Production-grade GitHub Actions CI/CD pipeline for Kubernetes deployments. Battle-tested across 50+ enterprise environments.
- Full CI/CD pipeline — test → build → push → deploy (staging + production)
- Blue-green deployments with automated traffic switching and rollback
- Least-privilege RBAC — namespace-scoped service account (no cluster-admin)
- Private registry auth — GitHub Container Registry (ghcr.io) pull secrets
- Multi-environment — staging (
developbranch) + production (mainbranch) - Canary analysis with Flagger for progressive traffic shifting
- Secret management — Sealed Secrets + External Secrets Operator patterns
- Smoke tests — in-cluster curl health checks after each deployment
- Slack notifications — success/failure alerts with deployment details
- Setup scripts — one-command kubeconfig generation for CI service account
Setting Up a CI/CD Pipeline to Kubernetes with GitHub Actions
Covers the real problems most tutorials skip: RBAC permission errors, ImagePullBackOff from private registries, kubeconfig management, and production-ready blue-green deployments.
# Create namespace and service account
kubectl apply -f k8s/rbac.yaml
# Generate kubeconfig for GitHub Actions
./scripts/generate-kubeconfig.sh productionKUBE_CONFIG_STAGING — base64-encoded kubeconfig for staging cluster
KUBE_CONFIG_PROD — base64-encoded kubeconfig for production cluster
SLACK_WEBHOOK — (optional) Slack incoming webhook URL
git checkout -b feature/my-feature
# ... make changes ...
git push origin feature/my-feature
# PR → merge to develop → auto-deploys to staging
# merge to main → auto-deploys to production (blue-green)workflow-examples/
deploy.yml # Main CI/CD pipeline — copy to .github/workflows/ to activate
k8s/
rbac.yaml # ServiceAccount, Role, RoleBinding (least-privilege)
staging/
deployment.yaml # Staging Deployment with health probes
service.yaml # ClusterIP service
ingress.yaml # Ingress with TLS
production/
deployment.yaml # Production Deployment (blue-green)
service.yaml # Service with version selector
ingress.yaml # Production Ingress with TLS
canary.yaml # Flagger Canary for progressive delivery
scripts/
generate-kubeconfig.sh # Generate scoped kubeconfig for CI
setup-pull-secret.sh # Create imagePullSecret for ghcr.io
rollback.sh # Emergency rollback script
validate-deployment.sh # Post-deploy health check
app/
Dockerfile # Multi-stage Node.js Dockerfile
src/index.js # Simple Express app with /health and /ready endpoints
Push to feature/* → [Tests only]
Push to develop → [Tests] → [Build + Push image] → [Deploy staging] → [Smoke tests]
Push to main → [Tests] → [Build + Push image] → [Blue-green prod deploy] → [Monitor 5m] → [Notify Slack]
PR to main → [Tests + Build] (no deploy)
Service account token expired. Regenerate:
kubectl delete secret $(kubectl get sa github-actions -n production -o jsonpath='{.secrets[0].name}') -n production
kubectl apply -f k8s/rbac.yaml
./scripts/generate-kubeconfig.sh production
# Update KUBE_CONFIG_PROD GitHub Secret with new output./scripts/setup-pull-secret.sh
# Ensure deployment.yaml references imagePullSecrets: [{name: ghcr-secret}]RBAC role is missing a verb. Edit k8s/rbac.yaml and re-apply:
kubectl apply -f k8s/rbac.yaml- Setting Up a CI/CD Pipeline to Kubernetes with GitHub Actions — Full tutorial with troubleshooting guide
- Orchestrating Kubernetes and IAM with Terraform — Terraform module for the EKS cluster this pipeline deploys to
- OAuth 2.0 Authorization Code Flow with Node.js — Secure the deployed app with OAuth
- Keycloak Docker Compose Production Setup — Add SSO to applications deployed via this pipeline
- IAMDevBox.com — Identity & Access Management tutorials for developers
MIT