---
title: "Delivery, GitOps, and the software supply chain"
chapter: "12"
---

# Delivery, GitOps, and the software supply chain

Production delivery should turn reviewed source into a traceable running image.

## Golden path

1. Developer changes source and tests.
2. CI builds once, scans, creates provenance and an SBOM.
3. Artifact Registry stores the immutable image.
4. Policy checks manifests and image trust.
5. A delivery controller deploys the same digest through environments.
6. Readiness and SLO signals decide promotion.
7. Rollback or roll-forward uses a known good artifact.

Cloud Build or another approved CI system can build. Cloud Deploy, Config Sync,
Argo CD, or another governed controller can deliver. Choose one clear owner for
desired state so two reconcilers do not fight.

## Rollout strategy

Rolling updates are the baseline. Use canary or blue/green when risk and traffic
control justify them. Define `maxSurge`, `maxUnavailable`, readiness, draining,
and rollback behavior from capacity and availability needs.

## Policy

Validate schemas, required labels, security contexts, resources, allowed
registries, signed images, and prohibited host access before production. Make
policy fast, explainable, versioned, and testable.

## Change safety

Separate application rollout from irreversible data migration. Use backward-
compatible schemas and expand/migrate/contract steps. A Kubernetes rollback
cannot undo corrupted data.