GitOps and Progressive Delivery with Automated Rollback
CI pipelines that kubectl apply into production fail quietly: drift, rollback archaeology, cluster credentials living in your most-attacked system. A pull-based GitOps controller plus SLO-gated canaries fixes all three. The git history it produces is change-management evidence your auditor will accept without a single screenshot.
GitOps Deploy Repo + SLO-Gated Canary
Copy as markdown to paste into your repo, or download a branded PDF for sharing with non-technical stakeholders.
Frequently asked questions
What is GitOps?
GitOps is a specific inversion of the deploy path: an agent like Argo CD or Flux runs inside the cluster, watches a git repository, and continuously reconciles the cluster toward what the repo declares. CI never touches the cluster — its job shrinks to building images and bumping an image tag in the deploy repo, and cluster credentials leave CI entirely.
Should I use Argo CD or Flux?
At 10 to 80 engineers the choice matters far less than the weeks teams spend debating it. Argo CD gives you a UI non-platform engineers use willingly, an RBAC model that maps to team and environment boundaries, and the Argo Rollouts ecosystem for canaries; Flux is lighter and purely CRD-driven. Pick one, record the decision, and move on.
How does automated rollback work in progressive delivery?
Argo Rollouts replaces the Deployment with a Rollout that shifts traffic in steps and runs an AnalysisRun against Prometheus between them. If any AnalysisRun breaches its failureLimit, Rollouts aborts: all traffic shifts back to the stable ReplicaSet, which was never scaled down, and the canary scales to zero. Rollback takes seconds and needs no human, no CI run, and no image pull.
Should environments be git branches or directories?
Directories. Environment branches feel natural but rot: after the first hotfix cherry-pick they diverge permanently, producing merge conflicts in generated YAML and prod carrying changes staging never saw. With directories, promotion is a PR that copies a change from one overlay to another, and comparing environments is a diff you can run any time.
Do I need a service mesh for canary deployments?
Not necessarily, but you need real traffic shifting — ALB weighted target groups via ingress annotations, or a mesh. Plain Service-based weighting is pod-count-granular and lumpy. You also need enough traffic for the statistics to mean something; low-traffic internal services should run a simpler two-step canary with longer pauses or use blue-green instead.
How does GitOps help with SOC 2 or audit change management?
Every production change becomes a PR with a named author, a required approver enforced by branch protection, a passing status check, a merge timestamp, and a deterministic link to what the cluster ran via the commit SHA in Argo CD's sync history. That is change management as auditors mean it, produced as a side effect of shipping — evidence collection becomes a query over the git log joined with the Argo CD API.
Get the next one.
New operating guides as we publish them — practical, infrequent, unsubscribe in one click.
Change control and same-day deploys are not in tension.
Kaan Systems does platform engineering and Terraform for funded SaaS, health-tech, and fintech. Compliance evidence is the by-product of that work. The Assessment reviews whether git is the only write path to production, and whether rollback writes its own evidence. The 7-day Assessment is read-only. Book a call.