.jar"

  # 테스트 스텝: 아티팩트 입력
  - name: test-with-artifact
    inputs:
      artifacts:
      - name: build-output
        path: /workspace/myapp.jar
    container:
      image: eclipse-temurin:17-jre
      command: [sh, -c]
      args: ["java -jar /workspace/myapp.jar --test && echo '테스트 완료'"]
    outputs:
      artifacts:
      - name: test-report
        path: /workspace/test-results
        s3:
          key: "{{workflow.name}}/reports/test-results"

# 공통 템플릿 정의 (한 번만!)
apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: common-ci-templates
  namespace: argo
spec:
  templates:
  # Docker 빌드 공통 템플릿
  - name: docker-build
    inputs:
      parameters:
      - name: image-name
      - name: dockerfile-path
        value: "Dockerfile"
      - name: context-path
        value: "."
    container:
      image: gcr.io/kaniko-project/executor:latest
      args:
      - --dockerfile={{inputs.parameters.dockerfile-path}}
      - --context={{inputs.parameters.context-path}}
      - --destination={{inputs.parameters.image-name}}:{{workflow.name}}
      - --cache=true
      - --cache-ttl=24h
      volumeMounts:
      - name: docker-config
        mountPath: /kaniko/.docker
    volumes:
    - name: docker-config
      secret:
        secretName: docker-registry-credentials

  # Kubernetes 배포 공통 템플릿
  - name: k8s-rolling-deploy
    inputs:
      parameters:
      - name: deployment-name
      - name: image-name
      - name: namespace
        value: "default"
    resource:
      action: patch
      manifest: |
        apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: {{inputs.parameters.deployment-name}}
          namespace: {{inputs.parameters.namespace}}
        spec:
          template:
            spec:
              containers:
              - name: app
                image: {{inputs.parameters.image-name}}:{{workflow.name}}

  # Slack 알림 공통 템플릿
  - name: slack-notify
    inputs:
      parameters:
      - name: message
      - name: channel
        value: "#deployments"
    container:
      image: curlimages/curl:latest
      command: [sh, -c]
      args:
      - |
        curl -X POST -H 'Content-type: application/json' \
        --data '{"channel":"{{inputs.parameters.channel}}","text":"{{inputs.parameters.message}}"}' \
        $SLACK_WEBHOOK_URL
      env:
      - name: SLACK_WEBHOOK_URL
        valueFrom:
          secretKeyRef:
            name: slack-credentials
            key: webhook-url

# 실제 프로젝트에서 공통 템플릿 참조
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: myapp-deploy-
spec:
  entrypoint: deploy-pipeline
  templates:
  - name: deploy-pipeline
    dag:
      tasks:
      # 공통 템플릿 참조! (templateRef 사용)
      - name: build
        templateRef:
          name: common-ci-templates
          template: docker-build
        arguments:
          parameters:
          - name: image-name
            value: "myregistry/myapp"

      - name: deploy-staging
        dependencies: [build]
        templateRef:
          name: common-ci-templates
          template: k8s-rolling-deploy
        arguments:
          parameters:
          - name: deployment-name
            value: "myapp"
          - name: image-name
            value: "myregistry/myapp"
          - name: namespace
            value: "staging"

      - name: notify-success
        dependencies: [deploy-staging]
        templateRef:
          name: common-ci-templates
          template: slack-notify
        arguments:
          parameters:
          - name: message
            value: "✅ myapp 스테이징 배포 완료! 버전: {{workflow.name}}"

