Skip to main content

Chapter 5 checkpoint

You can now reason about the whole path from commit to running service. Recall the chapter, then prove it.

The throughline​

  • A pipeline is staged gates — build → test → scan → artifact → deploy — where any failure stops the change early. "CI/CD" is three ideas: Continuous Integration (merge + test on a shared branch, often), Continuous Delivery (every passing change made ready to ship, human presses the final button), Continuous Deployment (every passing change shipped automatically). The only difference between the two CDs is the manual approval before prod.
  • Long-lived feature branches break CI by hoarding changes and causing merge hell. Trunk-based development uses short-lived branches off one trunk, feature flags to merge unfinished work safely, and merge queues to keep main always-green and deployable.
  • Build the artifact once, promote it unchanged. Identify it immutably: tag for humans, deploy by content-addressable digest (@sha256:…). Secure the supply chain — SBOM (Syft/Trivy), signing (Cosign), provenance/attestation (SLSA, in-toto), graded by SLSA levels L1–L3 — all verified at deploy.
  • Promote one artifact through dev → staging → prod, separating config from code: one base + thin per-environment overlays (Kustomize/Helm), not forked per-environment pipelines.
  • GitOps: Git is the declarative source of truth; an in-cluster agent pulls and continuously reconciles, detecting and correcting drift. Pull beats push because no cluster credentials live in CI. Manual kubectl changes are auto-reverted (self-heal) or flagged — never silently kept. Argo CD and Flux implement it; rollback = revert the commit.
  • Progressive delivery limits blast radius — blue-green, canary, rolling, feature flags — with automated metric/SLO analysis and automatic abort (Argo Rollouts/Flagger).
  • Pipeline security: OIDC federation for keyless, short-lived cloud auth (no stored long-lived keys); Sealed/External Secrets keep plaintext out of Git. DORA (deployment frequency, lead time, change failure rate, MTTR) is the feedback loop — speed and stability improve together.

Quiz​

Required checkpoint

Chapter 5 — CI/CD & GitOps

Pass to unlock the Next button below

That completes the delivery story: you can take a commit and turn it into a running production service — built once into an immutable, signed artifact, promoted through environments, deployed by a self-correcting GitOps agent, rolled out progressively with automatic abort, authenticated without stored keys, and measured by DORA. The next chapter gives you the other half of every progressive-delivery decision: how to actually see whether the system is healthy.

Next: Chapter 6: Observability & SRE →