Skip to main content
  1. We publish a release to a channel, with its validation evidence.
  2. Your cluster pulls it. Argo CD syncs; Kyverno verifies the signatures with cosign at admission, and — when you install with --verifier-image, which is what turns that gate on — the PreSync verifier checks the entry against your contract before the sync. That is what makes the update safe to roll.
  3. The cluster rolls it out, or rolls it back.
  4. A receipt goes back to the channel, so we know how it went.
Vexa publishes and gates a release into the channel; your cluster pulls it, admits it, deploys to staging, a human smokes it, you promote to production, and a station report returns to the channel Argo CD works against a generic, deterministic state — a Kubernetes namespace — so this is a deterministic operation. Nothing is pushed to your cluster. We have no access to your cluster. Your cluster has access to the channel, one way. The loop closes with a receipt, and that is the only thing flowing back. Next: Install · Upgrade · The channel