Stage: gitops

The gitops stage hands the final cluster state to ArgoCD. Instead of the pipeline imperatively applying manifests, it writes the new image tags and chart changes onto the gitops branch; ArgoCD then reconciles the cluster to git. The desired state lives in git, so drift is detectable and the deployment is declarative.

Part of the Full pipeline action map. Use the Fullscreen button on the diagram to view it edge-to-edge.

flowchart TD
  BUILD["Successful build + attest on main"]

  subgraph AUTO["Automatic (on_success)"]
    direction TB
    BP["gitops:bump:karc-portal:dev<br/>write sha-&lt;short&gt; -> envs/dev/image-tag.yaml"]
    BD["gitops:bump:podtato-head:dev<br/>write AWS image-tag file"]
    CP["gitops:promote:chart:karc-portal<br/>replay chart tree onto gitops"]
    CD["gitops:promote:chart:podtato-head"]
  end

  subgraph MANUAL["Manual promotion"]
    direction TB
    QA["gitops:promote:*:qa<br/>when: manual · auto-closes CR"]
    PROD["gitops:promote:*:prod<br/>when: manual"]
  end

  ARGO[("gitops branch<br/>ArgoCD reconciles")]

  BUILD --> AUTO
  AUTO --> ARGO
  MANUAL --> ARGO

  class BP,BD,CP,CD gitops
  class QA,PROD manual
  class ARGO argo
  class BUILD io
  classDef gitops fill:#8957e5,stroke:#512a8f,color:#ffffff
  classDef manual fill:#9a6700,stroke:#5c3d00,color:#ffffff
  classDef argo fill:#e8590c,stroke:#9a3b08,color:#ffffff
  classDef io fill:#57606a,stroke:#32383f,color:#ffffff

Jobs in this stage

Job	What it does	Why
`gitops:bump:karc-portal:dev`	Writes `sha-<short>` into `envs/dev/image-tag.yaml` on the gitops branch (on_success, change-gated to match the build).	Automatic dev promotion; the change-gate guarantees gitops never points at an unbuilt SHA.
`gitops:bump:podtato-head:dev`	Bumps the podtato AWS image-tag file on the gitops branch.	Per-CI/per-cloud: GitLab bumps the AWS file; GitHub/ADO bump theirs.
`gitops:promote:chart:karc-portal`	Replays the portal chart tree from main onto gitops, preserving `envs/` overlays.	Chart-template changes (e.g. PreSync hooks) auto-promote without a manual cherry-pick.
`gitops:promote:chart:podtato-head`	Same chart-replay for podtato-head.	Keeps the podtato chart in sync on the gitops branch.
`gitops:promote:karc-portal:qa` / `:prod`	`when: manual` chart promotion via `promote.sh`; qa auto-closes the CR.	Operator-driven promotion to qa/prod with the promotion script’s gates.
`gitops:promote:podtato-head:qa` / `:prod`	Manual podtato promotion to qa/prod.	Same operator-gated promotion for the demo app.

Why this stage exists

GitOps means git is the single source of truth for what runs. The pipeline’s job ends at writing the desired state; ArgoCD owns convergence, which is what makes the deployment auditable and self-healing. Production auto-sync is disabled by policy — prod changes are promoted deliberately.

Stages: post-deploy → gitops → release · all stages