GitOps in practice: shipping to Kubernetes without SSH
How Argo CD replaced our click-ops habits — and what we learned about drift, secrets and progressive delivery.
For years, deploying to Kubernetes meant kubectl apply from a laptop — sometimes mine, sometimes a colleague's. It worked… until it didn't.
Why GitOps
Git as the single source of truth gives you auditability, rollbacks for free and a review gate for every change. We chose Argo CD because its pull-based model keeps the cluster credentials off developer machines.
The pipeline
- Developer merges to
main - GitHub Actions builds, scans and pushes an image
- Image tag is updated in the environment repo
- Argo CD syncs within 3 minutes, health gates block bad rollouts
Lessons learned
Secrets need a story — we sealed-secrets for manifests and External Secrets for cloud credentials. Drift detection caught two "temporary" manual changes in the first week. And progressive delivery with Argo Rollouts means a bad release shrinks traffic automatically instead of paging the on-call.