Does the CMDB still matter when software ships every day?

The short answer

1. The CMDB records the durable things: services, owners, clusters, deployments and dependencies. The platform and observability tools hold the fleeting ones: pods, containers and instances.
2. The pipeline is the change record. Each deployment creates its own record with the evidence attached: who reviewed the code, which tests passed, which version went where.
3. Approval moves from people to policy. Peer review, automated checks and live health checks decide whether a change proceeds or rolls back. People set the policy and handle the exceptions.

Why the old way of filling the CMDB breaks

Mirroring every container into the CMDB produces records that are stale before anyone reads them, and buries the records that matter.

What to keep in the CMDB

The bridge is consistent labels: the same service, team and environment labels on platform objects, in telemetry and in the CMDB let any container be traced back to its service without becoming a record itself.

The health basics still apply to the durable layer: named owners, accurate records, mapped dependencies and links to change and incident.

Check your CMDB's health →

Change, redesigned

DORA, the long-running research program on software delivery, found that formal external approval, such as a change advisory board or senior-manager sign-off, has a negative impact on delivery performance, and found no evidence that it lowers change failure rates. Its recommendation: peer review during development, backed by automation, with the change board moving from gatekeeper to process architect.

Source: DORA, Streamlining change approval

ITIL 4 made the same turn. It renamed the practice change enablement and uses delegated change authority, so a team can approve its own low-risk changes.

Source: ServiceNow, Modernizing ITSM with ITIL 4: change enablement (2023)

• Most deployments become standard changes: the pipeline, its tests and its rollback are approved once, and each run is recorded.
• The pipeline writes the change record and attaches the evidence; service management tools can now auto-approve, auto-reject or route each one by policy.
• Risk decides who looks: a schema change, a payment flow or a regulated system goes to a named approver.
• The change board reviews the system, not each change: failure rates, near misses and the rules themselves.

Where approvals live now

Progressive delivery tools can run the last check on their own: they query live metrics during a canary or blue-green release and abort and roll back when a success condition fails.

Source: Argo Rollouts documentation, Analysis and progressive delivery

Error budgets work like market circuit breakers

US stock markets halt trading when the S&P 500 falls 7%, 13% or 20% from the prior close: a 15-minute pause at the first two levels (if before 3:25 p.m. Eastern) and a halt for the rest of the day at the third. Nobody debates the halt in the moment; the thresholds were agreed in advance.

Source: NYSE rule filing on market-wide circuit breakers, SEC Release 34-88402

An error budget works the same way. A service-level objective, for example 99.9% of checkout requests succeeding over four weeks, defines how much unreliability is acceptable; the remaining 0.1% is the budget. Google's published example policy says that when a service has spent its budget for the preceding four weeks, changes and releases stop except urgent fixes and security patches, and resume once the service is back within its objective. The same policy says it is not a punishment.

Source: Google SRE Workbook, Example error budget policy

Where the comparison stops

• Budgets are per service, not market-wide.
• They only work if the objective measures what users feel.
• They need leadership to honor the freeze when a feature is late.

Where does your operation stand? Posture check →

Regulated industries

Pharma, medical device and healthcare teams still need documented approval and traceability for systems that touch product quality or patient data. The guidance has moved toward this model: the second edition of GAMP 5, the industry guide to computerized system validation, says the life cycle is not inherently linear, supports Agile methods, encourages automated testing and traceability, and covers continuous integration and deployment tools.

Source: ISPE, What you need to know about the GAMP 5 Guide, 2nd Edition

In practice: separate validated systems from the rest, keep a named quality approver in the flow for validated systems, and let the pipeline produce the evidence. Your quality team decides what counts as a regulated change.

Questions to ask your team

1. What share of our changes are standard, pre-approved changes today?
2. Does every deployment create a change record automatically, with its evidence?
3. Which changes still wait for a board, and how long do they wait?
4. Do our most important services have objectives and an agreed error budget policy?
5. When something breaks, can we see within minutes which change caused it?
6. What does our CMDB record for container platforms, and is anyone using those records?

How we help

We work with your teams to decide what the CMDB should hold, redesign change approval around the pipeline, and set objectives and error budget policies that people trust. You choose the tools; we help them work together.

Sources

1. DORA, Streamlining change approval. https://dora.dev/capabilities/streamlining-change-approval/
2. ServiceNow, Modernizing ITSM with ITIL 4: change enablement (2023). https://www.servicenow.com/blogs/2023/itsm-itil-4-change-enablement
3. Argo Rollouts documentation, Analysis and progressive delivery. https://argo-rollouts.readthedocs.io/en/stable/features/analysis
4. NYSE rule filing on market-wide circuit breakers, SEC Release 34-88402. https://www.sec.gov/files/rules/sro/nyse/2020/34-88402.pdf
5. Google SRE Workbook, Example error budget policy. https://sre.google/workbook/error-budget-policy/
6. ISPE, What you need to know about the GAMP 5 Guide, 2nd Edition. https://ispe.org/pharmaceutical-engineering/january-february-2023/what-you-need-know-about-gampr-5-guide-2nd-edition

Checked Oct 14, 2026.