05 · Advanced CI/CD & GitOps Engine
Milestones of the roadmap items in this theme
As of 2026-10-22 · today
Gantt
Milestones
| # | Milestone | Start | Target | Status | Waits for | Team | Epic | Derived |
|---|---|---|---|---|---|---|---|---|
| 14 · Declarative GitOps Continuous Deployment (CD) | ||||||||
| 14.1 | ArgoCD reconciling from Git, SSO on, manual sync closed | 2026-09-01 | 2026-11-27 | in progress | — | SRE · Platform Engineering | — | — |
| 14.2 | Platform components reconciled, not applied by hand | — | 2027-05-21 | planned | 14.1 | SRE · Platform Engineering | — | waiting 14.1 |
| 14.3 | Single-application deployment triggered by a merge or a catalog action, never by a person | — | 2027-11-19 | planned | 14.2, 22.2 | SRE · Platform Engineering | — | waiting 14.2, 22.2 |
| 14.4 | A cluster's contents rebuildable from Git alone | — | 2028-03-10 | planned | 14.3 | SRE · Platform Engineering | — | waiting 14.3 |
| 15 · CI/CD Pipeline Optimization | ||||||||
| 15.1 | Progressive delivery on Kubernetes, with automated rollback | — | 2027-07-16 | planned | 14.1, 21.3 | SRE · Platform Engineering | — | waiting 14.1, 21.3 |
| 15.2 | VM to Kubernetes cut-over by APISIX weighted routing | 2026-09-15 | 2026-12-31 | in progress | — | Platform Engineering | — | — |
| 15.3 | Pipelines on GitLab CI, Jenkins retired | — | 2028-05-19 | planned | 15.1 | SRE | — | waiting 15.1 |
| 15.4 | Artifacts signed at build, verified before deploy | — | 2028-09-08 | planned | 15.3, 32.6 | SRE · Platform Engineering | — | waiting 15.3, 32.6 |
| 15.5 | First canary release on the application clusters — goods API | 2026-11-12 | 2027-03-21 | planned | — | Platform Engineering | — | — |
| 15.6 | Canary is the default for every service that moves to Kubernetes | 2027-01-01 | 2028-02-25 | planned | 15.5 | Platform Engineering | — | waiting 15.5 |
| 32 · Unified Artifact Management | ||||||||
| 32.1 | Nexus inventory and proof of concept settled | 2026-10-12 | 2027-01-15 | planned | — | SRE | — | — |
| 32.2 | Repositories, identity and private access under IaC | — | 2027-03-21 | planned | 32.1, 4.1 | SRE | — | waiting 32.1, 4.1 |
| 32.3 | Retention and registry-side scanning live | — | 2027-05-21 | planned | 32.2 | SRE | — | waiting 32.2 |
| 32.4 | Historical artifacts copied | — | 2027-07-16 | planned | 32.2 | SRE | — | waiting 32.2 |
| 32.5 | Pilot pipelines cut over, side by side | — | 2027-07-16 | planned | 32.2 | SRE | — | waiting 32.2 |
| 32.6 | Every pipeline, developer machine and host cut over | — | 2028-01-14 | planned | 32.4, 32.5 | SRE | — | waiting 32.4, 32.5 |
| 32.7 | Nexus retired, minimal NuGet instance left | — | 2028-05-19 | planned | 32.6 | SRE | — | waiting 32.6 |
Details
14.1ArgoCD reconciling from Git, SSO on, manual sync closed2026-11-27in progress · 1/4
- ArgoCD installed and reconciling its first workloadsowner · Charles
- Repository layout and app-of-apps structure agreedowner · TBDWhat lives in which repository decides who can change what without asking. Settling it after a few dozen applications exist means moving them.
- SSO through Zitadel, RBAC mapped from groupsowner · TBD
- Manual sync and console changes closed; drift is reported, not silently appliedowner · TBDAn engine that reconciles but still accepts a hand-made change is a second path, and the two disagree exactly when it matters. Same rule 7.3 sets for network devices.
14.2Platform components reconciled, not applied by hand2027-05-21planned · 0/4
- Platform components declared in Git and reconciled by ArgoCDowner · TBD
- The Terraform / ArgoCD boundary recorded: cluster below, contents hereowner · TBDItem 04 provisions the cluster; ArgoCD reconciles what runs inside it. Layered, not two tools competing over the same objects.
- DefectDojo, rebuilt under 21.1, is one of these componentsowner · TBD21.1 already calls for Helm/GitOps manifests and a build-before-break cutover; this milestone is where that lands rather than a second effort.
