Procedures and measures shall be implemented to securely manage software installation on operational systems.
Controlled & Verified Deployments
Kubernetes software and Helm charts follow a GitOps workflow with restricted permissions, verified sources, and cryptographic signing. ArgoCD enforces consistent desired state across clusters.
Server software and packages are installed only via approved Puppet roles and trusted repositories. OS-level configurations are enforced to prevent unauthorized installations.
Weekly Version Upgrades & Staged Rollouts
With KubeAid Over 50+ applications have version tags updated weekly. These updates are synced using ArgoCD and deployed within defined service windows per cluster, progressing from test → production using versioned, staged rollouts to ensure cluster stability and reliability.
Server updates occur in planned service windows, following versioned staged rollouts from test/validation to production environments to maintain operational stability.
Self hosted Harbor is deployed as a private container registry for clusters, enabling air-gapped operations where Kubernetes nodes do not require direct internet access while still receiving verified, signed images.
LinuxAid provides a repository server for air-gapped operations, automatic snapshots, and GPG-signed packages for servers. Commits are validated on separate runners to prevent malicious code from entering server releases, ensuring a secure, controlled software supply.