How do you integrate GitOps with a CI pipeline — separation of concerns?

The cleanest mental model is: CI builds artifacts, GitOps deploys them. The CI pipeline (GitHub Actions, GitLab CI, Jenkins) is responsible for everything up to and including pushing a container image to a registry. It is explicitly not responsible for applying changes to the cluster. That role belongs entirely to the GitOps operator.

The handoff between CI and GitOps is a commit to the config repository. CI updates the image tag reference in the relevant overlay or HelmRelease, commits it, and pushes. The GitOps operator detects the commit on its next poll and applies the new image tag to the cluster.

Config repo update step in a GitHub Actions CI workflow:

- name: Update image tag in GitOps config repo
  env:
    IMAGE_TAG: ${{ github.sha }}
  run: |
    git clone https://${{ secrets.GITOPS_TOKEN }}@github.com/org/gitops-config.git config
    cd config
    # Use kustomize to update the image tag in the prod overlay
    cd apps/my-app/overlays/prod
    kustomize edit set image my-app=registry.example.com/my-app:${IMAGE_TAG}
    git config user.email "ci-bot@example.com"
    git config user.name "CI Bot"
    git add kustomization.yaml
    git commit -m "chore(cd): promote my-app to ${IMAGE_TAG}"
    git push origin main

This separation has several benefits: the CI system never needs cluster credentials; rollbacks only require a Git revert (no re-running CI); and the config repo provides a clear record of every version deployed to every environment, independent of the CI system that triggered it.

Alternatives to manual kustomize edit set image: yq for YAML patching, sed -i (fragile but simple), or Flux's built-in image automation which removes the config-repo-update step from CI entirely.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.