6 min
DevOpsAdvanced
GitOps: The Modern Way to Manage Kubernetes Deployments
Learn GitOps principles and implement them with ArgoCD — automated Kubernetes deployments driven by Git pull requests.
#GitOps#Kubernetes#Helm
Neeraj Jha
505
Topic
CI/CD & Delivery
- Articles
- 11
- Answered questions
- 2
- Guides
- 3
On this page · 11 sections
A pipeline is the path a change takes from commit to production. Its value is not automation for its own sake: it is that every change travels the same path, so a failure is a signal about the change rather than about who deployed it.
The pipelines worth having are fast enough that nobody avoids them, and honest enough that a green run genuinely means the change is safe. Everything else — caching, parallel jobs, environment promotion — serves those two properties.
Learning paths
Existing pages in an order where each step answers a question the previous one raised, with an exercise at the end.
Guides
Step-by-step, with copy-paste commands and an assistant that answers questions about the guide you are reading.
Troubleshooting
Named errors and symptoms, each with its causes, a command that confirms each one, and the fix.
- GitHub ActionsNot authorized to perform sts:AssumeRoleWithWebIdentityGitHub issued a valid OIDC token and AWS refused to exchange it for the role's temporary credentials. Almost never a permissions problem — the role's trust policy is comparing the token's sub claim against a string that does not match it.
- Sigstore / cosignError: no matching signaturescosign found no signature on the image that satisfies the identity you asked it to accept. Either nothing signed it, or something did and you are checking for a different signer — and the full message tells you which:
no signatures foundmeans nothing is attached, whileno matching signatures: none of the expected identities matchedis followed by the subject and issuer that actually signed. - GitHubpush declined due to repository rule violationsGitHub found something that looks like a credential in the commits you are pushing and refused the push. Deleting the line and committing again does not clear it — the secret is still in the history being sent.
- CI/CDPasses locally, fails in CIThe same commit behaves differently on two machines, so something about those machines differs. The list of candidates is short, and each one can be confirmed rather than guessed at.
- MLOpsThe model performs worse in production than in evaluationEvaluation said one thing and production says another, yet nothing errors, nothing restarts, and the service is healthy. That is why this is usually found late and by somebody outside engineering.
- CI/CDThe vulnerability scan blocked the buildA scanner found something and stopped the pipeline, and the question is not how to make it pass. It is whether this finding is reachable, exploitable and fixable, and those are three separate checks.
- GitPush rejected as non-fast-forwardThe remote branch has commits yours is not built on, so accepting your push would drop them. Git refuses by default. The fix is almost never --force — it is to incorporate what is already there, and where history genuinely was rewritten, --force-with-lease --force-if-includes refuses to overwrite work that arrived while you were not looking.
- Gitfatal: refusing to merge unrelated historiesThe two branches share no commit at all, so Git cannot tell what changed on each side and refuses rather than guess. Usually a repository was created on the host with a README while the project was started locally; sometimes a shallow clone simply cannot see the shared history. Rebase onto the remote, or fetch the missing history. --allow-unrelated-histories is for the rare deliberate merge of two separate projects.
- TerraformError: Saved plan is staleA saved plan records the state it was worked out against, and Terraform refuses to apply it once that state has changed. Anything that writes the state in between counts — another apply, a retried job, even
terraform state rmon a resource the plan never touches — because the plan's changes were calculated for a state that no longer exists. There is no flag to force it, and you should not want one: plan again. - TerraformError: Inconsistent dependency lock file
.terraform.lock.hclrecords exactly which version of each provider the configuration uses. When the configuration asks for a provider the lock file does not have, or for a version range the locked version is outside of, Terraform stops rather than quietly choose. The fix depends on which: a new provider needs a plainterraform init; a changed version constraint needsterraform init -upgrade, which upgrades every provider, not just the one you changed. - npmnpm error ERESOLVE unable to resolve dependency treenpm could not build a dependency tree that satisfies every package's peerDependencies, so it stopped. The error names the package already in your tree and the package whose peer range excludes it. --force and --legacy-peer-deps make the error go away by installing the very combination the peer range forbids; the fix is to choose versions that agree.
