How does Kubernetes deployment integrate with CI/CD pipelines?

Deploying to Kubernetes from CI/CD involves several approaches. The simplest is kubectl-based deployment: the pipeline authenticates to the Kubernetes cluster (via a service account token or OIDC), updates the image tag in a Deployment manifest (kubectl set image deployment/my-app my-app=myimage:$GIT_SHA), and Kubernetes performs a rolling update. Helm manages Kubernetes applications as versioned "charts" — the pipeline runs helm upgrade --install my-app ./chart --set image.tag=$GIT_SHA. This packages all Kubernetes resources (Deployment, Service, Ingress, ConfigMap) into one versioned unit with rollback support. For production pipelines, use Kubernetes RBAC to limit the CI service account to only the namespaces and actions it needs, never give it cluster-admin. Always verify deployments with kubectl rollout status to ensure the rollout completed successfully before marking the pipeline as passed.