Kubernetes & GitOps Track · Capstone · 25 min

GitOps & CI/CD Quality Gates
DevOps IaC Part 2 — Day 14 Capstone

Construct end-to-end GitOps pipelines combining pull-request static scans with ArgoCD cluster synchronization

🎓 Capstone Project · End-to-End Enterprise Architecture🎭 Role: Kubernetes & Cloud Infrastructure Quality Architect

KubernetesGitOpsArgoCDCI/CD PipelinePull Request GatesCapstone

Welcome to the Day 14 Capstone!

Congratulations on reaching the final capstone of the 14-day DevOps & Infrastructure as Code curriculum. Today you will unite every layer you have mastered: remote state locking, Kind multi-node cluster provisioning, HCL workload orchestration, Helm packaging, multi-environment isolation, and security scanning into an enterprise GitOps pipeline powered by ArgoCD and GitHub Actions. Git becomes your absolute source of truth: every merged commit automatically drives cluster state reconciliation with zero manual intervention.

🎬

Day 14 Video Walkthrough: End-to-End GitOps Pipeline & Automated PR Quality Gates CapstoneComing Soon

An interactive 25 min video walkthrough for Day 14 is currently in production. Follow the step-by-step interactive playbook below!

📦Sample Codebase & Working Solution (Day 14)Available Now

View on GitHub

The official reference codebase for Day 14 is hosted in the repository. Clone the repository and navigate to day-14-gitops-argocd to run the working solution.

Git Clone — Working Solution

git clone https://github.com/777abhi/devops-terraform-roadmap.git
cd devops-terraform-roadmap/day-14-gitops-argocd

GitOps Architecture: Pull vs Push Reconciliation

Understand how declarative pull-based reconciliation eliminates pipeline secret leakage.

GitOps Continuous Reconciliation Engine

Examine how the ArgoCD controller inside the cluster constantly polls the Git repository for drift.

gitops-reconciliation-architecture.txt

GitOps Operating Model:
1. Developer opens PR -> GitHub Actions runs 'terraform fmt', 'tflint', and 'checkov'.
2. Team approves & merges PR to main branch.
3. ArgoCD In-Cluster Controller detects new commit SHA:
   ├─ Compares Git target state with actual live cluster objects.
   ├─ Detects delta (out-of-sync).
   └─ Self-heals: applies changes automatically or flags drift.
• Zero Inbound Ports: CI runner does NOT need cluster admin credentials.
• Self-Healing: If someone manually alters a pod via kubectl, ArgoCD resets it back!

Authoring Declarative ArgoCD Application & CI Gate

Write the ArgoCD Application CRD and the GitHub Actions pull-request validation workflow.

Declare ArgoCD Application in argocd-app.yaml

Configure the ArgoCD Application pointing to the Git repo and target namespace.

YAML — argocd-app.yaml

# argocd-app.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: devops-microservice
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default
  source:
    repoURL: 'https://github.com/777abhi/devops-terraform-roadmap.git'
    targetRevision: HEAD
    path: day-10-k8s-workloads
  destination:
    server: 'https://kubernetes.default.svc'
    namespace: devops-lab
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

Author GitHub Actions PR Gate in terraform-k8s-ci.yml

Enforce automated formatting, linting, and exit-code validation on every pull request.

YAML — .github/workflows/terraform-k8s-ci.yml

# .github/workflows/terraform-k8s-ci.yml
name: "Terraform & K8s Quality Gate"

on:
  pull_request:
    branches: [ main ]

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.8.0

      - name: Terraform Format Check
        run: terraform fmt -check -recursive

      - name: Static Security Scan (Checkov)
        uses: bridgecrewio/checkov-action@master
        with:
          framework: terraform,kubernetes
          soft_fail: false

Execution & Automated Sync Verification

Apply the ArgoCD application and verify automatic cluster synchronization.

Install ArgoCD on the Kind Cluster

Deploy the official ArgoCD control plane in the argocd namespace.

Terminal — Install ArgoCD

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
kubectl wait --for=condition=ready pod --all -n argocd --timeout=120s

Apply Application CRD & Verify Sync

Submit the Application manifest and watch ArgoCD synchronize the workloads.

Terminal — Verify GitOps Sync

cd /Users/abhinavsharma/Downloads/devops-terraform-roadmap/day-14-gitops-argocd
kubectl apply -f argocd-app.yaml
kubectl get application -n argocd devops-microservice
kubectl get pods -n devops-lab

Capstone Graduation & 14-Day Mastery

Review your complete Infrastructure as Code and Cloud-Native Quality Engineering achievement.

🏭14-Day DevOps & IaC Full Curriculum Summary

Part 1: Docker Foundations

Day 1: Docker Provider & Local State
Day 2: Variables & Output Structures
Day 3: State Schema & Drift Interception
Day 4: Modular HCL Refactoring
Day 5: Dynamic Loops & Network Blocks
Day 6: Static Security (tflint & checkov)
Day 7: Pull-Request CI/CD Gates

Part 2: Kubernetes & GitOps

Day 8: S3 Remote State & DynamoDB Mutex
Day 9: Multi-Node Kind Cluster in HCL
Day 10: Workloads, Probes & Services
Day 11: Helm Chart Packaging & Releases
Day 12: Workspaces & Environment Isolation
Day 13: Cluster Security & Trivy Scans
Day 14: GitOps ArgoCD & Automated Sync

Day 14 Capstone Quality Gate & Outcomes Checklist

Understood the architectural superiority of GitOps continuous reconciliation over push CI/CD.
Declared an ArgoCD Application CRD binding Git manifests to live Kubernetes namespaces.
Authored a GitHub Actions PR pipeline enforcing terraform fmt, checkov, and lint checks.
Demonstrated automated self-healing when live cluster configuration drifts from Git.
Achieved full graduation across all 14 days of the DevOps & Infrastructure as Code track!

← Return to Roadmaps Overview Hub