Architecture · 01 of 07 · System overview

Glidepath end to end: from a push to a verified release

Developers write one file and push. Pipelines-as-Code owns everything git-triggered, a broker chains the stages by event, every step is a span in one trace, and nothing reaches a cluster except through a reviewed commit that ArgoCD pulls.

Glidepath end to end: from a push to a verified release Architecture of Glidepath. An app repo with cicd.yaml sends webhooks to Pipelines-as-Code on the dev cluster, which starts stage PipelineRuns resolved from a shared, git-tag-pinned catalog. Each stage emits a CDEvent to a broker that authenticates callers with TokenReview and starts the next stage; a DORA exporter consumes the same events. Spans go to Tempo, Grafana queries them, and Tekton Results archives every run. The release stage opens a pull request against the gitops repo, and ArgoCD, the only writer to a cluster, pulls from it. GITHUBDEV CLUSTER · GLIDEPATHOBSERVEWEBHOOKSTARTSRESOLVESCDEVENTNEXT STAGESPANSQUERIESPRARGOCD PULLSApp repocicd.yaml · sourcegitops-<app>release PRs land herePipelines-as-CodeGitHub App · checksShared catalogHelm · pinned by git tagStage PipelineRunsvalidate · build · test · deploy · releaseCDEvents brokerTokenReview · no minted credsDORA exportera consumer of the eventsArgoCDthe only writer to a clusterGrafanapipelines · stages · DORATempoone trace per flowTekton Resultsevery run, archivedTwo triggers, two trust models: git events belong to Pipelines-as-Code, stage-to-stage chaining to the broker.LEGENDPipeline runsYour repoStateEvent or telemetryRelease pathReads

Built

  • Tekton plus Pipelines-as-Code on plain Kubernetes (ADR-0001).
  • CDEvents broker with a TokenReview interceptor (ADR-0002).
  • GitOps-only release (ADR-0004); Tekton Results archival (ADR-0016).

Why two triggers

Git events arrive with a webhook signature that the Pipelines-as-Code GitHub App already validates. A stage finishing is not a git event, so it needs its own path, and that path authenticates the pod itself rather than a credential the platform would have to mint and rotate.

Known gaps

Glidepath keeps a public known-gaps list of problems found building real apps, each with evidence: for example, config-only pushes are not validated yet, and required checks assume every PR is a release PR.

Hangar · Glidepath