DevOps & Cloud · Intermediate
GitOps Deploy Pipeline
Containerize an app and ship it on every git push with a CI pipeline that builds, scans, and auto-deploys to Kubernetes.
You build a complete GitOps loop: a small Go HTTP service is containerized with Docker, pushed to a registry, and deployed to a local Kubernetes cluster (k3s or Kind) entirely through GitHub Actions and Argo CD. Every merge to main triggers a CI job that builds the image, scans it for CVEs with Trivy, updates a Helm values file with the new image tag, and lets Argo CD sync the cluster to match. The project covers the full path from developer laptop to a running pod, making the deployment process auditable, repeatable, and entirely git-driven.
What you build
- GitHub Actions workflow triggers on push to main, builds a Docker image, and pushes it to GitHub Container Registry
- Trivy scans the image for critical CVEs and fails the pipeline before any deployment if vulnerabilities are found
- Helm chart manages Kubernetes manifests for the Go service, including Deployment, Service, and HorizontalPodAutoscaler
- Argo CD watches the git repo and automatically syncs the cluster when the Helm values file is updated with a new image tag
- A local k3s or Kind cluster runs the full stack on a single machine with no cloud account required
- Pipeline status badges and Argo CD sync status give immediate visibility into the health of each deploy
What it teaches
- Writing multi-stage GitHub Actions workflows with job dependencies and secrets management
- Building minimal, CVE-scanned container images and understanding image layer hygiene
- Structuring a Helm chart with parameterized values for multiple environments
- The GitOps reconciliation model and how Argo CD detects and applies drift between git state and cluster state
- Kubernetes Deployment rollout mechanics, health checks, and readiness probes
- Securing a pipeline with image signing, vulnerability gates, and least-privilege service accounts
How it works
- 1
Git Push
- Developer pushes to main branch
- 2
GitHub Actions CI
- Build Docker image
- Scan with Trivy (fail on critical CVEs)
- Push image to ghcr.io
- Commit new image tag to values.yaml
- 3
Argo CD Sync
- Detects values.yaml change in git
- Applies updated Helm chart to cluster
- 4
Kubernetes Rollout
- New pod starts with updated image
- Readiness probe passes
- Old pod terminated
Sign in to open the build guide
Free account. Get the step-by-step build and every resource link.
Take it further
- Add a staging environment Helm values file and a separate Argo CD Application so changes go through staging before a manual promotion to production
- Integrate Cosign to sign the container image in CI and verify the signature in an admission webhook before Kubernetes allows the image to run
- Add a rollback job that re-tags the previous image and commits it if a post-deploy smoke test fails
