A production-grade pipeline that ships code from git push to running Kubernetes
workloads — automated with GitHub Actions, reconciled by ArgoCD, and observed by a full
Prometheus + Grafana stack. All runnable on a single machine.
No tool pushes directly to Kubernetes. ArgoCD continuously reconciles the live cluster state with exactly what Git declares — every change is an auditable commit.
Push to main and the pipeline lints, tests, security-scans, builds multi-stage
container images, and commits the new image tag back to the repo. ArgoCD detects the commit
and rolls the change out to the cluster automatically.
The demo application is intentionally trivial — a FastAPI backend and an Nginx frontend — because the pipeline is the product, not the app. Every layer models how a real platform team would ship software safely.
Security, promotion gates, rollback, and observability — wired together, not bolted on.
ArgoCD reconciles the cluster to match Git every 3 minutes, with self-heal and drift detection. Deployments are just commits.
Lint → test → security-scan → build → update-manifests. Ruff, mypy, pytest with ≥80% coverage, and Kustomize validation all block bad merges.
Auto-deploy to dev; manual, approval-gated promotion to staging and prod. Production sync windows block risky weekend deploys.
GitOps rollback workflow updates the overlay, ArgoCD resyncs, and a GitHub Issue is opened as an audit trail — MTTR under 10 minutes.
Trivy CVE scans, non-root read-only containers, Sealed Secrets, and OPA Gatekeeper admission policies enforced at the API server.
Prometheus metrics, pre-built Grafana dashboards, Loki log aggregation, and 7 alert rules covering latency, errors, and rollout health.
git push to running podsFour CI jobs run in sequence on every push to main. The final job commits an image-tag bump — and that commit is what triggers ArgoCD.
ruff · mypy · pytest ≥80% · kustomize validate
Trivy · safety · kubesec → SARIF to GitHub
Multi-stage build → GHCR · image scan blocks CRITICAL
kustomize edit set image → commit tag bump
Pushes code to the GitHub repository
CI builds, scans & commits image tags
Immutable container images by SHA
Polls Git · reconciles cluster state
1 replica · debug logs · auto-sync
2 replicas · info logs · manual sync
3 replicas · PDB minAvailable 2 · approval-gated
Chosen deliberately — each tool earns its place with a documented design rationale.
:latest in prodEvery workflow, manifest, policy, and dashboard is open source and documented — including architecture diagrams, rollback procedures, and design-decision write-ups.