- GitHub ActionsRunner version is deprecated and cannot receive messagesGitHub stops sending jobs to a self-hosted runner that is too far behind the newest runner release, and GitHub Enterprise Cloud enforces this since 29 Sep 2026. A runner must be updated within 30 days of each release, and at once for critical security fixes. The runner prints this line and exits. The fix is to run a current runner version (v2.338.0 on 21 Oct 2026), usually by letting it update itself or by bumping the version baked into your image.
- Dockerblob unknown to registrySince Docker 29.7 (BuildKit 0.32), images are built with their provenance attestation stored as an OCI artifact that points at the image manifest. Some registries, GitLab's among them, refuse that attestation when the image manifest is new in the same push and answer blob unknown to registry. Rebuild with
BUILDX_NO_DEFAULT_OCI_ARTIFACT=1(Buildx 0.36.1 or later), then push again. - Ubuntu 26.04disk quota exceeded writing to /tmpUbuntu 26.04 mounts /tmp in RAM, limited to half the memory with a per-user quota, so writing several gigabytes there fails while the disk is nearly empty. It hits GitHub's ubuntu-26.04 runners (fix merged 20 Oct 2026, not yet in an image) and servers upgraded to 26.04. Send large temporary files to the disk with TMPDIR, or put /tmp back on disk.
- Python (pip)error: externally-managed-environmentpip refuses to install into a Python that the operating system or Homebrew manages, so a system update cannot break it. Install into a virtual environment, use pipx for command-line tools, or apt install python3-NAME. --break-system-packages only overrides the guard.
- Docker HubYou have reached your pull rate limitDocker Hub limits how many images can be pulled without a paid account, counted per IP address for anonymous pulls, and you went over. Authenticate every pull with docker login or an imagePullSecret, then cut repeat pulls with a mirror or cache. Check your remaining allowance with one HEAD request, which does not count.
- Gitfatal: detected dubious ownership in repositoryGit refuses to work in a repository owned by another user, because that user's config could run commands as you. Common in containers, CI and shared drives. Fix the ownership, or mark that one path safe in your global config; a setting inside the repository is ignored.
- AWS CLIUnable to locate credentialsThe AWS CLI or SDK found no credentials anywhere it looks: no environment variables, no profile with keys, no instance or container role. Run aws configure list to see what it found, then fix that source, often a missing profile, sudo or a container that cannot reach the instance role.
- AWSSignatureDoesNotMatchAWS recalculated your request's signature and got a different one: the secret key, a header, the URL or the clock differs from what was signed. With presigned S3 URLs it is usually a Content-Type or a URL that changed on the way.
- GitHubremote: Support for password authentication was removedGitHub stopped accepting account passwords for Git over HTTPS on 13 August 2021, so use a personal access token, gh auth login or SSH instead. If Git does not even ask, a saved old password is being sent: remove it with git credential reject.
- Gitfatal: Need to specify how to reconcile divergent branchesYour branch and the remote both have commits the other lacks, and since Git 2.33.1 git pull will not choose between merging and rebasing for you. Pick one for this pull with --rebase or --no-rebase, or set pull.rebase once.
- AWSExpiredToken: The security token included in the request is expiredTemporary AWS credentials have a lifetime, from 15 minutes to 12 hours, and the ones being used have run out. Most often they were exported as environment variables, which never renew and override your profile. Unset them and let a profile, SSO or the role refresh credentials for you.
- Giterror: src refspec main does not match anyGit has no local branch called main to push: there are no commits yet, the branch is called master, or CI checked out a single commit. Push the branch you have, rename it, or push HEAD:main.
- Giterror: remote origin already existsThe repository already has a remote called origin, often because you cloned it or ran the setup steps twice, so git remote add origin refuses. Change its URL with git remote set-url origin URL, or add the new remote under another name.
- Giterror: Your local changes to the following files would be overwritten by mergegit pull stopped because you have uncommitted edits to files the incoming commits also change, and merging would overwrite them. Commit them, stash them around the pull, or discard them if you do not need them.
