Docs · Glidepath
Architecture Decision Records
One file per load-bearing decision: what it is, why it was made this way, and what it costs. Written after the fact from the real design/implementation history - see ../../archive/ for the original, unabridged design record these were distilled from.
| ADR | Decision |
|---|---|
| 0001 | Tekton + Pipelines-as-Code, vanilla Kubernetes |
| 0002 | CDEvents broker with TokenReview auth for inter-stage chaining |
| 0003 | Governance gates as explicit, structurally-loud extension points |
| 0004 | GitOps-only release promotion |
| 0005 | Per-cluster ArgoCD instances, event-driven outcome reporting |
| 0006 | Cluster-agnostic bootstrap, no cluster state in the app repo |
| 0007 | Testkube CE in one shared namespace, not one per tenant |
| 0008 | Kyverno ValidatingPolicy closes the Testkube shared-secret gap |
| 0009 | External Secrets Operator + self-hosted Infisical as the secrets backend |
| 0010 | Kaniko for rootless image builds under PSS restricted |
| 0011 | Every Application is (at least) two peer namespaces, not one |
| 0012 | Ephemeral (PR-preview) environments deploy through airframe-application, TTL-swept |
| 0013 | Shared catalog distributed as a git-tag-pinned Helm chart, not a bundle resolver |
| 0014 | Keyless signing uses two separate trust roots - public Sigstore for humans, self-hosted Fulcio for workloads |
| 0015 | Provenance policy validates the attestation as input, additive to commit signing |
| 0016 | Tekton Results for long-term PipelineRun/TaskRun archival |
| 0017 | cicd.yaml is scaffolded at onboarding, not hand-authored first |
New decisions get a new numbered file here, not a paragraph buried in an unrelated doc.
Note on 0014/0015: distilled from image-signing.md/commit-signing.md/
provenance-policy.md as they stood 2026-09-06. A separate, concurrent session is
implementing sigstore end-to-end in GitOps fashion at the time these were written -
re-check both against the live mechanism before treating them as current if that work
has since landed.