| name | ci-cd-gitops-kubernetes |
| description | Kubernetes deployment and GitOps patterns: rolling/blue-green/canary strategies, ArgoCD/Flux manifests, K8s secrets management. Supplement to ci-cd-principles. |
| user-invocable | false |
CI/CD — GitOps and Kubernetes Deployment
Supplement to ci-cd-principles.md (Level 2). Apply only for K8s or K8s-based platforms. Not for Docker Compose or serverless.
Strategy Selection
| Strategy | When | Trade-off |
|---|
| Rolling | Default; SLO requirements | Simple, mixes versions briefly |
| Blue-Green | Zero-downtime, instant rollback | Doubles infra during switch |
| Canary | Risk-reducing incremental; A/B | Requires traffic splitting |
Rolling (Default)
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 25%
maxUnavailable: 0%
Rules: maxUnavailable: 0 for prod SLO. Set minReadySeconds. Configure terminationGracePeriodSeconds for in-flight requests.
Blue-Green
Blue (v1) [LIVE 100%] → Green (v2) [STANDBY]
↕ Switch LB
Blue (v1) [STANDBY] → Green (v2) [LIVE 100%]
Rules: identical infra. Smoke test green before switch. Keep blue alive ≥30 min post-switch. DB migrations must be backward-compatible.
Canary
5% → canary (v2), 95% → stable (v1)
25% → canary, 75% → stable [metrics good]
100% → canary (now stable) [bake time passes]
Rules: define success metrics before rollout. Auto-rollback if canary error rate >2× baseline. Min bake 15–30 min per increment. Feature flags complement canary for functional testing.
GitOps
App Repo (code) → CI builds image → updates tag in Config Repo
Config Repo (K8s manifests) → ArgoCD/Flux syncs to cluster
Rules: git = single source of truth. All prod changes via PRs on config repo (no kubectl in prod). ArgoCD/Flux auto-corrects drift. Secrets reference external stores — never plaintext in git.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: myapp-production
spec:
source:
repoURL: https://github.com/org/config-repo
path: environments/production/myapp
targetRevision: HEAD
destination:
server: https://kubernetes.default.svc
namespace: production
syncPolicy:
automated:
prune: true
selfHeal: true
Secrets Management
| Tool | Pattern |
|---|
| External Secrets Operator | Syncs from AWS/GCP/Vault → K8s Secrets |
| Sealed Secrets | Encrypts with cluster key; safe to commit |
| Vault Agent Injector | Sidecars inject at runtime |
Checklist
Related
- CI/CD Principles @.gemini/skills/ci-cd-principles/SKILL.md
- Security Principles @.gemini/rules/security-principles.md
- Monitoring @.gemini/skills/monitoring-and-alerting-principles/SKILL.md
- Feature Flags @.gemini/skills/feature-flags-principles/SKILL.md
