GitOps and CI/CD Patterns
Delivery patterns trunk-based CI, GitOps reconciliation, progressive rollout, and security gates in the pipeline.
GitOps and CI/CD Patterns
CI builds and verifies artifacts. CD promotes trusted artifacts to environments. GitOps makes git the desired-state source for what runs in cluster.
Pattern comparison
| Pattern | How it works | Best for |
|---|---|---|
| Push-based CD | Pipeline calls kubectl apply or cloud API | Simple apps, few clusters |
| GitOps (pull) | Controller syncs cluster to git | Kubernetes, audit trail |
| Feature flags | Decouple deploy from release | SaaS, gradual exposure |
| Blue/green | Two identical envs; switch traffic | Zero-downtime migrations |
| Canary | Small % traffic to new version | Risk reduction |
Reference pipeline (secure)
Research Core: CI/CD · DevSecOps
GitOps repository layout
infra-repo/
apps/
payments/
base/
overlays/
staging/
production/
clusters/
prod-eks/
argocd-apps.yaml
Rules:
- Immutable tags in production no
:latest - Separate repos or paths for app source vs deployment manifests
- PR reviews on every prod change
Environment promotion
| Gate | Staging | Production |
|---|---|---|
| Automated tests | Required | Required |
| Security scan severity | Block critical | Block critical + high |
| Manual approval | Optional | Required for tier-1 |
| Smoke tests post-deploy | Required | Required + synthetic monitors |
Common failures (and fixes)
| Symptom | Likely cause | Fix |
|---|---|---|
| Drift between git and cluster | Manual kubectl edit | Disable direct edits; reconcile |
| Slow pipelines | No caching | Cache deps; parallelize independent jobs |
| Flaky tests block everyone | Quarantine + fix | Separate quarantine job; SLA to fix |
| Secrets in workflow logs | Echo or env dump | Mask secrets; use OIDC to cloud |
Learning exercise
- Fork a sample app.
- Add GitHub Actions: test → build → push to registry with digest tag.
- Add Argo CD Application pointing at
kustomizeoverlay. - Change replica count in git; watch sync never
kubectl scaleby hand.