What's the best practice for updating a k8s deployment as part of a cicd pipeline? The container image version atm comes from the config, should it come from an event variable (like the git sha)?