Changes to information processing facilities and information systems should be subject to change management procedures.
All changes flow through Git Pull Requests with enforced two-reviewer approval. Branch protection rules prevent direct commits. Every change is version-controlled, auditable, and traceable through Git history.
Changes are tested and verified in staging environments via Argo CD before production promotion.
Non-critical environments auto-sync from Git. Critical environments require manual sync via Argo CD.
Non-critical environments auto-sync changes directly from Git, while production deployments require manual approval through Argo CD. Sealed secrets are an exception, which are auto-synced to prevent service disruption during application updates.