Theory

Updated

October 30, 2026

Theory: Notifications Observe the Loop; Secrets Must Not Live as Plain Desired State

Slack fires on Application events. Secrets need an external system (Sealed Secrets, SOPS, ESO) so Git stays the index of secret references. Blue-green at the Argo CD layer is usually two apps or a Rollouts object.

Invariants

  1. Notification config is itself desired state (or a cluster controller).
  2. Sealed/SOPS ciphertext can live in Git; plaintext must not.
  3. Blue-green without Rollouts is two Destinations or two services.
Application event → notification controller → Slack
Git ciphertext    → controller           → cluster Secret

What can break

  • Base64 secrets in Git called ‘encryption’.

How to read this chapter

Slack, secret strategies, blue-green.