# Argo Events 설치
kubectl create namespace argo-events
kubectl apply -f https://github.com/argoproj/argo-events/releases/download/v1.9.0/install.yaml
kubectl apply -n argo-events -f https://github.com/argoproj/argo-events/releases/download/v1.9.0/install-validating-webhook.yaml

apiVersion: argoproj.io/v1alpha1
kind: EventSource
metadata:
  name: github-eventsource
  namespace: argo-events
spec:
  service:
    ports:
    - port: 12000
      targetPort: 12000
  github:
    myapp-repo:
      repositories:
      - owner: myorg
        names:
        - myapp
      webhook:
        endpoint: /push
        port: "12000"
        method: POST
        url: https://my-argo-events.example.com
      events:
      - push
      apiToken:
        name: github-access
        key: token
      webhookSecret:
        name: github-webhook-secret
        key: secret
      insecure: false
      active: true
      contentType: json

apiVersion: argoproj.io/v1alpha1
kind: Sensor
metadata:
  name: github-sensor
  namespace: argo-events
spec:
  template:
    serviceAccountName: argo-events-sa
  dependencies:
  - name: github-dep
    eventSourceName: github-eventsource
    eventName: myapp-repo
    filters:
      data:
      # main 브랜치 푸시만 트리거
      - path: body.ref
        type: string
        value:
        - refs/heads/main

  triggers:
  - template:
      name: argo-workflow-trigger
      argoWorkflow:
        group: argoproj.io
        version: v1alpha1
        resource: workflows
        operation: submit
        source:
          resource:
            apiVersion: argoproj.io/v1alpha1
            kind: Workflow
            metadata:
              generateName: github-triggered-
              namespace: argo
            spec:
              workflowTemplateRef:
                name: myapp-ci-pipeline
        parameters:
        # GitHub 이벤트 데이터를 워크플로우 파라미터로 전달
        - src:
            dependencyName: github-dep
            dataKey: body.after
          dest: spec.arguments.parameters.0.value
        - src:
            dependencyName: github-dep
            dataKey: body.repository.clone_url
          dest: spec.arguments.parameters.1.value

apiVersion: argoproj.io/v1alpha1
kind: WorkflowTemplate
metadata:
  name: nodejs-full-pipeline
  namespace: argo
spec:
  arguments:
    parameters:
    - name: git-repo
      value: "https://github.com/myorg/myapp.git"
    - name: git-branch
      value: "main"
    - name: image-registry
      value: "registry.example.com"
    - name: image-name
      value: "myapp"
    - name: app-version
      value: "{{workflow.name}}"

  entrypoint: full-pipeline
  
  # 볼륨 설정 (스텝 간 공유)
  volumeClaimTemplates:
  - metadata:
      name: workspace
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 2Gi

  templates:
  # ===== 메인 DAG =====
  - name: full-pipeline
    dag:
      tasks:
      # 1. 코드 체크아웃
      - name: checkout
        template: git-checkout

      # 2. 의존성 설치 및 빌드
      - name: install-and-build
        dependencies: [checkout]
        template: npm-build

      # 3. 병렬 실행: 단위테스트, 린트, 타입체크
      - name: unit-tests
        dependencies: [install-and-build]
        template: npm-test
        arguments:
          parameters:
          - name: test-script
            value: "test:unit"

      - name: lint-check
        dependencies: [install-and-build]
        template: npm-test
        arguments:
          parameters:
          - name: test-script
            value: "lint"

      - name: type-check
        dependencies: [install-and-build]
        template: npm-test
        arguments:
          parameters:
          - name: test-script
            value: "type-check"

      # 4. Docker 이미지 빌드 (테스트 통과 후)
      - name: docker-build
        dependencies: [unit-tests, lint-check, type-check]
        template: kaniko-build

      # 5. 이미지 보안 스캔
      - name: image-scan
        dependencies: [docker-build]
        template: trivy-image-scan

      # 6. 스테이징 배포
      - name: staging-deploy
        dependencies: [image-scan]
        template: helm-deploy
        arguments:
          parameters:
          - name: environment
            value: "staging"
          - name: replicas
            value: "2"

      # 7. 스테이징 스모크 테스트
      - name: staging-smoke-test
        dependencies: [staging-deploy]
        template: smoke-test
        arguments:
          parameters:
          - name: target-url
            value: "https://staging.myapp.example.com"

