Platform & Cloud
Freelance client
Multi-Cluster GitOps Platform with ArgoCD
ArgoCD · Kubernetes · Kustomize · Helm · GitHub Actions · Vault · OPA Gatekeeper
120/weekAutomated Deployments with Zero Drift
01
The Challenge
The engineering team had 14 microservices deployed across three Kubernetes clusters. Deployments were done manually: update Helm values locally, run
helm upgrade, hope nothing broke. There was no audit trail. Configuration drift was a constant problem because engineers would kubectl apply quick fixes to production. Secrets were stored in Kubernetes Secrets encoded in base64 (not encrypted) and committed to the Git repo. Anyone with read access could decode every production password. Rolling back a bad deployment required finding the previous image tag in Slack history and running helm upgrade again, which took 20 to 30 minutes.02
The Approach
The platform is built on the principle that Git is the single source of truth. No human runs
kubectl or helm against production. The Git repository has a base directory with Kustomize resources and overlay directories for each environment. ArgoCD Application Sets use a Git generator to create one Application per microservice per cluster. The CI pipeline runs in GitHub Actions, building images, running tests, and updating Kustomize overlays via automated commit. Before merge, three checks run: rendered manifest diffs as PR comments, OPA Gatekeeper policy enforcement across 12 rules, and dry-run validation. Secrets are managed through HashiCorp Vault with Vault Agent sidecar injecting secrets into tmpfs volumes. Progressive rollouts use Argo Rollouts with a canary strategy: ten percent for five minutes, fifty percent for ten minutes, then full promotion with automatic abort on metric breaches.03
GitOps Platform Architecture
GitOps Platform Architecture
Multi-cluster Kubernetes delivery with ArgoCD, OPA Gatekeeper, HashiCorp Vault, and Argo Rollouts. Click any node to view implementation details.
Select a node to view infrastructure details
Primary data flow
Policy / secret injection
04
Overview
Built a GitOps delivery platform managing 14 microservices across three Kubernetes clusters (staging, production-eu, production-us). ArgoCD syncs application state from a monorepo containing Kustomize overlays for each environment. All configuration changes go through pull requests with automated diff previews, OPA Gatekeeper policy checks, and mandatory approvals before ArgoCD picks them up. HashiCorp Vault provides runtime secret injection via the Vault Agent sidecar, so secrets never appear in Git or environment variables. The platform handles roughly 120 deployments per week with a rollback rate under two percent.
05
Business Impact
Deployment frequency increased from roughly 8 manual releases per week to 120 automated deployments per week. Mean time from code merge to production went from 4 hours to 12 minutes. The rollback rate is under two percent, and ArgoCD completes rollbacks in under 90 seconds. Configuration drift dropped to zero because ArgoCD auto-heals any out-of-sync state within 3 minutes. The OPA policies caught 47 policy violations in the first month.
06
Technical Highlights
- ArgoCD Application Sets generating one ArgoCD Application per microservice per cluster from a single template
- Kustomize overlays for staging, production-eu, and production-us with environment-specific resource limits and replica counts
- GitHub Actions CI building container images, running tests, and updating the image tag in the Kustomize overlay via automated commit
- ArgoCD diff preview bot posting rendered manifest diffs as pull request comments before merge
- OPA Gatekeeper enforcing 12 policies: resource limits required, no host networking, readiness probes required, image pull policy Always, no latest tag
- HashiCorp Vault with Kubernetes auth backend injecting secrets via Vault Agent sidecar into tmpfs volumes at pod startup
- Progressive rollout with Argo Rollouts using canary strategy: 10% traffic for 5 minutes, then 50% for 10 minutes, then full promotion
- Auto-heal on configuration drift: ArgoCD detects and reverts manual kubectl changes within 3 minutes
- Sealed Secrets for bootstrap credentials that ArgoCD needs before Vault is available in a fresh cluster
- Namespace-scoped RBAC with ArgoCD projects restricting which team can deploy to which namespace
Want results like this for your infrastructure?
I specialize in taking complex AI pipelines and cloud setups from concept to high-availability production. Let's discuss how to optimize your workloads, secure your environment, and reduce cloud costs.