Pipeline succeeds but the new version isn't deployed — how would you debug?

When a CI/CD pipeline shows green but production is unchanged, the issue lies in artifact immutability, deployment trigger conditions, or GitOps reconciliation gaps. Key Takeaway: Check the live running image tag first. Avoid mutable ':latest' tags that bypass k8s rollouts. Verify pipeline conditions, approval gates, and GitOps manifest commit chains.

Production deployment fails halfway — what's your rollback strategy?

A deployment failing halfway means your system is in a hybrid state — some nodes or pods are running the new version while others run the old version. The strategy depends on deployment pattern and data compatibility. Key Takeaway: Halt forward rollout immediately. Revert traffic to the stable baseline. Never couple breaking database migrations with application deployments — use Expand/Contract.

How would you securely manage secrets?

Secure secrets management requires defense-in-depth across three stages: in Git repositories (at rest), during CI/CD execution (in transit), and inside production runtime environments. Key Takeaway: Store secrets in AWS Secrets Manager / Vault, inject into K8s via External Secrets Operator, encrypt in Git using SOPS, use OIDC for CI/CD instead of static keys, and encrypt etcd at rest.

How would you implement Blue-Green/Canary deployment?

Both strategies aim for zero downtime, but they serve different risk profiles: Blue-Green is all-or-nothing environment switching, while Canary is progressive, metric-driven traffic shifting. Key Takeaway: Canary uses Argo Rollouts/Flagger for metric-driven progressive traffic shifting (5% -> 100%). Blue-Green uses dual environments with a router flip. Both require backward-compatible Expand/Contract database schemas.

Design an enterprise-grade CI/CD pipeline for multiple teams deploying microservices independently. How would you implement automated testing, artifact management, security scanning, approvals, deployment strategies, and rollback?

An enterprise CI/CD system must provide autonomous developer self-service while enforcing strict organizational security, automated progressive delivery, and zero-downtime rollbacks. Key Takeaway: Decouple CI from CD via GitOps (ArgoCD). Enforce shift-left security (Trivy, Cosign, SBOM), use immutable Git SHA tags, and deploy to production via metric-driven automated canary analysis with instant rollback.

118+ Production CI/CD & GitOps Interview Questions & Scenarios (2026 Edition)

Senior DevOps / SRE Pipelines & Delivery

⚡ Scenario cicd-pipeline-succeeds-not-deployed

CI/CD Pipeline Succeeds but New Version Isn't Deployed — Debugging

Diagnostic guide for when CI/CD logs show green checkmarks but the target production environment continues running old code: image tag caching, branch rules, an...

#CI/CD #Docker #Image Tagging

All CI/CD & GitOps Scenario Questions (118)