Werf CI/CD for Kubernetes Guide

Source Code → Build Images → Push to Registry → Deploy (Helm) → Cleanup Old Images
                    ↑                                    ↑              ↑
                All managed by werf with content-based tagging

curl -sSL https://werf.io/install.sh | bash

# werf.yaml
project: order-api
configVersion: 1

---
image: order-api
dockerfile: Dockerfile
context: .

# Build, push, and deploy in one command
werf converge --repo ghcr.io/myorg/order-api

.helm/
├── Chart.yaml
├── templates/
│   ├── deployment.yaml
│   └── service.yaml
└── values.yaml

# .helm/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Chart.Name }}
spec:
  replicas: {{ .Values.replicas }}
  template:
    spec:
      containers:
        - name: app
          image: {{ .Values.werf.image.order_api }}
          # werf injects the correct content-based image tag

# werf.yaml
project: ecommerce
configVersion: 1

---
image: frontend
dockerfile: frontend/Dockerfile
context: frontend/

---
image: order-api
dockerfile: backend/order-api/Dockerfile
context: backend/order-api/

---
image: payment-svc
dockerfile: backend/payment-svc/Dockerfile
context: backend/payment-svc/

Source files hash → Image tag

src/server.ts (changed) → sha256:abc123 (new tag)
src/server.ts (unchanged) → sha256:abc123 (same tag, no rebuild)

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # werf needs full history

      - name: Install werf
        uses: werf/actions/install@v2

      - name: Converge
        uses: werf/actions/converge@v2
        with:
          env: production
        env:
          WERF_REPO: ghcr.io/myorg/ecommerce
          WERF_NAMESPACE: production
          WERF_KUBE_CONFIG_BASE64: ${{ secrets.KUBE_CONFIG }}

deploy:
  stage: deploy
  script:
    - werf converge --repo $CI_REGISTRY_IMAGE
  environment:
    name: production

# Remove images not referenced by any Git tag or branch
werf cleanup --repo ghcr.io/myorg/order-api

# .werf-cleanup.yaml
policies:
  - references:
      branch: /^main$/
    imagesPerReference:
      last: 10  # Keep last 10 images on main
  - references:
      tag: /^v\d+\.\d+\.\d+$/
    imagesPerReference:
      last: 5   # Keep last 5 tagged releases

# Deploy to staging
werf converge --repo ghcr.io/myorg/order-api --env staging

# Promote to production (same images, different values)
werf converge --repo ghcr.io/myorg/order-api --env production