Homelab / From a push to an HTTPS response with no manual step.
Delivery chain
Jenkins is defined entirely through JCasC and builds on a separate virtual machine, because it runs code that arrives in pull requests. The image is published by sha256 digest, the digest lands as a commit in the gitops repository, and Argo CD syncs it; that repository is the only description of cluster state.
Jenkins tests and builds on a separate agent, because it runs code that arrives in pull requests.
The image is published by sha256 digest, and that digest lands as a commit in the gitops repository.
Argo CD syncs that repository against the cluster and flags when the two stop matching.
How I built it
An image tag can be repointed; a digest cannot. Pinning the deployment by sha256 means the gitops repository describes one specific version, and rebuilding the cluster from that repository returns the same bytes. Jenkins is defined entirely through JCasC, so the build server configuration is reviewed as a file too.