- Giterror: pathspec did not match any file(s) known to gitgit checkout did not find a local branch, tag or file with that name, so it treated the name as a file path and matched nothing. Usually the branch exists only on the remote and has not been fetched yet, or the name is misspelled; git fetch, then check it out again.
- Gitfatal: The current branch has no upstream branchThe branch you are pushing was created locally and is not yet linked to a branch on the remote, so a plain git push does not know where to send it. Push it once with git push -u origin BRANCH, or set push.autoSetupRemote.
- Git*** Please tell me who you areGit needs a name and email for every commit and none is configured for this user, which is normal in fresh containers and CI runners. Set user.name and user.email with git config, either for every repository on this machine (--global) or for this repository only, and commit again.
- Gitfatal: not a git repositoryGit looked in this directory and every parent for a .git and found none, so the command has no repository to work on. Usually you are in the wrong directory, or the files were copied without .git, as in many Docker builds and downloaded archives.
- TerraformError: No value for required variableA variable in the configuration you are running (the root module) has no default and no value reached it. Terraform could not ask for one, because input is off, as in CI. Usually the .tfvars file was not passed, or the TF_VAR_ environment variable is named differently from the variable.
- Giterror: cannot lock refGit could not update a branch or remote-tracking ref, so the fetch, pull or commit stopped part-way. Usually a remote branch such as feature was replaced by one such as feature/x, two remote branches differ only in letter case on a Mac or Windows disk, or a crashed Git left a .lock file.
- Gitfatal: Unable to create '.git/index.lock': File existsGit found .git/index.lock, the file it uses to stop two commands changing the staging area at once, so it refused to start. Either another Git command really is running, or one crashed and left the lock behind.
- Node.jsJavaScript heap out of memoryNode.js ran out of room in its own memory heap and stopped the process: the job needed more than V8's heap limit allows. Usually a build or test run that is simply big, a leak in a long-running process, or a limit set lower than the work needs.
- Gitfatal: could not read Username for 'https://github.com': terminal prompts disabledGit needed a username and password for an https:// repository, had none stored, and was not allowed to ask. Usually a CI job with no credentials for that repository, a private or misspelt repository URL, or a script running without a terminal.
- npmnpm error code EACCES: permission denied, mkdirnpm tried to create a folder your account is not allowed to write to, usually the shared folder for global packages or a cache left owned by root. The fix is to install where you own the files, not to run npm with sudo.
- Node.jsSyntaxError: Cannot use import statement outside a moduleNode.js loaded your file as a CommonJS script, where import statements are not allowed. Usually the package is not marked as an ES module, the Node.js version is older than automatic detection, or a tool runs the file as CommonJS.
- Node.jsError [ERR_REQUIRE_ESM]: require() of ES Module not supportedCommonJS code called require() on a package or file that is an ES module, and this Node.js version cannot load ES modules that way. Newer Node.js can, except for modules that use top-level await.
- Gitwarning: LF will be replaced by CRLF the next time Git touches itA warning, not an error: Git is set to convert line endings, and this file will get different ones in your working folder at its next checkout. Your commit still worked.
- Giterror: cannot rebase: You have unstaged changesgit rebase or git pull --rebase found uncommitted changes to tracked files and stopped before changing anything. Commit them, stash them, or rebase with --autostash.
- Giterror: The following untracked working tree files would be overwritten by checkoutA file you have locally but never committed exists, tracked, in the branch or commits you are switching to or pulling. Git stops rather than replace it, even when the contents are identical.
- GitGit tag already exists (rejected, would clobber existing tag)A tag with that name already points at a different commit, and Git does not move tags unless you force it. Creating, pushing and fetching a moved tag all stop with a variant of this error.
- TerraformError: Module not installedTerraform found a module block it has not downloaded or linked yet, or one whose source changed since terraform init last ran. Run terraform init again in that directory.
- Bashunbound variableThe script runs with set -u (often as set -euo pipefail) and read a variable or argument that was never set, so bash stopped. Set it, give it a default, or fail with a clear message.
- Linux shellBad substitutionA bash-only expansion such as ${VAR^^}, ${VAR:0:3} or an array ran under /bin/sh, which on Debian and Ubuntu is dash. Run it with bash, or use a POSIX form.
