GKE + Helm + ArgoCD GitOps Tutorial: Production Deployment Pipeline on GCP

GKE + Helm + ArgoCD is the de facto GitOps stack for production Kubernetes. This article walks through the full setup, the App of Apps pattern, Workload Identity, and Sealed Secrets with working examples.

Architecture

Developer
   |
   git push (Helm Chart / values)
   |
   v
GitHub Repository ← ArgoCD が Sync (pull)
                                |
                                v
                       GKE Cluster (Prod)
                                |
                                v
                       Pods (Helm Chart 展開)

Step 1: Create the GKE Cluster

gcloud container clusters create-auto prod-cluster \
  --region=asia-northeast1 \
  --release-channel=stable \
  --enable-private-nodes

gcloud container clusters get-credentials prod-cluster \
  --region=asia-northeast1

Step 2: Install ArgoCD

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# UI アクセス (Port Forward)
kubectl port-forward svc/argocd-server -n argocd 8080:443

# 初期パスワード取得
kubectl -n argocd get secret argocd-initial-admin-secret \
  -o jsonpath="{.data.password}" | base64 -d

Step 3: Helm Chart Structure

my-app/
├── Chart.yaml
├── values.yaml
├── values-prod.yaml
├── values-staging.yaml
└── templates/
    ├── deployment.yaml
    ├── service.yaml
    ├── ingress.yaml
    ├── hpa.yaml
    ├── serviceaccount.yaml   # Workload Identity 用 Annotation
    └── _helpers.tpl

# templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}
spec:
  replicas: {{ .Values.replicas }}
  selector:
    matchLabels: { app: {{ .Release.Name }} }
  template:
    metadata:
      labels: { app: {{ .Release.Name }} }
    spec:
      serviceAccountName: {{ .Release.Name }}
      containers:
      - name: app
        image: {{ .Values.image.repo }}:{{ .Values.image.tag }}
        resources:
          requests: { cpu: {{ .Values.resources.cpu }}, memory: {{ .Values.resources.memory }} }
---
# templates/serviceaccount.yaml (Workload Identity)
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Release.Name }}
  annotations:
    iam.gke.io/gcp-service-account: {{ .Values.gsaEmail }}

Step 4: Define the ArgoCD Application

# argocd/applications/my-app-prod.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app-prod
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/my-org/k8s-config.git
    targetRevision: HEAD
    path: charts/my-app
    helm:
      valueFiles: [values-prod.yaml]
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground

Step 5: App of Apps Pattern

# argocd/root-app.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: root
  namespace: argocd
spec:
  source:
    repoURL: https://github.com/my-org/k8s-config.git
    path: argocd/applications/
    targetRevision: HEAD
  destination:
    server: https://kubernetes.default.svc
    namespace: argocd
  syncPolicy:
    automated: { prune: true, selfHeal: true }

# 全 App が applications/ 配下から自動同期

Step 6: Sealed Secrets (Secret Management)

# Sealed Secrets Controller インストール
helm install sealed-secrets sealed-secrets/sealed-secrets -n kube-system

# Secret を Sealed Secret に変換
kubectl create secret generic db-pass --from-literal=password=secret -o yaml --dry-run=client | \
  kubeseal -o yaml > db-pass-sealed.yaml

# 結果: Git に commit 可能な暗号化 YAML
# 復号鍵はクラスタ内のみ存在

Step 7: Workload Identity

# GSA 作成
gcloud iam service-accounts create my-app-gsa

# Role 付与
gcloud projects add-iam-policy-binding PROJECT \
  --member=serviceAccount:[email protected] \
  --role=roles/cloudsql.client

# KSA ↔ GSA 紐づけ
gcloud iam service-accounts add-iam-policy-binding \
  [email protected] \
  --role=roles/iam.workloadIdentityUser \
  --member="serviceAccount:PROJECT.svc.id.goog[production/my-app]"

# Helm values
gsaEmail: [email protected]

Step 8: Canary Deployment (Argo Rollouts)

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: my-app
spec:
  strategy:
    canary:
      steps:
      - setWeight: 20
      - pause: { duration: 5m }
      - setWeight: 50
      - pause: { duration: 10m }
      - setWeight: 100
  selector: { matchLabels: { app: my-app } }
  template: ... # Deployment と同じ

A Typical Workflow

1. A developer pushes Helm chart / values changes to Git
2. CI (GitHub Actions) builds the image and pushes it to Artifact Registry
3. CI commits the new image tag back to Git (via an image updater)
4. ArgoCD detects the Git change and auto-syncs
5. Argo Rollouts performs the staged Canary rollout
6. Cloud Monitoring watches the SLOs and triggers automatic rollback on violation

Best Practices

• Manage every Application from Git with the App of Apps pattern
• Keep secrets in Git safely with Sealed Secrets or External Secrets
• Use Workload Identity so you never need service account keys
• Lock down production permissions with ArgoCD RBAC
• Integrate SSO (Cloud Identity or Entra ID)
• Wire up Slack notifications with argo-notifications
• Run multi-cluster management with the Hub-and-Spoke pattern

Google Cloud is a trademark of Google LLC; the Argo Project and Helm belong to the CNCF. For the latest details, see the official ArgoCD docs.