DEV Community

Cover image for 🚀 Secure Your Deployments: A DevSecOps + GitOps CI/CD Pipeline with Jenkins, ArgoCD, and Kubernetes
Kapil Bhalodiya
Kapil Bhalodiya

Posted on • Edited on

🚀 Secure Your Deployments: A DevSecOps + GitOps CI/CD Pipeline with Jenkins, ArgoCD, and Kubernetes

#devops #gitops #cicd #jenkins

A complete breakdown of how I automated code quality, security, containerization, GitOps deployment, and monitoring — using only open-source tools.

🚀 Why I Built This Pipeline

In today’s cloud-native era, simply deploying code isn’t enough.
We need to:

✅ Ensure code quality
✅ Scan for security vulnerabilities
✅ Automate deployments
✅ Monitor everything
✅ Get feedback instantly

So, I decided to build a DevSecOps + GitOps pipeline that ties together:

🔁 Jenkins for CI/CD

📦 Docker + GitHub + DockerHub

🔍 SonarQube, Trivy, OWASP Dependency Check

☸️ Kubernetes + ArgoCD

📈 Prometheus, Grafana, Loki, Alertmanager

💬 Slack + Gmail notifications

🎥 See It in Action

Watch the pipeline executing:

🧠 Pipeline Flow Breakdown

Let's walk through each step in this real-world production-ready CI/CD setup.

🟢 1. Developer Pushes Code to GitHub

Triggers a Jenkins multibranch pipeline via GitHub webhook

🟡 2. Jenkins CI Begins — With Parallel Security Gates 

parallel {
  stage('SonarQube') {
    steps {
      sh 'sonar-scanner -Dsonar.projectKey=my-app ...'
    }
  }
  stage('Trivy Scan') {
    steps {
      sh 'trivy fs . --exit-code 1'
    }
  }
  stage('OWASP Check') {
    steps {
      sh './dependency-check/bin/dependency-check.sh -s .'
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

✅ Code quality, container vulnerabilities, and dependency checks all run in parallel

🔵 3. Docker Build + Push 

docker build -t <image-name>:<Image-tage> .
docker push <image-name>:<Image-tage>
Enter fullscreen mode Exit fullscreen mode

Built containers are pushed to DockerHub or any secure private registry.

🟠 4. Jenkins CD Updates Kubernetes Manifests

Jenkins updates the Kubernetes deployment.yaml with the new Docker image:

sed -i -E 's|^(\\s*tag:) .*|\\1 "${imageTag}"|' values.yaml
git commit -am "update image tag"
git push origin main
Enter fullscreen mode Exit fullscreen mode

This commit lands in a separate Infra GitHub Repo, which is continuously watched by ArgoCD.

🔴 5. ArgoCD (GitOps) Deploys to Kubernetes

  • ArgoCD syncs automatically with the updated manifest repo.
  • It deploys the new version into the Kubernetes cluster.

🟣 6. Monitoring & Logging Kicks In

Prometheus scrapes metrics from the cluster and app.
Grafana Dashboards display:

  • Application performance
  • Pod CPU/memory usage
  • Business metrics

Loki collects logs
Alertmanager sends alerts on failure, high latency, etc.

📨 7. Instant Notifications

Pipeline stages notify:

✅ Gmail for critical alerts

✅ Slack #ci-cd for success/failure, build times

Example Slack message:

✅ Docker image built and pushed
🚀 ArgoCD deployed version to cluster

🧪 Challenges I Faced

  • Managing parallel Jenkins stages with proper failure handling
  • Avoiding secret exposure in git history
  • Setting up ArgoCD auto-sync correctly
  • Tuning Prometheus scraping and Grafana alert rules
  • Handling secure scanning without breaking pipelines

💡 What I Learned

🔐 Security gates should be integrated early (shift-left) in CI

☸️ GitOps brings traceability and rollback safety

📈 Observability is critical for real production setups

📬 Notifications save time during active development cycles

🔗 Try It Yourself

📬 Final Thoughts

This pipeline is more than a pet project — it’s a blueprint for building production-ready, secure, and scalable deployment workflows using only open-source tools.

If you're starting your DevOps journey or want to adopt GitOps at scale, this setup might help you avoid months of trial and error.

💬 Feel free to drop your thoughts, suggestions, or questions in the comments.
I’m open to feedback and collaborations!

Top comments (0)