From commit to production: building pipelines that don't lie to you, letting Git — not a script — be the source of truth for what's running, gating builds before they ship, and rolling out changes without betting the whole fleet at once.
# Non-zero exit fails the pipeline — no image with a critical CVE ships
📋
SBOM & Supply Chain
A Software Bill of Materials lists every component in the image — the artifact you need when the next zero-day drops and you must answer "are we affected?" in minutes, not days.
Important
Important▾
1
Generate an SBOM per build (syft $IMAGE -o spdx-json) and store it alongside the artifact
2
Sign images with cosign so deployment can verify provenance before running them
3
When a CVE drops, grep SBOMs across all past builds instead of re-scanning everything from scratch
🚧
Admission Control (OPA / Kyverno)
The last gate isn't in the pipeline at all — it's at the cluster's API server, refusing to admit anything that violates policy, pipeline or not.
Runtime
Recommended▾
🔵Block unsigned images, images with :latest tag, or missing resource limits — before they're admitted
🔵Kyverno and OPA/Gatekeeper both implement this as ValidatingAdmissionWebhooks — policy as code, versioned in Git like everything else
DEPLOYMENT STRATEGIES
Shipping a change without betting the entire fleet on it at once
3 Concepts
🐤
Canary Releases
Route a small slice of traffic to the new version, watch the golden signals, and only then ramp it up — or auto-rollback if it looks bad.
Must Know
Must Know▾
Argo Rollouts canary step (excerpt)
yaml
strategy:
canary:
steps:
- {setWeight: 10}
- {pause: {duration: 5m}}
- {setWeight: 50}
- {pause: {duration: 10m}}
- {setWeight: 100}
Why It Works
🔴Blast radius of a bad release is capped at the canary weight, not 100% of traffic
🟠Pair with automated analysis (Argo Rollouts + Prometheus) to auto-abort on error-rate regressions
🔵🟢
Blue-Green Deployment
Run two full environments side by side; switch traffic all at once by flipping a service selector or load balancer target.
Important
Important▾
Trade-offs vs Canary
🟠Instant rollback — flip the selector back, no gradual ramp needed
🟠Costs 2x resources while both environments are live
🔵All-or-nothing traffic switch — no gradual exposure to catch subtle regressions
Best Fit
1
Database-schema-sensitive releases where you want an instant, clean cutover
2
Low-traffic or batch services where gradual canary weighting adds little value
⏪
Automated Rollback
A rollback that requires a human to notice, decide, and type a command is a rollback that happens too late.
Reliability
Recommended▾
1
Wire canary analysis to real SLIs — error rate, p99 latency — not just pod readiness
2
In GitOps, rollback is a git revert on the manifest repo — the controller reconciles back automatically
3
Keep the previous ReplicaSet/revision around (kubectl rollout undo) as the manual fallback of last resort
SECRETS & ARTIFACT MANAGEMENT
Nothing sensitive belongs in a Git diff — including in your GitOps manifest repo
3 Concepts
🔑
The GitOps Secrets Problem
GitOps wants everything in Git — but plaintext secrets in Git is a non-starter. Two patterns solve this without breaking the "Git is truth" model.
Must Know
Must Know▾
Sealed Secrets
🔴Encrypt the secret client-side with a cluster-specific public key
🟠Commit the encrypted blob to Git safely — only the in-cluster controller can decrypt it
External Secrets Operator + Vault
1
Secret values never touch Git at all — they stay in Vault/AWS Secrets Manager/Azure Key Vault
2
Only a reference (which secret, which path) is committed — an ExternalSecret CRD
3
The operator syncs the real value into a native K8s Secret at runtime
📦
Artifact & Registry Hygiene
Images and Helm charts pile up fast — retention policy is not optional once storage bills start showing up.
Important
Important▾
1
Tag images with commit SHA, never rely on :latest in any deployed manifest
2
Set a retention policy: keep last N tags per branch, expire untagged/dangling images automatically
3
Package Helm charts as OCI artifacts in the same registry — one system to secure and back up, not two
✍️
Image Signing & Verification
Proving an image came from your pipeline and hasn't been tampered with since — closing the loop the SBOM opened.