- Bash[: too many argumentsA [ ] test received a different number of words than it expects, almost always because a variable was not quoted and was empty or contained spaces. The test fails, and the script carries on down the wrong branch.
- Bashsyntax error near unexpected tokenBash could not parse the script, so none of it ran, and the token it names is where parsing broke. A token of $'\r' means Windows line endings, ( means unquoted parentheses, and fi or done means a malformed block.
- Linux shellset: Illegal option -o pipefailA script written for bash ran under /bin/sh, which on Debian and Ubuntu is dash. That shell rejects pipefail, source, [[ ]], arrays and the function keyword, and two of those fail silently.
- Linux/usr/bin/env: 'python': No such file or directoryA script's first line asks for python, and this system only has python3. Current Ubuntu and Debian do not install a python command. Point the script at python3, or install the package that adds the alias.
- curlcurl: (7) Failed to connectcurl found the host's address but nothing accepted the connection on that port. Usually the service is not running yet, listens on another port or address, or a firewall refuses it.
- curlcurl: (22) The requested URL returned errorThe server answered with an HTTP error (400 or above) and curl was run with -f or --fail, so it exited 22 instead of saving the error page. The number after error: is the HTTP status, and it tells you what to fix.
Commonly confused
Pairs of things that get mistaken for one another, and the problem the mix-up causes.
- ConfigMap vs SecretA Secret is not encrypted by default. Kubernetes stores Secrets unencrypted in etcd unless encryption at rest is turned on, and base64 is only the format the data field has to be written in. What a Secret does give you is narrower handling — it is sent only to nodes that need it and, when mounted as a volume, kept off disk there — so treat it as a label for sensitive data, not as protection by itself.
- Docker image tag vs digestA tag is a name the publisher can move to a different image at any time; a digest is a hash of the image's content, so it can only ever mean that one image. Deploy by tag and two pulls of the same reference can give you different code. Pin by digest and you get the same image every time — including after a security fix has been published for it.
- Git merge vs rebaseBoth bring your branch up to date with another one. Merge adds a commit with two parents and leaves every existing commit as it was. Rebase replays your commits on top of the other branch as new commits with new IDs. That is the whole trade: a straight history in exchange for rewriting commits — harmless on work only you have, and trouble on anything others have already pulled.
- Git reset vs revertReset moves your branch back to an earlier commit, so the commits after it stop being part of the branch. Revert keeps every commit and adds a new one that undoes the changes. On commits only you have, reset is fine; on anything already pushed, revert is the one that does not rewrite history — and
reset --hardalso throws away uncommitted work: changes you never staged are gone for good.
Why it works that way
The design decision behind the behaviour, and what it costs you.
- CI/CDWhy can't you just remove a secret from Git after committing it?Because git is built to remember. A commit is content-addressed and immutable, so deleting the file adds a new commit that removes it — while the original stays reachable, in your history and in every clone anybody already made.
- CI/CDWhy do CI/CD systems insist on immutable artifacts?So that testing something means anything. If the artifact can change between the test and the deploy, then passing tests tells you about a thing that no longer exists.
What happens if
A failure followed step by step: what each part of the system does, and what you can change.
CI/CD security risks
The OWASP Top 10 CI/CD Security Risks, each with how it shows up and what to check in your own pipeline.
- CICD-SEC-1Insufficient Flow Control MechanismsCode or artifacts can travel from a developer's keyboard to production without anything standing in the way.
- CICD-SEC-2Inadequate Identity and Access ManagementThe pipeline accumulates identities — human, machine, and inherited — that nobody has counted, scoped or retired.
- CICD-SEC-3Dependency Chain AbuseThe build fetches code from the internet and runs it, and an attacker only has to get their package into that set.
- CICD-SEC-4Poisoned Pipeline Execution (PPE)An attacker who can influence what the pipeline runs gets to run code with the pipeline's privileges, without ever touching production.
- CICD-SEC-5Insufficient Pipeline-Based Access ControlsA pipeline step runs with far more access than its job requires, so any code that reaches it inherits the surplus.
