GitHub Actions Kubernetes Deployment: ECR, GitOps and Production CI/CD

GitHub Actions Kubernetes Deployment: The Decoupled GitOps Architecture

A modern, production-grade delivery pipeline separates Continuous Integration (CI) from Continuous Deployment (CD):

1. CI (GitHub Actions): Runs unit/integration tests, compiles code, builds container images with BuildKit, scans for vulnerabilities with Trivy, and pushes immutable signed images to Amazon ECR.
2. The Hand-Off: The CI runner commits an updated image tag into a dedicated infrastructure-gitops repository.
3. CD (ArgoCD inside EKS): ArgoCD detects the new git commit, verifies health checks, and initiates a progressive canary or rolling deployment to Kubernetes.

# GitHub Actions workflow step for keyless AWS authentication
- name: Configure AWS Credentials via OIDC
  uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::347166961665:role/github-actions-ecr-push-role
    aws-region: us-east-1
    audience: sts.amazonaws.com

# Build and scan workflow steps
- name: Set up Docker Buildx
  uses: docker/setup-buildx-action@v3

- name: Build and Push to Amazon ECR
  uses: docker/build-push-action@v5
  with:
    context: .
    push: true
    tags: 347166961665.dkr.ecr.us-east-1.amazonaws.com/api:${{ github.sha }}
    cache-from: type=gha
    cache-to: type=gha,mode=max

- name: Scan Image for High/Critical Vulnerabilities
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 347166961665.dkr.ecr.us-east-1.amazonaws.com/api:${{ github.sha }}
    format: 'table'
    exit-code: '1'
    ignore-unfixed: true
    severity: 'CRITICAL,HIGH'

cd deploy/overlays/production
kustomize edit set image api=347166961665.dkr.ecr.us-east-1.amazonaws.com/api:${{ github.sha }}
git commit -am "chore(release): update api image to ${{ github.sha }} [skip ci]"
git push origin main

Hardening the Pipeline: Permissions, Environments and Rollback

A pipeline that can push to production is a high-value target, so give it as little power as possible. Set workflow permissions explicitly, request an OIDC token only where it is needed, and bind production deploys to a protected GitHub environment that requires approval.

permissions:
  id-token: write   # allow the job to request an OIDC token
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    environment: production   # protection rules and approvals live here
    steps:
      - uses: actions/checkout@<full-commit-sha>   # pin actions by commit SHA
      - uses: aws-actions/configure-aws-credentials@<full-commit-sha>
        with:
          role-to-assume: arn:aws:iam::123456789012:role/gha-ecr-push
          aws-region: us-east-1

On the AWS side, restrict the role's trust policy to the exact repository and branch or environment through the token's sub claim, so a fork or a different branch cannot assume it. Tag images with the commit SHA or digest instead of latest, scan on push, and promote a release by opening a pull request against the GitOps repository. Rolling back then becomes a git revert that ArgoCD applies for you.

Troubleshooting Common Failures

• Not authorized to perform sts:AssumeRoleWithWebIdentity: the trust policy does not match the token. Check the sub and aud conditions against the actual repository, branch and environment.
• Denied when pushing to ECR: the role lacks ECR push permissions or the login step ran for the wrong registry or region.
• ImagePullBackOff after a deploy: the tag was never pushed, the node role cannot pull from ECR, or the manifest points at a stale tag. The Kubernetes runbook walks through each case.
• ArgoCD stuck OutOfSync: something is changing live objects, such as an autoscaler. See how to eliminate ArgoCD configuration drift.
• Slow builds: cache misses are usually caused by layer order or a changing build context, so put dependency installs before frequently changing source.

One last tip for any GitHub Actions Kubernetes deployment: keep the workflow short, move logic into versioned scripts, and review pipeline changes with the same care as application code.

For the infrastructure these pipelines deploy into, see the Terraform AWS architecture.

Frequently Asked Questions

Naveed Ahmed (Kumbhar)

Senior DevOps & Cloud Engineer with 10+ years specializing in AWS, Kubernetes, Platform Engineering, SRE incident response, and autonomous AI infrastructure agents.

Passionate about cloud architecture & systems engineering? Connect on LinkedIn →

Portfolio · Interview Hub (970 Scenarios) · K8s Mastery Path · Email Naveed ✉️