Final project: a complete DevOps chain from commit to production

What you will learn in this TP

• Chain CI, security and GitOps
• Verify and roll back automatically
• Measure the chain with DORA

Introduction #

What you will learn in this section

• Chain CI, security and GitOps
• Verify and roll back automatically
• Measure the chain with DORA

Context. You present an end-to-end delivery chain for a new service to your management. Each step reuses a course lab; the goal is to chain them with no manual action between the commit and the cluster.

Prerequisites: a GitHub account, Docker, kubectl and kind; having completed the Git, CI/CD, GitOps and DevSecOps labs  ·  Estimated time: 120 min

A commit on main reaches production in minutes, verified, traceable and reversible.

Hands-on #

Guided steps, with their solution.

1. 1. Two repositories

   Why? Separating code and deployment description gives separate permissions and histories.

   Create shop-api (code, Dockerfile, tests, workflow) and shop-deploy (Kustomize manifests base and overlays/staging, overlays/production). Protect main on both.

2. 2. CI pipeline

   Why? The pipeline applies the CI/CD chapter lessons: fail fast, build once, secure.

   In shop-api, write a workflow: lint and tests, Gitleaks and Trivy, build and push to GHCR tagged with the SHA, SBOM and keyless Cosign signature.

3. 3. Automatic deployment repository update

   Why? CI only needs to write to Git: it holds no cluster access.

   Add a job that updates the staging tag in shop-deploy with kustomize edit set image and pushes the commit (limited-scope token or GitHub App).

4. 4. GitOps deployment

   Why? Argo CD applies every commit of the deployment repository and fixes any drift.

   On a kind cluster with Argo CD (GitOps lab), create two Applications shop-staging and shop-production pointing to the overlays, with automatic sync.

5. 5. Verify and promote

   Why? Production receives exactly the image validated in staging, through a reviewed pull request.

   After staging syncs, run a smoke test; if it passes, automatically open a pull request copying the same tag to the production overlay.

6. 6. Incident and rollback

   Why? A Git rollback is fast, traced and needs no cluster access.

   Ship a version returning 500 errors on /health, see the staging smoke test fail (no promotion), then simulate a production incident and roll back with git revert in shop-deploy. Write a short post-mortem.

7. 7. Measure

   Why? DORA metrics show whether the chain delivers on its promise.

   Deploy five small changes and compute deployment frequency, commit-to-production lead time, failure rate and restore time (DORA lab method). Present the result and the next improvement.

Difficulty level : ●●●●○ (4/5)