CI/CD Integration
In a GitOps workflow, CI and CD have clear jobs. CI builds, tests, and publishes artifacts. CD is the GitOps controller (ArgoCD or Flux) reconciling the cluster from Git. These guides show how to wire popular CI systems without turning the pipeline into a push-based deployer.
CI vs GitOps CD
| Stage | Owns | Typical actions |
|---|---|---|
| CI | Pipeline | Lint, test, build image, scan, push to registry |
| Git update | CI (or bot) | Bump image tag / digest in manifests or values, open or push a commit |
| CD | GitOps controller | Detect Git change, sync, report health, self-heal drift |
The important rule: the cluster should change because Git changed, not because CI ran kubectl apply. That keeps audit trail, rollback, and drift detection in one place.
What CI should and should not do
Do in CI
- Build and push immutable images (prefer digests)
- Run unit, integration, and policy checks
- Update desired state in Git (tag, digest, or values)
- Optionally open a PR for human approval on sensitive envs
Avoid in CI (for GitOps CD)
- Direct
kubectl apply/helm upgradeto production as the main path - Cluster credentials in every pipeline when a controller already has them
- Skipping Git so “hotfixes” only exist on the cluster
For promotion strategies after the Git update, see Environment promotion.
What you’ll learn
| Guide | What it covers |
|---|---|
| GitHub Actions | Workflows that build, push, and commit manifest updates for ArgoCD or Flux |
| GitLab CI | Pipeline stages for the same GitOps handoff with GitLab runners |
Suggested path
- Clarify ownership — Confirm CD is ArgoCD or Flux before writing deploy jobs.
- Implement one pipeline — Start with GitHub Actions or GitLab CI for a single app.
- Align the repo — Match CI path updates to your repository structure.
Related guides
- GitOps principles — why pull-based CD beats push deploys
- ArgoCD sync policies — when auto-sync is safe after CI updates Git
- Flux installation — bootstrap the controller that consumes CI’s Git commits
- Helm integration — bump chart or image values from CI cleanly
FAQ
Can CI still deploy to a cluster?
Yes for break-glass or non-GitOps environments—but for GitOps production paths, prefer updating Git and letting the controller sync.
Who writes the manifest update—CI or image automation?
Either. CI often commits the new tag after a build. Flux image automation can watch the registry and commit instead. Pick one primary path per app to avoid races.
Do I need separate repos for app code and manifests?
Common and recommended for access control. CI in the app repo can open a PR or push to the config repo via a deploy key or machine user.