CI/CD & GitOps: Jenkins, GitHub Actions & ArgoCD
Continuous Integration/Delivery automates the path from code commit to running production service. GitOps extends this with a core principle: Git is the single source of truth for desired cluster stat
Continuous Integration/Delivery automates the path from code commit to running production service. GitOps extends this with a core principle: Git is the single source of truth for desired cluster state, and an in-cluster controller (ArgoCD, Flux) continuously reconciles actual cluster state toward what Git declares -- rather than a CI pipeline imperatively running kubectl apply. Every change goes through a reviewed Git commit, the audit trail is inherently Git history, and CI pipelines need only Git/registry access, not direct cluster credentials.
-
A CI pipeline (Jenkins or GitHub Actions) builds an image, runs tests, and commits an updated image tag to a Helm values file or Kustomize overlay in a GitOps config repo.
-
ArgoCD runs inside the cluster as a controller, watching Git repositories for manifests, Helm charts, or Kustomize overlays, and continuously reconciling Git state against actual cluster state.
-
ArgoCD sync applies the Git state to the cluster. Auto-sync applies changes immediately when Git diverges.
-
The separation between CI (build) and CD (deploy via Git+ArgoCD) is a key GitOps benefit: CI only needs permission to push to Git and a registry, not direct cluster access.
-
GitHub Actions supports OIDC-based keyless authentication to cloud providers -- short-lived credentials per workflow run, no long-lived keys stored in secrets.
-
Developer pushes code; CI workflow triggers, builds Docker image, runs tests, pushes to registry.
-
CI updates image tag in Kustomize overlay or Helm values file in GitOps config repo and commits.
-
ArgoCD detects the Git change (via polling or webhook), diffs new desired state against cluster.
-
ArgoCD syncs -- applying only changed resources -- and monitors rollout health.
-
ArgoCD reports sync status (Synced/OutOfSync) and health status (Healthy/Progressing/Degraded).
-
Rolling back is reverting the Git commit -- ArgoCD re-syncs to the previous state.
-
Platform team where all cluster state changes go through pull requests -- full audit trail.
-
Multi-environment promotion: CI updates overlays/staging, tests pass, promotes to overlays/prod.
-
Drift detection: ArgoCD flags or auto-remediates manual kubectl changes that diverge from Git.
-
GitHub Actions OIDC to AWS EKS using short-lived credentials without storing long-lived keys.
-
Separate application code repos from GitOps config repos -- keeps deployment history clean.
-
Enable selfHeal: true so manual kubectl changes are automatically reverted.
-
Use prune: true so resources removed from Git are removed from the cluster.
-
Use OIDC keyless authentication rather than long-lived credentials in CI secrets.
-
Mixing direct kubectl apply pipeline steps with ArgoCD management -- ArgoCD reverts the direct apply.
-
Storing long-lived cloud credentials in CI secrets rather than using OIDC tokens.
-
Giving CI pipelines direct cluster admin access instead of routing through Git+ArgoCD.
-
Not setting prune: true, leaving orphaned resources after removing them from Git.
-
Use ArgoCD webhooks from GitHub/GitLab to reduce sync detection latency from minutes to seconds.
-
Use ApplicationSet controller to template ArgoCD Applications across many environments.
-
Treat the GitOps config repo with the same access controls as application code.
-
Run ArgoCD in HA mode in production -- controller unavailability stops automated sync.
-
Implement ArgoCD Projects with scoped RBAC to restrict which teams can sync which apps.
-
Install ArgoCD, create an Application pointing at a Kustomize overlay, and observe sync/health status.
-
Make a manual kubectl change to a resource managed by ArgoCD with selfHeal enabled and observe automatic revert.
-
Create a GitHub Actions workflow that builds an image and commits an updated image tag to a GitOps config repo.
-
GitOps makes Git the single source of truth for cluster state; ArgoCD reconciles actual cluster state toward Git.
-
CI pipelines need only Git/registry access -- no direct cluster credentials.
-
selfHeal reverts manual kubectl changes; prune removes resources deleted from Git.
-
ArgoCD sync status (Synced/OutOfSync) and health status (Healthy/Degraded) are independent and both meaningful.
-
OIDC keyless auth eliminates long-lived cloud credentials from CI secrets.
Want a visual for this concept?
Generate a diagram tailored to “CI/CD & GitOps: Jenkins, GitHub Actions & ArgoCD” — the AI picks whichever visual (flowchart, comparison, sequence, etc.) best fits.
Sign in to generate a visual →