KCNA — CI/CD Fundamentals
CI/CD Fundamentals
CI/CD (Continuous Integration / Continuous Delivery) is the practice of automating the software delivery process. It’s a key concept for the KCNA exam and fundamental to cloud-native application delivery.
What Is CI/CD?
Continuous Integration (CI)
CI is the practice of frequently merging code changes into a shared repository, with automated builds and tests running on every change.
Developer → Commit → Build → Test → Integration
│ │ │ │ │
└─────────┴────────┴───────┴─────────┘
Automated on every push
CI Goals:
- Detect bugs early — automated tests catch issues immediately
- Reduce integration problems — merge small, frequent changes instead of big, risky merges
- Maintain a working codebase — the main branch should always be buildable
Continuous Delivery (CD)
Continuous Delivery ensures that code is always in a deployable state. After CI, the artifact is ready for production — but a human approves the actual deployment.
Code → Build → Test → Staging → [Human Approval] → Production
Continuous Deployment
Continuous Deployment goes one step further — every change that passes all tests is automatically deployed to production. No human approval needed.
Code → Build → Test → Staging → Production
(automatic!)
Comparison
| Practice | Build/Test | Deploy to Staging | Deploy to Production |
|---|---|---|---|
| CI | Automated | Manual | Manual |
| Continuous Delivery | Automated | Automated | Manual (approval gate) |
| Continuous Deployment | Automated | Automated | Automated |
CI/CD Pipeline
A pipeline is a series of automated stages that code goes through:
┌─────────┐ ┌─────────┐ ┌──────────┐ ┌─────────┐ ┌──────────┐
│ Source │──→│ Build │──→│ Test │──→│ Release │──→│ Deploy │
│ (Git) │ │ (Image) │ │(Unit,E2E)│ │(Tag,Push)│ │(K8s,Helm)│
└─────────┘ └─────────┘ └──────────┘ └─────────┘ └──────────┘
Pipeline Stages
| Stage | What Happens |
|---|---|
| Source | Code is committed and pushed to Git repository |
| Build | Application is compiled and container image is built |
| Test | Automated tests run — unit, integration, end-to-end |
| Security Scan | Container image scanned for vulnerabilities (CVEs) |
| Release | Image is tagged and pushed to a container registry |
| Deploy | Application is deployed to the target environment (K8s) |
CI/CD Tools
General-Purpose CI/CD
| Tool | Type | Description |
|---|---|---|
| GitHub Actions | SaaS | CI/CD integrated with GitHub repositories |
| GitLab CI | SaaS/Self-hosted | Built-in CI/CD in GitLab |
| Jenkins | Self-hosted | Widely used, extensible CI/CD server |
| CircleCI | SaaS | Cloud-native CI/CD platform |
Kubernetes-Native CI/CD
| Tool | Type | Description |
|---|---|---|
| Tekton | CNCF Incubating project (CDF) | Kubernetes-native pipeline framework |
| ArgoCD | CNCF Graduated (Argo project) | GitOps continuous delivery for K8s |
| Flux | CNCF Graduated | GitOps toolkit for Kubernetes |
Container Image Pipeline
A typical CI/CD pipeline for Kubernetes applications:
1. Developer pushes code to Git
2. CI system detects the change
3. Build stage:
- Run linting and static analysis
- Build the container image (docker build)
4. Test stage:
- Run unit tests
- Run integration tests
5. Security stage:
- Scan image for vulnerabilities (Trivy, Snyk)
- Check base image for CVEs
6. Release stage:
- Tag image with Git SHA or version
- Push to container registry (Docker Hub, ECR, GCR)
7. Deploy stage:
- Update K8s manifests with new image tag
- Apply to cluster (kubectl, Helm, ArgoCD)
Image Tags and Versioning
| Practice | Example | Description |
|---|---|---|
| Git SHA | myapp:a1b2c3d |
Unique, traceable to exact commit |
| Semantic Version | myapp:1.2.3 |
Clear version numbering |
| Latest | myapp:latest |
Avoid in production — not reproducible |
Never use latest in production — it’s a mutable tag that can point to different images over time, making rollbacks impossible.
Artifact Storage
| Artifact Type | Storage |
|---|---|
| Container Images | Docker Hub, Amazon ECR, Google GCR, Azure ACR, Harbor |
| Helm Charts | Helm repositories, OCI registries, ChartMuseum |
| Build Artifacts | JFrog Artifactory, Nexus Repository |
Harbor is a CNCF Graduated project for container image registry with security scanning and access control.
KCNA Exam Tips
- Know the difference between CI, Continuous Delivery, and Continuous Deployment
- Continuous Delivery has a human approval gate; Continuous Deployment is fully automated
- Know the typical pipeline stages: Source → Build → Test → Scan → Release → Deploy
- Never use
latesttag in production — use Git SHA or semantic versioning - Tekton is a Kubernetes-native CI/CD framework
- Harbor is a CNCF Graduated container registry
What’s Next?
Learn GitOps — the practice of using Git as the single source of truth for infrastructure and application delivery.
