case study 03 / gitops-tekton
Delivery and security
Tekton, Argo CD, and Trivy
Designed automated Tekton build pipelines, Trivy container security scans, and Argo CD GitOps delivery.
Tekton · Argo CD · Helm · DevSecOps
- Commit → Tekton → Trivy → Argo CD
- Helm App-of-Apps
Proprietary production work. Customer names, hostnames, and unpublished volumes are omitted.
Problem
Manual deployments and unstandardized build environments caused build fragility, configuration drift, and late-stage security discovery.
Design
Built resilient Tekton pipeline tasks for containerized Java builds with memory isolation and single-threaded compilation. Integrated Trivy image scanning at build time. Established Argo CD GitOps architecture with environmental Helm values, webhook triggers, and Wazuh cluster monitoring.
Path
- 01Git commit
- 02automated webhook
- 03Tekton build & Trivy scan
- 04Argo CD declarative sync to OpenShift via Helm.
Constraints
- Internal repository URLs, pipeline timing benchmarks, and specific security finding logs are omitted.
Decisions
Containerized, isolated build environments
Isolated build tasks eliminate host-level dependency leaks and stabilize compilation memory consumption.
Declarative GitOps with Argo CD
Git remains the single source of truth for desired state, replacing manual kubectl/oc commands with automated reconciliation.
Shift-left security scanning
Trivy scans container images before registry promotion, while Wazuh provides continuous runtime cluster monitoring.
Limits
- GitOps ensures declarative state consistency but relies on rigorous Helm chart linting and environmental property validations.