There's a moment every platform team hits: Argo CD is syncing beautifully, deployments are declarative, and yet moving a release from dev to staging to production still means a human editing a values file and hoping. The deployment problem is solved; the promotion problem isn't.
In this article, I want to walk through how we close that gap on AWS: separate EKS clusters per environment, ECR as the registry, OIDC federation everywhere instead of static credentials, ApplicationSets instead of copy-pasted manifests, and — critically — automated verification gates backed by real metrics before anything gets promoted.
This is the architecture my team runs variations of in production, and the reasoning behind each decision.
The core idea: promotion is a Git commit, not a deployment
Before touching any tool, it's worth being precise about what "promotion" means in a GitOps world.
