How iamdevbox/github-actions-k8s-deploy works
Purpose and Activation
This repository is a reusable GitHub Actions-to-Kubernetes deployment template, not a standalone application product. Its pipeline definition is intentionally stored as an example and must be copied into .github/workflows/ to activate: workflow-examples/deploy.yml. It builds and deploys the bundled Node.js service from app/.
Application and Container Boundary
The deployable workload is a small Node.js/Express service with health/readiness endpoints in app/src/index.js. app/Dockerfile packages it into a container image; app/package.json defines its runtime dependencies and commands. The image is expected to be pushed to GitHub Container Registry (ghcr.io) and consumed by Kubernetes manifests.
CI/CD Control Flow
workflow-examples/deploy.yml is the central orchestrator: feature branches run validation only; develop builds, pushes, and deploys to staging; main builds, pushes, and performs production rollout/monitoring plus notification. GitHub Actions receives source-control events, authenticates to the container registry and target Kubernetes cluster using repository secrets, then applies environment-specific manifests.
Kubernetes Access and Registry Authentication
k8s/rbac.yaml establishes the namespace-scoped GitHub Actions service account, Role, and RoleBinding boundary rather than granting cluster-admin access. scripts/generate-kubeconfig.sh creates the scoped kubeconfig intended for KUBE_CONFIG_STAGING or KUBE_CONFIG_PROD GitHub secrets. scripts/setup-pull-secret.sh provisions registry credentials so cluster nodes can pull private GHCR images.
Staging Deployment Path
Staging is defined independently through k8s/staging/deployment.yaml and k8s/staging/service.yaml. The pipeline updates the staging workload image, waits for deployment health, and runs in-cluster smoke checks according to the workflow. The Deployment is the workload/replica boundary; the ClusterIP Service is the stable in-cluster traffic endpoint.
Production Progressive Delivery
Production uses k8s/production/deployment.yaml with k8s/production/service.yaml as the traffic-selection boundary, supporting versioned/blue-green rollout behavior. k8s/production/canary.yaml adds Flagger-based progressive delivery and traffic analysis. This introduces Flagger and its required cluster-side integrations as material external infrastructure beyond Kubernetes itself.
Recovery and External Integrations
scripts/rollback.sh is the operator-facing emergency recovery path for reverting a rollout. GitHub Actions depends on GitHub-hosted execution, GitHub Secrets, GHCR, and Kubernetes API access; Slack incoming webhooks are an optional notification sink configured through SLACK_WEBHOOK. The repository documents Sealed Secrets and External Secrets Operator patterns, but no corresponding manifests are present in this tree.
Components 19
Repository assets
- Express service · Provides health and readiness endpoints.
app/src/index.js - Runtime package
app/package.json - Container build
app/Dockerfile - Scoped kubeconfig generator · Produces kubeconfig values for staging or production secrets.
scripts/generate-kubeconfig.sh - Registry pull-secret setup · Provisions node access to private GHCR images.
scripts/setup-pull-secret.sh - Emergency rollback · Reverts a rollout outside the normal pipeline.
scripts/rollback.sh
GitHub delivery
- Deploy workflow example · Must be copied into .github/workflows/ to activate.
workflow-examples/deploy.yml - Source-control events · Feature branches validate; develop targets staging; main targets production.
- Repository secrets · Supplies registry, cluster, and optional Slack credentials.
- In-cluster smoke checks
workflow-examples/deploy.yml
Kubernetes
- Namespace RBAC · Limits GitHub Actions to a service account, Role, and RoleBinding.
k8s/rbac.yaml - Staging Deployment · Replica and deployment-health boundary.
k8s/staging/deployment.yaml - Staging Service · Stable in-cluster staging endpoint.
k8s/staging/service.yaml - Production Deployment · Supports versioned or blue-green rollout.
k8s/production/deployment.yaml - Production Service · Production traffic-selection boundary.
k8s/production/service.yaml - Flagger canary · Defines traffic analysis for production rollout.
k8s/production/canary.yaml
External integrations
- GHCR
- Flagger integrations · Required cluster-side progressive-delivery components.
- Slack webhook · Optional delivery notification target.
Connections 21
- Runtime package → Express service: defines runtime
- Container build → Express service: packages
- Source-control events → Deploy workflow example: triggers
- Repository secrets → Deploy workflow example: authenticates
- Scoped kubeconfig generator → Repository secrets: supplies KUBE_CONFIG values
- Namespace RBAC → Scoped kubeconfig generator: scopes API identity
- Deploy workflow example → Container build: builds
- Deploy workflow example → GHCR: pushes image
- Registry pull-secret setup → GHCR: configures pulls from
- Deploy workflow example → Staging Deployment: develop deploys
- Staging Deployment → Staging Service: served by
- Deploy workflow example → In-cluster smoke checks: runs after staging
- In-cluster smoke checks → Staging Service: checks
- Deploy workflow example → Production Deployment: main deploys
- Production Deployment → Production Service: selected by
- Flagger canary → Production Deployment: progressively rolls out
- Flagger canary → Flagger integrations: requires
- Deploy workflow example → Slack webhook: optionally notifies
- Emergency rollback → Production Deployment: reverts
- GHCR → Staging Deployment: image source
- GHCR → Production Deployment: image source