Skip to main content
  1. We publish a release to a channel, with its validation evidence.
  2. Your cluster pulls it. Argo CD syncs; Kyverno verifies the signatures with cosign at admission, and — when you install with --verifier-image, which is what turns that gate on — the PreSync verifier checks the entry against your contract before the sync. That is what makes the update safe to roll.
  3. A release that does not pass is refused before it syncs, rather than rolled back after. Going back is one command and it is yours: production follows a pin you move, and moving it to the previous version is Roll back. Nothing here reverts a release on its own — staging’s selfHeal reverts hand-drift, not a bad release, and production has no automated sync at all.
  4. A receipt goes back to the channel when you send it, so we know how it went.
Vexa publishes and gates a release into the channel; your cluster pulls it, admits it, deploys to staging, a human smokes it, you promote to production, and a station report returns to the channel Argo CD works against a generic, deterministic state — a Kubernetes namespace — so this is a deterministic operation. Nothing is pushed to your cluster. We have no access to your cluster. Your cluster has access to the channel, one way. The loop closes with a receipt, and that is the only thing flowing back. Next: Install · Upgrade · The channel