GitOps delivery for a cloud product

The product runs as containers on an RKE2 cluster used as R&D's test environment. After a merge, GitLab CI builds images and updates a deploy repo; ArgoCD syncs the cluster. Nobody logs in to a host.

Track
CI/CD
Status
In use by R&D
Period
2024-10 – present
AI
Partly AI-assisted

Two-stage pipeline

Service repos build; a deploy repo updates and syncs, chained as a downstream pipeline.

  1. service repo · build
    • Maven
    • Go
    • static front-end
    • nginx config check
  2. service repo · image
    • docker build
    • push → Harbor
  3. trigger
    • trigger deploy repo
  4. deploy repo · update
    • validate
    • bump image tag
    • commit [skip ci]
  5. deploy repo · sync
    • wait-sync
Git is the source of truth

The cluster follows Git; history doubles as the deploy log

selfHeal on

Manual drift is reverted automatically

prune off

Deleting from Git never deletes cluster objects by accident

My scope

Owner of the platform and deploy flow: RKE2, Longhorn, Envoy Gateway, the deploy repo, ArgoCD and its notifications, GitLab Runners, Harbor, the nginx proxy config and its CI gate, and per-team dashboards. Application features and production release decisions are out of my scope.

Approach

  • Two-stage pipeline: service repos build and push images to Harbor, then trigger the deploy repo, which bumps image tags (commits marked [skip ci] to avoid loops).
  • ArgoCD treats Git as the single source of truth; selfHeal reverts manual drift, prune is off so deletions need a human.
  • Ingress traffic and TLS are handled with Envoy Gateway (Gateway API).

Verification

ArgoCD reports every app Synced/Healthy; every deploy leaves a traceable commit in the deploy repo.

Results

MetricValueSourceEvidence
Automated deploysmedian ~33 per monthDeploy-repo bot commits, Mar–Oct 2026System record
Related hours362 hTimesheets, Oct 2024 – Aug 2026System record
Logged hours split: me / AI executionme ≈175 h, AI execution ≈187 h (hours before 2025-02-22 count as mine)Own estimate; hours since 2025-02-22 split by the period’s ratio; company-logged hours onlyOwn estimate

Limits and next steps

This flow serves the R&D test environment; production deployment, secrets and network-layer settings are outside my scope.

Tools

  • GitLab CI
  • Harbor
  • ArgoCD
  • RKE2
  • Envoy Gateway
  • Longhorn
  • nginx