Container Registry and Software Supply Chain Platform · View 24 of 33 · 5 · Operations
Decisions
- The platform is its own first customer: its images carry provenance and SBOMs and pass the same admission control
- Policy bundle changes ship through the same pipeline as code, with a dry-run gate and two approvers
- Argo CD deploys digests, never tags
The bootstrap problem
- The admission controller cannot deny its own upgrade into an unrecoverable state: it is excluded from its own namespace's policy by an explicit, audited rule
- That exclusion is the single most sensitive rule in the bundle and is reviewed every release
- Rollback is by digest, and the previous digest is retained regardless of lifecycle rules
Deliberately omitted
- Application team pipelines — they are producers, shown in act 4
- Infrastructure provisioning — outside the platform boundary
