GitOps Delivery: GitHub Actions → ECR → Argo CD → EKS

You will hand in

• App repo workflow: test, build, push to ECR via OIDC, bump the dev tag in the config repo
• Config repo with base + dev/prod overlays (or Helm values) and an ApplicationSet
• Argo CD with SSO/RBAC basics, auto-sync + self-heal in dev
• Prod API as an Argo Rollout with canary steps and automated analysis

1. 1

   CI with OIDC and ECR

   Done when: Images pushed from GitHub Actions without stored AWS keys.

   • IAM OIDC provider + role trusting only repo:<org>/shoplite-api:ref:refs/heads/main
   • Workflow: test → build → push ecr/shoplite-api:sha-<sha>
   • Enable ECR image scanning and immutable tags

   Prove it works

   terminalcopy cmd

   $ aws ecr describe-images --repository-name shoplite-api --query 'sort_by(imageDetails,&imagePushedAt)[-1].imageTags'

   ── expected output ──

   ["sha-3f2a1c9"]

2. 2

   Config repo and Argo CD

   Done when: Argo CD deploying dev from the config repo.

   • Install Argo CD (Helm, via Terraform or a bootstrap script)
   • Config repo with overlays; ApplicationSet generating an app per env
   • Dev: automated: { prune: true, selfHeal: true }

   Prove it works

   terminalcopy cmd

   $ argocd app list

   ── expected output ──

   NAME SYNC STATUS HEALTH STATUS

   api-dev Synced Healthy

   api-prod Synced Healthy

3. 3

   Automated dev deploys, PR-based prod

   Done when: CI bumps dev; promotion to prod is a reviewed PR.

   • CI job commits the new tag to envs/dev using a scoped token
   • CODEOWNERS + branch protection on envs/prod/**
   • A small workflow (or manual step) to open the promotion PR with the same tag

   Prove it works

   terminalcopy cmd

   $ git log --oneline -3 -- envs/

   ── expected output ──

   a91c2e7 api(prod): promote sha-3f2a1c9 (#41)

   6b0d8f3 api(dev): deploy sha-3f2a1c9 from shoplite-api

   2c4e1a0 api(dev): deploy sha-91be7d0 from shoplite-api

4. 4

   Canary with analysis

   Done when: Prod releases shift traffic gradually and abort on errors.

   • Install Argo Rollouts; convert the prod API Deployment to a Rollout
   • Steps 10% → 30% → 60% → 100% with pauses
   • AnalysisTemplate on success rate from Prometheus; test with a deliberately faulty image

   Prove it works

   terminalcopy cmd

   $ kubectl argo rollouts get rollout api -n shoplite-prod | head -4

   ── expected output ──

   Name: api

   Status: ✖ Degraded

   Message: RolloutAborted: Metric "success-rate" assessed Failed

   Images: ...sha-3f2a1c9 (stable)

• Preview environments per PR with the ApplicationSet pull-request generator
• Sign images in CI and verify signatures with Kyverno before deploy (Project 11)
• Automate promotion with Kargo

Résumé bullet

Implemented GitOps delivery to EKS with GitHub Actions (OIDC → ECR), Argo CD ApplicationSets, PR-based promotion, and Argo Rollouts canaries with Prometheus analysis and automatic rollback; removed all cluster credentials from CI.

Demo script

• Merge a change and watch it reach dev with no clicks
• kubectl edit in dev and watch self-heal revert it
• Ship a faulty image to prod and watch the canary abort