Flipkart Marketplace Platform  ·  View 20 of 25  ·  6 · Operations

Delivery Pipeline and Environments

How a change reaches production, and every gate that can stop a bad one.

Editable source SVG draw.io All views
Source GitHub trunk + PR Review + CODEOWNERS Terraform modules infra as code Build GitHub Actions hermetic build SBOM + sign Syft · Cosign Container Registry Azure ACR Verify Unit + contract Pact SAST + secrets SonarQube Image + CVE scan Trivy Policy gate Kyverno Environments dev ephemeral staging prod-shaped data perf and game day 10x replay Release Argo CD GitOps sync Argo Rollouts canary 1-5-25% SLO gate auto rollback Sale freeze window code freeze Production AKS · 2 regions Feature flags kill switches Change audit who, what, when burn rate breach: roll back Delivery Pipeline — What Stops a Bad Change Application we own Decision point Security / platform Data store failure / alternate Nothing reaches production except by a signed image referenced from a Git commit. During a sale window the freeze is enforced by policy, and only flag flips and rollbacks are allowed. v 1.0 · owner Platform Engineering · date 2026-09

Decisions

  • GitOps: Argo CD reconciles the cluster to Git, so the repository is the only way in and the audit trail is free
  • Only signed images with an SBOM deploy; the policy engine rejects anything else at admission
  • Progressive delivery with automatic rollback on an SLO burn-rate breach, so a bad release does not need a human to notice it

Environments

  • Ephemeral per-PR environments for dev; a permanent staging with production-shaped, masked data
  • A performance environment that replays production traffic at 10x before every sale event
  • A code freeze window during sale events, enforced by policy — only flag flips and rollbacks are permitted

Risks

  • Database migrations are the one change class GitOps does not make safe; expand-and-contract is mandatory and reviewed by hand
  • Feature flags accumulate: an unreviewed flag is an untested branch in production
  • The freeze window shifts risk rather than removing it — the release immediately after a sale is the riskiest of the quarter
◀  Deployment Topology All views Observability and Operations  ▶
Solution Architecture v1.0 · Open source on Microsoft Azure · Enterprise Architecture · 2026-0920-cicd-and-environments