      # 8. 프로덕션 배포 (승인 필요)
      - name: production-deploy
        dependencies: [staging-smoke-test]
        template: helm-deploy
        arguments:
          parameters:
          - name: environment
            value: "production"
          - name: replicas
            value: "5"

      # 9. 완료 알림
      - name: notify-complete
        dependencies: [production-deploy]
        template: send-notification
        arguments:
          parameters:
          - name: status
            value: "SUCCESS"

  # ===== 개별 템플릿들 =====
  
  - name: git-checkout
    container:
      image: alpine/git:2.40.1
      command: [sh, -c]
      args:
      - |
        git clone --depth=1 --branch {{workflow.parameters.git-branch}} \
        {{workflow.parameters.git-repo}} /workspace/app
        echo "체크아웃 완료: $(git -C /workspace/app rev-parse --short HEAD)"
      volumeMounts:
      - name: workspace
        mountPath: /workspace

  - name: npm-build
    container:
      image: node:20-alpine
      command: [sh, -c]
      args:
      - |
        cd /workspace/app
        npm ci --prefer-offline
        npm run build
        echo "빌드 완료!"
      volumeMounts:
      - name: workspace
        mountPath: /workspace
      resources:
        requests:
          memory: "512Mi"
          cpu: "500m"
        limits:
          memory: "1Gi"
          cpu: "1000m"

  - name: npm-test
    inputs:
      parameters:
      - name: test-script
    container:
      image: node:20-alpine
      command: [sh, -c]
      args:
      - |
        cd /workspace/app
        npm run {{inputs.parameters.test-script}}
      volumeMounts:
      - name: workspace
        mountPath: /workspace
    outputs:
      artifacts:
      - name: test-results
        path: /workspace/app/coverage
        optional: true

  - name: kaniko-build
    container:
      image: gcr.io/kaniko-project/executor:v1.19.0
      args:
      - --context=/workspace/app
      - --dockerfile=/workspace/app/Dockerfile
      - --destination={{workflow.parameters.image-registry}}/{{workflow.parameters.image-name}}:{{workflow.parameters.app-version}}
      - --destination={{workflow.parameters.image-registry}}/{{workflow.parameters.image-name}}:latest
      - --cache=true
      - --cache-repo={{workflow.parameters.image-registry}}/{{workflow.parameters.image-name}}-cache
      - --compressed-caching=false
      volumeMounts:
      - name: workspace
        mountPath: /workspace
      - name: docker-config
        mountPath: /kaniko/.docker
    volumes:
    - name: docker-config
      secret:
        secretName: registry-credentials
        items:
        - key: .dockerconfigjson
          path: config.json

  - name: trivy-image-scan
    container:
      image: aquasec/trivy:0.48.0
      command: [trivy]
      args:
      - image
      - --exit-code=1
      - --severity=HIGH,CRITICAL
      - --ignore-unfixed
      - --format=table
      - "{{workflow.parameters.image-registry}}/{{workflow.parameters.image-name}}:{{workflow.parameters.app-version}}"
    retryStrategy:
      limit: "2"
      retryPolicy: "OnFailure"

  - name: helm-deploy
    inputs:
      parameters:
      - name: environment
      - name: replicas
    container:
      image: alpine/helm:3.13.0
      command: [sh, -c]
      args:
      - |
        helm upgrade --install myapp ./charts/myapp \
          --namespace {{inputs.parameters.environment}} \
          --create-namespace \
          --set image.repository={{workflow.parameters.image-registry}}/{{workflow.parameters.image-name}} \
          --set image.tag={{workflow.parameters.app-version}} \
          --set replicaCount={{inputs.parameters.replicas}} \
          --set environment={{inputs.parameters.environment}} \
          --wait \
          --timeout=5m
        echo "{{inputs.parameters.environment}} 배포 완료!"
      volumeMounts:
      - name: workspace
        mountPath: /workspace
      env:
      - name: KUBECONFIG
        value: /root/.kube/config

