Sachin Chaurasiya
Search articles, labs, tools…

Path 04 · learning path

CI/CD Engineering

How reliable delivery works before security gates are added: the pipeline lifecycle, deterministic builds with pinned dependencies and cached installs, rolling, blue/green and canary deployments on Kubernetes, and rollback with versioned artifacts.

Parts
4 parts
Total reading time
~44 min to read
Difficulty
beginner intermediate
Start with part 1 See the path ↓

What you will learn

  • Read a pipeline as stages, jobs, runners and artifacts, and predict what fails when
  • Make builds deterministic with pinned images and lockfiles, and make them fast with the right cache
  • Choose between rolling, blue/green and canary deployments and run each one on Kubernetes
  • Roll back with kubectl rollout undo and versioned artifacts, and keep data migrations out of the blast radius

Before you start

Knowledge assumed

  • Git and a basic build for one application
  • Reading YAML; no prior CI experience is assumed

Hands-on environment

  • A GitLab.com project, or gitlab-ci-local to run the examples without one
  • Docker, to run jobs locally
  • A disposable Kubernetes cluster for parts 3 and 4 (kind is enough)

Each part names what it needs. Nothing has to be installed before part 1.

The path

4 parts, in order

Each part states what it assumes from the previous one, so you can also jump in where your setup already is.

  1. Part 1 of 4 Start here

    CI/CD Fundamentals: How a Pipeline Actually Runs

    What a delivery pipeline does between a push and a deployment: stages and jobs, runners, checkout, build, test, artifacts, environments and promotion, with a GitLab CI pipeline you can execute locally and watch fail.

    CI/CD beginner 11 min read
  2. Part 2 of 4

    Building Reliable Pipelines: Pinning, Caching, Artifacts and Failure Handling

    Make a pipeline produce the same result every time and fail usefully: pinned images and lockfiles, a cache keyed on the lockfile, artifacts versus caches, needs, retries and timeouts, and build kept apart from deploy.

    CI/CD intermediate 10 min read
  3. Part 3 of 4

    Deployment Strategies: Rolling, Blue/Green and Canary on Kubernetes

    Rolling updates, blue/green switches and canary releases built from plain Deployments and Services on a kind cluster, with the health checks, gates and promotion steps that decide when each one is right.

    CI/CD intermediate 12 min read
  4. Part 4 of 4

    Rollback and Recovery: Versioned Artifacts, Rollout Undo and the Database Problem

    Make rollback a deploy, not a rebuild: immutable artifacts and image digests, a failed rollout detected with rollout status and conditions, kubectl rollout undo on a real failure, and migrations planned separately.

    CI/CD intermediate 11 min read

Practise

Labs that exercise this path

All labs →
Lab

Least-Privilege Kubernetes RBAC for a Deployer Service Account

Create a service account that can roll out Deployments in one namespace and nothing else, prove the boundary with impersonation and a real short-lived token, and audit the cluster for wildcard roles and anonymous access.

intermediate 35 minutes Kubernetes
Lab

Enforce Pod Security with Pod Security Admission and Kyverno

On a kind cluster, turn on the restricted Pod Security profile for a namespace, watch it reject a default pod, then add a Kyverno ValidatingPolicy in Audit mode, read the PolicyReport, and switch it to Deny.

intermediate 45 minutes Kubernetes · Kyverno

Toolchain

Tool profiles used in this path

All tools →
deploy Orchestration

Kubernetes

Container orchestration platform and the deployment target for most of the toolchain.

code DevSecOps platform

GitLab

Source control, merge requests and CI/CD in one platform, with built-in security scanning templates.

After the last part

Where to go next

Two paths pick up where this one stops. Either order works; neither is required.