- CICD-SEC-6Insufficient Credential HygieneSecrets end up somewhere they were never meant to persist — a commit, a log line, an image layer, an environment dump.
- CICD-SEC-7Insecure System ConfigurationThe systems that run the pipeline are themselves unpatched, over-permissioned or exposed.
- CICD-SEC-8Ungoverned Usage of Third-Party ServicesThird-party integrations accumulate broad, permanent access to source and pipelines, and nobody re-reviews them.
- CICD-SEC-9Improper Artifact Integrity ValidationNothing checks that the artifact reaching production is the one that was built from the reviewed source.
- CICD-SEC-10Insufficient Logging and VisibilityWhen something does go wrong in the pipeline, there is not enough evidence to work out what happened.
Tools
Run in your browser; nothing you paste is sent anywhere.
Interview practice
A question, then the follow-ups an interviewer asks when the first answer is right.
Articles
Ordered by how much they are read.
8 min
CI/CDBeginner
Setting Up a CI/CD Pipeline with GitHub Actions
Build a complete CI/CD pipeline with GitHub Actions — from running tests on every PR to automated production deployments.
#GitHub Actions#CI/CD
Neeraj Jha
435
10 min
InfrastructureBeginner
Infrastructure as Code with Terraform: State, Modules and CI
Learn Infrastructure as Code with Terraform — from your first resource to production-ready modules, state management, and CI integration.
#Terraform#AWS#CI/CD
Neeraj Jha
Updated
418
8 min
SecurityIntermediate
SBOMs: What They Answer, and What They Do Not
Most teams generate an SBOM and never read one. The single question it answers well, the four things it does not, and the difference between a compliance artifact and an operational one.
#CI/CD#Docker
Neeraj Jha
215
7 min
CI/CDIntermediate
Flaky Tests: Fix, Quarantine, or Delete
The question is not how to eliminate flakiness. It is what to do with each flaky test — and there are exactly three answers, one of which people resist and should not.
#CI/CD#SRE
Neeraj Jha
199
10 min
SecurityIntermediate
From DevOps to DevSecOps: Turning 312 Findings Into Four
Security scanners produce findings, and findings are not work until somebody can act on them: how a DevSecOps team turns 312 of them into four. The triage, the gate decision, and why false positives destroy the whole programme.
#CI/CD#SRE
Neeraj Jha
189
10 min
DevOpsIntermediate
Platform Engineering: Why Developers Route Around Your Platform
What actually changes moving from DevOps to platform engineering: your work stops being mandatory and starts being optional, and every design decision is now a negotiation with somebody's convenience.
#SRE#CI/CD#Kubernetes
Neeraj Jha
188
15 min
DevOpsIntermediate
From DevOps to MLOps and AIOps: What Actually Changes
MLOps and AIOps sound alike and are different jobs. What transfers from DevOps, the one assumption that breaks, and the failure modes worth learning before you need them — with examples.
#MLOps#AIOps#SRE
Neeraj Jha
181
3 min
CI/CDBeginnerNew
Why Your GitHub Actions Cron Runs Late, or Not at All
Why a GitHub Actions scheduled workflow runs late or not at all: at most every five minutes, delays at busy times, default branch only, and UTC by default. Plus the 60-day switch-off in public repositories, and how to stop being surprised.
#GitHub Actions#CI/CD
Neeraj Jha
3 min
ContainersIntermediateNew
docker push Failing Since Docker 29.7? Two Causes
Since Docker 29.7, docker push can fail with blob unknown to registry on GitLab or with timeout awaiting response headers on slow registries. How to tell which one you have, and what fixes each.
#Docker#CI/CD
Neeraj Jha
3 min
CI/CDIntermediateNew
Ubuntu 26.04 Puts /tmp in RAM: Big CI Builds Run Out
Ubuntu 26.04 mounts /tmp as a RAM disk with a per-user quota, so large builds fail with disk quota exceeded on the ubuntu-26.04 runner. How to check your job and the two-line fix.
#GitHub Actions#Linux#CI/CD
Neeraj Jha
Answered questions
Real questions from the community, with an accepted answer.