hushrun and Kargo
Updated
Kargo manages how new versions move through stages in a GitOps setup, with an agent such as Argo CD doing the deploy. hushrun runs in the CI you already have, and deploys the artifact staging validated, by digest, when signed evidence says the same files passed. Kargo suits Kubernetes teams on GitOps. hushrun suits teams whose deploys live in CI.
| Kargo | hushrun | |
|---|---|---|
| Where it runs | A controller on Kubernetes | A CLI inside your CI jobs |
| What it moves | Freight: versions of images, config and charts | Images, copied by digest |
| Who deploys | An agent such as Argo CD | Your CI's deploy step |
| What triggers a promotion | Stage policies and verification | A plan for the files' digest |
| Evidence | Verification results in Kargo | Signed events in an append-only log |
| Skips repeated checks | No | Yes |
How Kargo works
In Kargo's model, a Warehouse watches for new versions and produces Freight, and Stages are the targets Freight moves through. Deployment stays with an agent such as Argo CD.
How hushrun differs
- No cluster needed. hushrun runs in GitHub Actions or GitLab CI, and deploys however your workflow does.
- It starts from the code. A source digest of the files tells it that
mainholds whatdeveloptested, even though the commits differ. See Source digests and scopes. - It removes repeated checks and builds. A stage's plan runs only what's left for that digest, and it can end in six modes, from
promotetoblocked. - Each step is signed.
hushrun verifyshows who signed every event of a digest.
Which to choose
- Choose Kargo if you already run Argo CD and manage environments through GitOps.
- Choose hushrun if your deploys run from CI, or you're not on Kubernetes.