GitOps delivery platform

One loop serves every kind of change — application code, plugin version bumps, configuration, and the Kubernetes manifests themselves. Nothing and nobody applies manifests or pushes images to the cluster by hand; merging to master is the deploy button, and a revert is the rollback button.

Three Flux Kustomizations split the estate by blast radius: the registry (which owns the namespace and the secrets plumbing, and deploys first), the application, and the CI runners — each reconciles independently, so a broken runner chart can never block an app deploy. The platform is deliberately self-contained: its own Key Vault, its own container registry, its own npm registry, and its own CI compute, all inside one namespace on a shared cluster, coexisting with the legacy instance it replaces.

No secret value exists in git, in manifests, or in CI-rendered output. External Secrets Operator syncs Kubernetes Secrets from Azure Key Vault using workload identity federation — a Kubernetes service-account token exchanged at Entra ID for a managed-identity token, so there is no client secret to leak or rotate anywhere in the chain. The vault, the user-assigned managed identity, and the federated credential were all provisioned self-service after discovering the shared ops vault was inaccessible — including working around missing role-assignment rights by running the vault in access-policy mode.

A hard discovery shaped the whole CI design: neither ingress controller on the cluster is internet-facing — even the "public" class resolves public DNS to a private load-balancer IP. GitHub-hosted runners could therefore never reach the private registry. Rather than wait on a networking change, the platform runs GitHub Actions inside the cluster: actions-runner-controller with one ephemeral, scale-from-zero runner scale set per repository, a custom runner image with the CI toolchain baked in (built in-cluster with kaniko when the upstream image registry proved unreachable from workstations), and Docker-in-Docker for real image builds. A foreign cluster-wide runner controller that silently deleted our resources was diagnosed with a version-probe matrix and neutralized with a Kubernetes validating admission policy — the full story is in the case files.

Plugin distribution moved from vendored tarballs (fragile, checksum-pinned, fetch-script-dependent) to a Verdaccio private npm registry deployed by Flux. It is engineered as a deliberate stop-gap with an exit contract: the registry URL and credential exist in exactly one file per consumer, packages use plain semver, and the full release history was backfilled with integrity verification against the previously pinned hashes — so a future managed registry replaces it with configuration-only changes. Release immutability carries over as deny-unpublish configuration; publishing requires a dedicated CI identity; nothing is readable anonymously.