CI and verified GitOps promotion

CI and verified GitOps promotion An architecture diagram generated by Archify. app-source · Source repository · Architecture component app-source Source repository Trigger · Webhook receiver · Tekton (CI) Trigger Webhook receiver git-clone · Clone source · Tekton (CI) git-clone Clone source Test / Lint · Unit tests + lint · Tekton (CI) Test / Lint Unit tests + lint Image Build · Container image · Tekton (CI) Image Build Container image ECR Push · Push image · Tekton (CI) ECR Push Push image Promotion checks · CI / scan / signatures · Separate promotion Promotion checks CI / scan / signatures Container Registry · Amazon ECR · Architecture component Container Registry Amazon ECR app-manifests · reviewed digest change · Separate promotion app-manifests reviewed digest change ArgoCD Sync · Sync manifests · ArgoCD (CD) ArgoCD Sync Sync manifests kubelet / runtime · pull image / run Pod · Kubernetes runtime kubelet / runtime pull image / run Pod push image review / merge detect manifests pull Tekton (CI) ArgoCD (CD) Separate promotion Kubernetes runtime

CI / promotion

  • • Check build/scan success and signatures separately
  • • Commit a reviewed digest change to Git

CD

  • • ArgoCD synchronizes manifests
  • • Kubelets pull images; verify actual application health