  - name: smoke-test
    inputs:
      parameters:
      - name: target-url
    container:
      image: curlimages/curl:8.5.0
      command: [sh, -c]
      args:
      - |
        echo "스모크 테스트 시작: {{inputs.parameters.target-url}}"
        for i in 1 2 3 4 5; do
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" {{inputs.parameters.target-url}}/health)
          if [ "$STATUS" = "200" ]; then
            echo "✅ 헬스체크 통과! (HTTP $STATUS)"
            exit 0
          fi
          echo "재시도 $i/5... (HTTP $STATUS)"
          sleep 10
        done
        echo "❌ 스모크 테스트 실패!"
        exit 1

  - name: send-notification
    inputs:
      parameters:
      - name: status
    container:
      image: curlimages/curl:8.5.0
      command: [sh, -c]
      args:
      - |
        curl -X POST $SLACK_WEBHOOK \
          -H 'Content-type: application/json' \
          -d "{\"text\": \"🚀 배포 {{inputs.parameters.status}}! 버전: {{workflow.parameters.app-version}}\"}"
      env:
      - name: SLACK_WEBHOOK
        valueFrom:
          secretKeyRef:
            name: slack-config
            key: webhook-url

templates:
- name: flaky-step
  retryStrategy:
    limit: "3"              # 최대 3번 재시도
    retryPolicy: "Always"   # Always, OnFailure, OnError, OnTransientError
    backoff:
      duration: "10s"       # 첫 재시도 대기 시간
      factor: "2"           # 지수 백오프 (10s, 20s, 40s)
      maxDuration: "1m"     # 최대 대기 시간
  container:
    image: alpine
    command: [sh, -c]
    args: ["curl https://flaky-api.example.com/data"]

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: timeout-example-
spec:
  # 전체 워크플로우 타임아웃
  activeDeadlineSeconds: 3600  # 1시간
  entrypoint: main
  templates:
  - name: main
    # 특정 스텝 타임아웃
    activeDeadlineSeconds: 300  # 5분
    container:
      image: alpine
      command: [sh, -c]
      args: ["long-running-task.sh"]

templates:
- name: conditional-pipeline
  dag:
    tasks:
    - name: check-environment
      template: get-env

    # 프로덕션 환경일 때만 실행
    - name: production-only-step
      dependencies: [check-environment]
      template: prod-task
      when: "{{tasks.check-environment.outputs.result}} == production"

    # 스테이징이 아닐 때 실행
    - name: non-staging-step
      dependencies: [check-environment]
      template: other-task
      when: "{{tasks.check-environment.outputs.result}} != staging"

templates:
- name: parallel-deploy
  dag:
    tasks:
    # 여러 리전에 동시 배포!
    - name: multi-region-deploy
      template: deploy-to-region
      arguments:
        parameters:
        - name: region
          value: "{{item}}"
      withItems:
      - ap-northeast-2    # 서울
      - us-east-1         # 버지니아
      - eu-west-1         # 아일랜드

- name: deploy-to-region
  inputs:
    parameters:
    - name: region
  container:
    image: bitnami/kubectl:latest
    command: [sh, -c]
    args: ["kubectl --context={{inputs.parameters.region}} apply -f deployment.yaml"]

templates:
- name: tracked-step
  metrics:
    prometheus:
    # 워크플로우 완료 카운터
    - name: workflow_complete_total
      help: "완료된 워크플로우 수"
      labels:
      - key: status
        value: "{{status}}"
      counter:
        value: "1"
    # 실행 시간 히스토그램
    - name: workflow_duration_seconds
      help: "워크플로우 실행 시간"
      when: "{{status}} == Succeeded"
      gauge:
        value: "{{duration}}"
  container:
    image: alpine
    command: [sh, -c]
    args: ["deploy.sh"]

