Promotion Evidence Checklist

For every promotion, ensure you collect the following artifacts:

• Flux Reconcile Success: flux get kustomizations -n flux-system shows Ready.
• Tag in Git = tag in cluster: the newTag you committed is the image the Deployment runs.
• Deployed Digest: kubectl shows the same digest in the target environment that was verified in the source environment.
• Rollback Commit: the Git SHA that reverts the promotion is known before you merge it.
• Cloud track: flux get image policy shows the automation selected the intended immutable tag.

Core Exercises (Required)

1. Read the lanes: grep -n newTag flux/apps/backend/*/kustomization.yaml - three environments, three tag families (develop-*, staging-*, production-*). Confirm with crane ls ghcr.io/safeops-course/backend | grep ^production- which production tags exist.
2. Analyze a Policy: Look at the ImagePolicy regex in flux/apps/backend/production/image-policy.yaml. Explain how it prevents a develop-* image from accidentally being deployed - even though on the local cluster the policy object is not applied, the regex is the promotion contract.
3. Promote by Git: change newTag in flux/apps/backend/production/kustomization.yaml to another existing production-* tag, commit, push, and watch Flux roll production to it (flux reconcile kustomization apps-production --with-source, then kubectl -n production rollout status deploy/backend).
4. Perform a Rollback: git revert that commit, push, and observe Flux restore the previous tag. No kubectl writes anywhere in this exercise.

Challenge Exercise (Optional)

Digest-Pinned Promotion: Promote by image@sha256:<digest> instead of a tag: read the digest of the staging image (crane digest), pin it in the production overlay, and verify that the running container’s imageID matches. Explain what the digest gives you that an immutable tag does not.

Done When

You have completed this chapter when:

• You can explain the difference between “promotion” and “rebuild.”
• You have promoted and rolled back production with nothing but two commits (Cloud track: you can also read the automation objects with flux get images all -A).
• You can demonstrate a GitOps-first rollback using a commit revert.
• You can verify the running image digest using kubectl.

Knowledge Check

Before finishing this chapter, complete the Quiz to verify your understanding of the guardrail principles.