- Cluster bootstrap reproducible from the repositoryowner · TBD
14.3Single-application deployment triggered by a merge or a catalog action, never by a person2027-11-19planned · 0/5
- Applications on Kubernetes deployed through ArgoCD onlyowner · TBD
- Ordered multi-system releases are the stated exception, driven by 23.1owner · TBDA release routinely covers twenty-plus systems that must go in sequence, and ArgoCD reconciles each application independently — it cannot express that order. So the ordering stays with cogwork, and this milestone claims only what it can deliver: one application, no person.
- The trigger is a merge or a Backstage catalog actionowner · TBD
- cogwork stops triggering a single application's deployowner · TBDToday cogwork calls Jenkins jobs directly to deploy — and so does the release ticket system. Retiring Jenkins moves both to GitLab CI: 23.2 the cogwork side, 24.3 the ticket system side. What leaves cogwork is triggering one application's deploy; advancing an ordered release stays with it. The catalog action this milestone can be triggered by is 22.2, which it waits on.
- An audit trail that answers who caused a deployment, and from which revisionowner · TBDarchitecture →Removing the person from the trigger must not remove the answer to who is accountable — it moves it to the merge.
14.4A cluster's contents rebuildable from Git alone2028-03-10planned · 0/3
- Reconcile onto an empty cluster as a rehearsalowner · TBD2.4's clean-slate pattern applied to the cluster: rebuild from the repository with no access to the running one, which is what turns GitOps from a deployment convenience into a recovery capability.
- Whatever could not be rebuilt recorded, not quietly fixed by handowner · TBDThe gaps are the finding. A rehearsal patched by hand as it runs proves only that someone was there.
- Recovery time recorded and the runbook publishedowner · TBD
15.1Progressive delivery on Kubernetes, with automated rollback2027-07-16planned · 0/4
- Ambient is already installed for the L3-mode cluster under 11.1, so this milestone adds release policy on top of a datapath that exists rather than standing up a new one.
- Promotion decided by metrics, not by someone watching a dashboardowner · TBDA human watching is a canary that only works during office hours, and only for as long as attention holds.
- Automated rollback when the criteria are breachedowner · TBD
- The policy check is 21.3's release gate, not a second one built hereowner · TBDTwo gates eventually disagree, and then nobody can say which is authoritative. 21.3 lands 2027-02-12, before this milestone, so this is a dependency the chart can actually draw.
15.2VM to Kubernetes cut-over by APISIX weighted routing2026-12-31in progress · 1/4
- Weighted splitting done at APISIX, in front of both the VMs and the clusterowner · TBDKubernetes tooling does not reach VM workloads, so the split happens in front of them and is independent of whatever deploys them.
- Cut-over in steps — 1, 5, 10, 50, 100 % — each step checked on errors, latency and pod stateowner · TBD
- Rollback is shifting the weight back, and it has been rehearsedowner · TBD
- Recorded as a bridge: applications leave it as item 26 moves themowner · TBDWithout saying so, a bridge becomes a second permanent release system that nobody decided to build.
15.3Pipelines on GitLab CI, Jenkins retired2028-05-19planned · 0/5
- Pipeline inventory with an owner for eachowner · TBD
- CI on GitLab CI, CD on ArgoCD — the split Jenkins used to straddleowner · TBDJenkins does both today: it builds and it deploys. Retiring it is not one replacement but two, and the two have different triggers.
- cogwork calls GitLab CI where it called Jenkins jobsowner · TBD
- Test execution parallelised as part of the rewrite, not as a later passowner · TBDEvery pipeline is being rewritten once. Anything deferred to afterwards means opening all of them a second time.
- Jenkins switched off, not left runningowner · TBDA Jenkins left up is a path that still works, and a path that still works will be used the first time the new one is inconvenient.
15.4Artifacts signed at build, verified before deploy2028-09-08planned · 0/4
- Signing in the shared GitLab CI templates, not per pipelineowner · TBDDone during the 15.3 rewrite this is nearly free; done later it means opening every pipeline again.
- Unsigned or unverifiable artefacts refused at deployowner · TBDA signature nothing checks records provenance without enforcing it — the refusal is what makes it a control.
- Signing keys held in Vaultowner · TBDSigning is not in item 12's agreed consumer order (databases, then application secrets, then SSH), so no dependency is drawn to 12.x — the requirement stays stated here.
- The line with item 20 recorded: signatures produced here, collected thereowner · TBDItem 20 builds the searchable audit trail over provenance and signatures; it consumes what this milestone produces rather than producing its own. Item 20 has no milestones, so the boundary is text.