# 워크플로우 전용 ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: workflow-runner
  namespace: argo
---
# 필요한 권한만 부여 (최소 권한 원칙)
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: workflow-role
  namespace: argo
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "patch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get", "watch"]
- apiGroups: ["argoproj.io"]
  resources: ["workflows"]
  verbs: ["get", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: workflow-role-binding
  namespace: argo
subjects:
- kind: ServiceAccount
  name: workflow-runner
roleRef:
  kind: Role
  name: workflow-role
  apiGroup: rbac.authorization.k8s.io

# 워크플로우에서 ServiceAccount 지정
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: secure-workflow-
spec:
  serviceAccountName: workflow-runner  # 전용 SA 사용
  securityContext:
    runAsNonRoot: true    # root 실행 금지
    runAsUser: 1000
  entrypoint: main
  templates:
  - name: main
    container:
      image: alpine
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
      command: [sh, -c]
      args: ["echo '보안 강화된 워크플로우 실행!'"]

# 워크플로우 상태 확인
argo list -n argo
argo list -n argo --status Failed  # 실패한 것만

# 특정 워크플로우 상세 정보
argo get my-workflow-xyz -n argo

# 실시간 로그 확인
argo logs my-workflow-xyz -n argo --follow

# 특정 스텝 로그
argo logs my-workflow-xyz -n argo --node-id=my-workflow-xyz-build-123

# 워크플로우 재실행
argo resubmit my-workflow-xyz -n argo

# 실패한 스텝부터 재시작
argo retry my-workflow-xyz -n argo

# 워크플로우 중단
argo terminate my-workflow-xyz -n argo

# 완료된 워크플로우 삭제 (정리)
argo delete --completed -n argo

# 워크플로우 컨트롤러 로그 확인
kubectl logs -n argo deployment/workflow-controller -f

# 아르고 서버 로그
kubectl logs -n argo deployment/argo-server -f

# 특정 워크플로우 파드 직접 확인
kubectl get pods -n argo -l workflows.argoproj.io/workflow=my-workflow-xyz
kubectl describe pod -n argo my-workflow-xyz-build-123
kubectl logs -n argo my-workflow-xyz-build-123 -c main

# Argo Workflows에서 Helm 차트 레포 업데이트하는 스텝
- name: update-helm-chart
  inputs:
    parameters:
    - name: new-image-tag
  container:
    image: alpine/git:latest
    command: [sh, -c]
    args:
    - |
      # Helm 차트 레포 클론
      git clone https://github.com/myorg/helm-charts.git /tmp/helm-charts
      cd /tmp/helm-charts
      
      # 이미지 태그 업데이트 (yq 사용)
      yq e '.image.tag = "{{inputs.parameters.new-image-tag}}"' \
        -i charts/myapp/values.yaml
      
      # 변경사항 커밋 및 푸시
      git config user.email "argo-bot@myorg.com"
      git config user.name "Argo Bot"
      git add charts/myapp/values.yaml
      git commit -m "chore: update myapp image to {{inputs.parameters.new-image-tag}}"
      git push origin main
      
      echo "Helm 차트 업데이트 완료! Argo CD가 자동 배포할 거야 🚀"
    env:
    - name: GIT_CREDENTIALS
      valueFrom:
        secretKeyRef:
          name: git-credentials
          key: token

# TTL 및 PodGC 설정 예시
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: best-practice-
spec:
  # 완료 후 24시간 뒤 자동 삭제
  ttlStrategy:
    secondsAfterCompletion: 86400
    secondsAfterSuccess: 86400
    secondsAfterFailure: 259200  # 실패는 3일 보관

  # 완료된 파드 자동 삭제
  podGC:
    strategy: OnPodSuccess  # OnPodCompletion, OnWorkflowCompletion, OnWorkflowSuccess

  # 동시 실행 제한
  parallelism: 5

  entrypoint: main
  templates:
  - name: main
    container:
      image: alpine:3.18.5  # 정확한 버전 태그!
      resources:
        requests:
          memory: "128Mi"
          cpu: "100m"
        limits:
          memory: "256Mi"
          cpu: "200m"
      command: [echo]
      args: ["베스트 프랙티스 적용 완료!"]