Deploy Request: from merged commit to serving traffic

Deploy Request: from merged commit to serving traffic A sequence diagram generated by Archify. merge to main push signed image request rollout resolve digest manifest submit workload policy verdict apply canary 1% readiness + SLO healthy scale to 100% deploy complete Build handoff Policy gate Progressive rollout Engineer · merges the PR · Sequence participant Engineer merges the PR Release Job · CI runner · Sequence participant Release Job CI runner Controller · rollout API · Sequence participant Controller rollout API Registry · image digests · Sequence participant Registry image digests Admission · policy check · Sequence participant Admission policy check Cluster · workload API · Sequence participant Cluster workload API Probes · health + SLO · Sequence participant Probes health + SLO Legend request return security default message

The digest is the contract

  • • CI pushes an image; the controller resolves it by digest, never by tag
  • • The same digest is what a revert restores
  • • Nothing is rebuilt between staging and production

The gate that can say no

  • • Admission verifies signature and policy before any pod starts
  • • A rejected verdict stops the rollout with zero traffic shifted
  • • Policy failures are release failures, not infrastructure noise

Reading this trace during an incident

  • • Stalled at resolve digest: the artifact never reached the registry
  • • Stalled at policy verdict: signing or provenance is missing
  • • Healthy canary but no scale-up: the SLO window has not closed