Lesson 6: GitOps & Delivery Pipelines

Release Pipeline Platform: GitOps Delivery at Production Scale

What We Build Today

• Release Pipeline Platform — a unified delivery control plane with ArgoCD GitOps sync, Flagger canary rollouts on order-service, and Istio traffic management

• Quality gate pipeline — Kubernetes Job-based smoke and integration tests with a FastAPI aggregator that blocks releases below 95% pass rate

• DevSecOps enforcement layer — Kyverno ClusterPolicies, default-deny NetworkPolicies, and Trivy image scanning in CI

• Drift detection operations — release controller tracking OutOfSync state, intentional drift labs, and reconciliation runbooks

• Prometheus observability — ServiceMonitors on all services, SLO-aligned alert rules, and business metrics driving HPA

Why This Matters

Netflix ships thousands of deployments daily because GitOps eliminates imperative kubectl as the source of truth—Git commits become auditable deployment contracts. Spotify's deployment pipeline gates every release through automated canary analysis before full promotion; a bad binary never reaches 100% traffic without metric evidence. Airbnb's platform teams learned that CI/CD failures cluster around three boundaries: sync drift (cluster diverges from Git), security policy violations (pods deploy before Kyverno catches them), and observability blind spots (rollouts succeed while error rates climb). Manual deployments at scale are not slow—they are non-deterministic. When an engineer scales a deployment during an incident without committing to Git, the next sync either reverts the fix or leaves permanent drift. This week builds one integrated platform where GitOps, progressive delivery, testing gates, security policies, drift debugging, and Prometheus metrics operate as a single release contract.

Kubernetes Architecture Deep Dive

GitOps Reconciliation vs Imperative Operations