CI/CD
Jenkins, GitLab CI, GitHub Actions and Argo CD — pipelines that are fast, reproducible and secure by default.
Replace hand-copied Argo CD Applications with an ApplicationSet driven by per-environment config files: the Git file generator, templatePatch for automated versus manual sync, AppProject boundaries and deletion policy.
The operating model behind the CI templates, ApplicationSets, Kyverno guardrails and observability stack on this site: what a team hands over, what the platform returns, where the golden path ends and enforcement begins.
Kyverno as a platform guardrail system: baseline and production policy layers keyed on namespace labels, delivered by Argo CD from one repository, rolled out audit-first, with scoped expiring exceptions.
One platform-owned GitLab CI template instead of a pipeline per repository: spec:inputs with validation, a consumer that includes it by project and tag, extension points, versioning, and what a consumer can override.
Make a pipeline produce the same result every time and fail usefully: pinned images and lockfiles, a cache keyed on the lockfile, artifacts versus caches, needs, retries and timeouts, and build kept apart from deploy.
What a delivery pipeline does between a push and a deployment: stages and jobs, runners, checkout, build, test, artifacts, environments and promotion, with a GitLab CI pipeline you can execute locally and watch fail.
Rolling updates, blue/green switches and canary releases built from plain Deployments and Services on a kind cluster, with the health checks, gates and promotion steps that decide when each one is right.
Put Checkov in front of terraform plan: a GitLab CI job on every merge request, a baseline so only new findings fail, a pass/fail policy by check ID, exceptions with reasons, reports in the MR, and branch protection.
Make rollback a deploy, not a rebuild: immutable artifacts and image digests, a failed rollout detected with rollout status and conditions, kubectl rollout undo on a real failure, and migrations planned separately.
The GitLab pipeline that gated this site while it ran CI: frozen installs, parallel quality gates, Trivy with SAST and secret detection, artifact verification, and one deployment owner behind protected main.
Install Argo CD, model applications and projects, enable automated sync with pruning and self-heal, and lock the control plane down so Git really is the only way to change the cluster.
Stop credentials from reaching Git: run Gitleaks in pre-commit hooks and CI, tune rules and allowlists, handle findings without leaking them further, and decide when history rewriting is worth it.
How Trivy finds OS and application vulnerabilities, secrets and misconfigurations in container images, how to make the results actionable, and how to wire it into CI without slowing builds down.
A declarative Jenkins pipeline with secrets scanning, SAST, image scanning and least-privilege credential handling — and the agent, plugin and Docker decisions that keep it that way.
Declarative GitOps continuous delivery controller for Kubernetes.
CI/CD workflows integrated with GitHub repositories and the Actions marketplace.
Source control, merge requests and CI/CD in one platform, with built-in security scanning templates.
Self-hosted automation server with pipelines as code and a large plugin ecosystem.