// Apply Kubernetes deployment and GitOps patterns when configuring container orchestration, deployment strategies (rolling, blue-green, canary), ArgoCD/Flux manifests, or Kubernetes secrets management. Supplement to ci-cd-principles.
| name | ci-cd-gitops-kubernetes |
| description | Apply Kubernetes deployment and GitOps patterns when configuring container orchestration, deployment strategies (rolling, blue-green, canary), ArgoCD/Flux manifests, or Kubernetes secrets management. Supplement to ci-cd-principles. |
| user-invocable | false |
Agent scope: This is a supplement to
ci-cd-principles.md(Level 2). Apply only when the project targets Kubernetes or a Kubernetes-based managed platform. Do not apply rolling/canary/blue-green patterns to Docker Compose or serverless deployments.
| Strategy | When to use | Trade-off |
|---|---|---|
| Rolling | Default for most services; SLO requirements | Simple, but mixes versions briefly |
| Blue-Green | Zero-downtime with instant rollback | Doubles infrastructure cost during switch |
| Canary | Risk-reducing incremental rollout; A/B variants | Requires traffic splitting capability |
Kubernetes native. Suitable for most stateless services.
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 25% # Max pods above desired count during update
maxUnavailable: 0% # Zero-downtime: don't remove pods before new ones ready
Rules:
maxUnavailable: 0 for production services with SLO requirementsminReadySeconds to let pods stabilize before proceedingterminationGracePeriodSeconds to finish in-flight requests before shutdownWhen: Zero-downtime deployments where rollback must be instant and clean.
┌──────────────┐ ┌──────────────┐
│ Blue (v1) │ │ Green (v2) │
│ [LIVE 100%] │────→│ [STANDBY] │
└──────────────┘ └──────────────┘
↕ Switch load balancer
┌──────────────┐ ┌──────────────┐
│ Blue (v1) │ │ Green (v2) │
│ [STANDBY] │ │ [LIVE 100%] │
└──────────────┘ └──────────────┘
Rules:
When: Risk-reducing incremental rollout; A/B testing deployment variants.
Traffic split during rollout:
5% → canary (v2)
95% → stable (v1)
↓ metrics look good
25% → canary
75% → stable
↓ bake time passes
100% → canary (now stable)
Rules:
For Kubernetes environments, use declarative GitOps instead of imperative kubectl apply.
Pattern:
Application Repo (code) → CI builds image → updates tag in Config Repo
Config Repo (K8s manifests) → ArgoCD/Flux syncs to cluster automatically
Rules:
kubectl in prodapiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: myapp-production
spec:
source:
repoURL: https://github.com/org/config-repo
path: environments/production/myapp
targetRevision: HEAD
destination:
server: https://kubernetes.default.svc
namespace: production
syncPolicy:
automated:
prune: true # Remove resources deleted from git
selfHeal: true # Reconcile manual drift
Never store plaintext secrets in git — even in private repositories.
| Tool | Pattern |
|---|---|
| External Secrets Operator | Syncs secrets from AWS Secrets Manager, GCP Secret Manager, Vault into K8s Secrets |
| Sealed Secrets | Encrypts secrets with a cluster-held key; safe to commit encrypted form |
| Vault Agent Injector | Sidecars inject secrets directly into pods at runtime |
Choose based on your cloud provider or existing tooling. Document the choice in your technical architecture document.
maxUnavailable: 0 set for production services with SLO?terminationGracePeriodSeconds configured for graceful shutdown?kubectl apply commands in production CI pipeline?Execute a structured code review protocol that inspects code quality against the full rule set. Use when auditing code written by yourself or another agent, during code audit workflows, or when the user asks for a code review. Produces a findings document with severity tags.
Structured research protocol for investigating technologies, patterns, and APIs before implementation. Use when exploring unfamiliar technologies, evaluating library options, or documenting technical findings. Covers multi-tool search strategy, research log conventions, and training data fallback honesty protocol.
Apply WCAG accessibility standards when building UI components, forms, interactive elements, or any user-facing interface. Covers semantic HTML, ARIA attributes, keyboard navigation, color contrast, and screen reader support.
Document significant architectural decisions using the ADR (Architecture Decision Record) format. Use during research phases when choosing between approaches, when introducing new dependencies or patterns, or when the user asks to document a technical decision.
Apply REST/HTTP API design conventions when implementing endpoints, handlers, middleware, request validation, or response formatting. Covers resource naming, status codes, error formats, versioning, and pagination.
Apply CI/CD pipeline design patterns when configuring build pipelines, deployment processes, release strategies, Dockerfiles, or GitHub Actions workflows. Covers pipeline stages, artifact management, environment promotion, and rollback strategies.