15.5First canary release on the application clusters — goods API2027-03-21planned · 0/4
- Canary process designed during the freeze, before 11/11owner · TBD
- goods API Phase 11–12 released by canary on the clusters' own gatewayowner · TBD
- Promotion and rollback criteria stated: error rate and latency, not someone watchingowner · TBD
- Written up as the template 15.6 applies to every moved serviceowner · TBD
15.6Canary is the default for every service that moves to Kubernetes2028-02-25planned · 0/3
- Every service moving to Kubernetes from 2027 is released by canaryowner · TBD
- Canary steps part of the paved-road templates, not set up per serviceowner · TBD
- A service that does not use it is named, with the reasonowner · TBD
32.1Nexus inventory and proof of concept settled2027-01-15planned · 0/8
- Every Nexus repository listed with its format, size and consumers (from access logs)owner · TBD
- Forward-proxy logs show who fetches what from which registry todayowner · TBD
- Every format proven end to end — Docker, npm, Maven, PyPI, Go (incl. private modules), Apt 24.04 / 26.04 archive + securityowner · TBD
- On-prem pulls over the Shared VPC path measured against today's mirror-nexus path — latency, bandwidth, Apt fleet-patching volumeowner · TBD
- Artifact Analysis coverage, cost and DefectDojo import checkedowner · TBD
- Virtual-repository support per format, and whether org policy can restrict remote upstreamsowner · TBD
- Pilot services named by their teamsowner · TBD
- Decisions recorded — region, Go row, on-prem pull path, historical-copy scopeowner · TBD
32.2Repositories, identity and private access under IaC2027-03-21planned · 0/6
- Standard, remote and virtual repository per format from one Terraform module; image repositories with immutable tagsowner · TBD
- Upstreams defined only in IaC — create/update granted to the Terraform identity alone; virtual repositories resolve internal firstowner · TBD
- Pipelines by workload identity federation, writer on their own repositories only; people by SSO; data-access audit logs onowner · TBD
- Private access — hybrid link on the Shared VPC host project, restricted VIP advertised, on-prem DNS for *.pkg.dev → restricted VIP, VPC-SC perimeter around host and GAR projectsowner · TBD
- On-prem Apt cache with GAR as its only upstreamowner · TBD
- Error-rate and storage alerts in the monitoring platform, and a cost budgetowner · TBD
32.3Retention and registry-side scanning live2027-05-21planned · 0/4
- Cleanup policies run dry first and are checked against the digests running in the clustersowner · TBD
- Version tags never cleaned; commit tags newest-N, never while deployedowner · TBD
- Artifact Analysis on internal-docker, findings into DefectDojoowner · TBD
- Running digests rescanned dailyowner · TBD
32.4Historical artifacts copied2027-07-16planned · 0/3
- Docker images copied by digest; Maven, npm, PyPI and Apt packages re-publishedowner · TBD
- Counts and checksums match Nexus per repositoryowner · TBD
- Delta copy repeatable until the last pipeline cuts overowner · TBD
32.5Pilot pipelines cut over, side by side2027-07-16planned · 0/3
- Pilots cut over — this portal, api-gateway, one Maven and one npm service (final list from 32.1)owner · TBD
- Rollback rehearsed by pointing the registry URL backowner · TBD
- 25.1 base images published to GARowner · TBD
32.6Every pipeline, developer machine and host cut over2028-01-14planned · 0/7
- Every pipeline on GAR, GitLab CI and Jenkins alike — not waiting for 15.3owner · TBD
- mirror-nexus stage retiredowner · TBD
- Developer settings — one URL per format, no --extra-index-url, no GOPROXY …,direct — with an SOP and Office Hourowner · TBD
- CI rejects lockfiles with git or URL dependenciesowner · TBD
- Hosts' Apt sources on the on-prem cache, pushed by Ansible (4.4)owner · TBD
- Forward-proxy allowlist narrowed — public registries and Ubuntu archives no longer reachable directlyowner · TBD
- Final delta copied, then Nexus read-onlyowner · TBD
32.7Nexus retired, minimal NuGet instance left2028-05-19planned · 0/3
- Nexus read-only side by side for at least four weeks, then decommissionedowner · TBD
- NuGet instance minimal, under IaC and backed upowner · TBD
- Its exit condition recorded — GAR supports NuGet, or the unit stops using itowner · TBD
Back to the Platform Roadmap overview · the direction behind these milestones is the Platform Roadmap.