GKE + Helm + ArgoCD GitOps Tutorial: Production Deployment Pipeline on GCP

GKE + Helm + ArgoCD is the de facto GitOps stack for production Kubernetes. This article walks through the full setup, the App of Apps pattern, Workload Identity, and Sealed Secrets with working examples.

Architecture

Developer
   |
   git push (Helm Chart / values)
   |
   v
GitHub repository <- ArgoCD syncs (pull)
                                |
                                v
                       GKE Cluster (Prod)
                                |
                                v
                       Pods (rendered from the Helm chart)

Step 1: Create the GKE Cluster

gcloud container clusters create-auto prod-cluster \
  --region=asia-northeast1 \
  --release-channel=stable \
  --enable-private-nodes

gcloud container clusters get-credentials prod-cluster \
  --region=asia-northeast1

Step 2: Install ArgoCD

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Access the UI (port forward)
kubectl port-forward svc/argocd-server -n argocd 8080:443

# Get the initial password
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d

Step 3: Helm Chart Structure

my-app/
├── Chart.yaml
├── values.yaml
├── values-prod.yaml
├── values-staging.yaml
└── templates/
    ├── deployment.yaml
    ├── service.yaml
    ├── ingress.yaml
    ├── hpa.yaml
    ├── serviceaccount.yaml   # annotation for Workload Identity
    └── _helpers.tpl

# templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}
spec:
  replicas: {{ .Values.replicas }}
  selector:
    matchLabels: { app: {{ .Release.Name }} }
  template:
    metadata:
      labels: { app: {{ .Release.Name }} }
    spec:
      serviceAccountName: {{ .Release.Name }}
      containers:
      - name: app
        image: {{ .Values.image.repo }}:{{ .Values.image.tag }}
        resources:
          requests: { cpu: {{ .Values.resources.cpu }}, memory: {{ .Values.resources.memory }} }
---
# templates/serviceaccount.yaml (Workload Identity)
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Release.Name }}
  annotations:
    iam.gke.io/gcp-service-account: {{ .Values.gsaEmail }}

Step 4: Define the ArgoCD Application

# argocd/applications/my-app-prod.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app-prod
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/my-org/k8s-config.git
    targetRevision: HEAD
    path: charts/my-app
    helm:
      valueFiles: [values-prod.yaml]
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground

Step 5: App of Apps Pattern

# argocd/root-app.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: root
  namespace: argocd
spec:
  source:
    repoURL: https://github.com/my-org/k8s-config.git
    path: argocd/applications/
    targetRevision: HEAD
  destination:
    server: https://kubernetes.default.svc
    namespace: argocd
  syncPolicy:
    automated: { prune: true, selfHeal: true }

# Every app under applications/ syncs automatically

Step 6: Sealed Secrets (Secret Management)

# Install the Sealed Secrets controller
helm install sealed-secrets sealed-secrets/sealed-secrets -n kube-system

# Convert a Secret into a SealedSecret
kubectl create secret generic db-pass --from-literal=password=secret -o yaml --dry-run=client | \
  kubeseal -o yaml > db-pass-sealed.yaml

# Result: encrypted YAML that is safe to commit to Git
# The decryption key exists only inside the cluster

Step 7: Workload Identity

# Create the GSA
gcloud iam service-accounts create my-app-gsa

# Grant the role
gcloud projects add-iam-policy-binding PROJECT \
  --member=serviceAccount:[email protected] \
  --role=roles/cloudsql.client

# Bind the KSA to the GSA
gcloud iam service-accounts add-iam-policy-binding \
  [email protected] \
  --role=roles/iam.workloadIdentityUser \
  --member="serviceAccount:PROJECT.svc.id.goog[production/my-app]"

# Helm values
gsaEmail: [email protected]

Step 8: Canary Deployment (Argo Rollouts)

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: my-app
spec:
  strategy:
    canary:
      steps:
      - setWeight: 20
      - pause: { duration: 5m }
      - setWeight: 50
      - pause: { duration: 10m }
      - setWeight: 100
  selector: { matchLabels: { app: my-app } }
  template: ... # same as the Deployment

A Typical Workflow

1. A developer pushes Helm chart / values changes to Git
2. CI (GitHub Actions) builds the image and pushes it to Artifact Registry
3. CI commits the new image tag back to Git (via an image updater)
4. ArgoCD detects the Git change and auto-syncs
5. Argo Rollouts performs the staged Canary rollout
6. Cloud Monitoring watches the SLOs and triggers automatic rollback on violation

Best Practices

• Manage every Application from Git with the App of Apps pattern
• Keep secrets in Git safely with Sealed Secrets or External Secrets
• Use Workload Identity so you never need service account keys
• Lock down production permissions with ArgoCD RBAC
• Integrate SSO (Cloud Identity or Entra ID)
• Wire up Slack notifications with argo-notifications
• Run multi-cluster management with the Hub-and-Spoke pattern

Google Cloud is a trademark of Google LLC; the Argo Project and Helm belong to the CNCF. For the latest details, see the official ArgoCD docs.