Enterprise Pipeline Architecture

CI/CD & GitOps Platform

Building production-grade CI/CD infrastructure from scratch—evolving a greenfield microservices platform to 400 deploys/month with enterprise security

2023-2025 (2-year evolution)
20 Microservices • 400 Deploys/Month
// the challenge

The Challenge

I joined as a Graduate QA Engineer at the very beginning of a massive architectural transformation: migrating from a legacy monolith to a modern Kubernetes-based microservices platform.

With no existing CI/CD infrastructure and a blank canvas, I was tasked with designing and implementing the entire deployment pipeline that would serve 20+ microservices across 4 environments (Dev, QA, Pre-Prod, Production).

Initial Requirements

  • •Zero existing infrastructure — build everything from scratch
  • •Multi-environment strategy — Dev, QA, Pre-Prod, Prod with different promotion rules
  • •Security-first approach — SAST/SCA scanning, compliance gates
  • •GitOps-native — declarative deployments with ArgoCD

Key Insight: Zero existing infrastructure—build everything from scratch for a massive monolith to microservices migration.

// the evolution

The Evolution

Over 2 years of iterative platform engineering, I transformed a basic build script into a sophisticated, production-ready CI/CD platform. Here's how it evolved:

Phase 1:Foundation (Months 1-6)

Built the initial pipeline architecture with basic Maven builds, Docker image creation, and manual ECR pushes.

Early Pipeline (bitbucket-pipelines.yml)
image: maven:3.9.6
pipelines:
  branches:
    master:
      - step:
          name: Build, Test, and Push Docker Image
          script:
            - mvn clean install
            - mvn test
            - docker build -t $IMAGE_NAME:$IMAGE_TAG .
            - pipe: atlassian/aws-ecr-push-image:2.2.0

      - step:
          name: Deploy to Dev
          script:
            - git clone git@bitbucket.org:company/argocd-apps.git
            - ./scripts/update_tag.sh
            - git push origin master

Key Achievement: Established GitOps pattern with ArgoCD for declarative deployments

Phase 2:Standardisation & Reusability (Months 6-12)

Created reusable pipeline components and custom base images to eliminate duplication across services.

  • •Custom Base Image — Pre-built Maven image with kubectl, ArgoCD CLI, AWS CLI, jq
  • •Shared Pipeline Scripts — Centralised notifications via pipeline_reporter.sh
  • •Kustomize Overlays — Environment-specific configuration management
  • •App-of-Apps Pattern — Hierarchical ArgoCD application management

Key Achievement: Custom Docker base image reducing pipeline config by ~40%

Phase 3:Security & Quality Gates (Months 12-18)

Integrated enterprise security scanning and quality gates directly into the pipeline.

SAST (Veracode)

Static code analysis blocking critical/high vulnerabilities

SCA (SourceClear)

Dependency vulnerability scanning with automated reporting

Key Achievement: 100% security scan coverage on all PRs

Phase 4:Test Orchestration & Observability (Months 18-24)

Migrated from brittle pipeline-based testing to robust ArgoCD PostSync hooks with comprehensive observability.

  • •PostSync Hook Architecture — Tests run AFTER deployment completes
  • •Automated Test Suites — JUnit (API), Cucumber + Playwright (UI) as Kubernetes Jobs
  • •DORA Metrics — Custom collector tracking deployment frequency, lead time, MTTR
Why PostSync > Pipeline Testing

Pipeline tests run before pods are healthy, causing false negatives when services aren't ready. PostSync hooks wait for ArgoCD sync completion, then validate pods are ready before running tests — eliminating an entire class of flaky failures.

Key Achievement: Reduced false test results by ~90%

// architecture

Architecture

CI/CD & GitOps Architecture

DevCommitBitbucketPipelinesTests • Build • DeployParallel TestsUnit • IntegrationSAST • SCADocker BuildCustom Base ImageAWS ECRContainer RegistryGitOps RepoKustomize Overlaysdev • qa • preprod • prodAuto: dev, qaArgoCDGitOps SyncApp-of-Apps PatternKubernetesEKS Cluster4 EnvironmentsPostSync TestsNewman API TestsCucumber BDDTeamsAdaptive CardsRich NotificationsPipeline ReporterBash Script (1000+ lines)Baked into Base Imagegit pushbuildpushupdateconfig updatedsyncdeploytest

Flow: Developer commits → Bitbucket runs parallel tests → Docker builds with custom base image → Pushes to ECR → Updates GitOps repo → ArgoCD syncs → Deploys to K8s → PostSync tests run → Teams notifications at each stage

// current state

Current State: Production-Grade Platform

Pipeline Architecture

→Parallel Test Execution: Unit, integration, SAST, SCA run concurrently (~5min total)
→Automated Deployments: Master → Dev (auto), QA (auto w/ Jira gate), Pre-Prod (manual), Prod (manual)
→Jira Integration: Release Version validation prevents premature QA deployments
→PostSync Testing: Kubernetes Jobs execute tests after ArgoCD sync completion
// impact

Business Impact

400+

Deployments per month across all environments

~5 min

Consistent build time with parallel testing

20+

Microservices using standardised pipeline

50+

Alert rules for rapid incident response

~90%

Reduction in false test results

100%

Security scan coverage on all PRs

// transformation

Transformation Metrics

Drag the slider to see the dramatic transformation from manual processes to automated platform engineering.

Deployment Frequency
2/week
Before
400/month
After
Drag the slider to compare before and after
Build Time
15+ min
Before
~5 min
After
Drag the slider to compare before and after
Service Onboarding
1 week
Before
<1 day
After
Drag the slider to compare before and after
Test Reliability
?%
Before
95%+
After
Drag the slider to compare before and after
// lessons

Lessons Learned

  • →Iterative improvement beats big-bang rewrites: Each phase built on the previous, allowing production usage throughout
  • →Standardisation is key to scale: Reusable components (base images, scripts) made onboarding new services trivial
  • →GitOps eliminates deployment drift: Declarative configs in Git provided audit trail and rollback capability
  • →Testing architecture matters: Moving from pipeline polling to PostSync hooks eliminated an entire class of flaky tests
  • →Observability from day one: DORA metrics, deployment notifications, and test reporting enabled data-driven improvements

Want Similar Results?

I'd love to bring this same approach to your platform engineering challenges. Let's discuss how I can help your team.