GitOps

GitOps #

GitOps is an operational model where Git is the source of truth for infrastructure and application deployment state.

Core principles #

  • Declarative desired state in version control
  • Automated reconciliation by agents/operators
  • Pull-based deployment model for stronger security
  • Full audit trail for all production changes

Benefits #

  • repeatability across environments
  • faster rollback through Git history
  • clear change visibility and compliance traceability
  • improved separation of duties

Reference workflow #

  1. Engineer opens a pull request with infra/app manifest changes
  2. CI validates schema, policy, and security checks
  3. Approved merge updates desired state in Git
  4. GitOps controller reconciles cluster state automatically
  5. Drift detection alerts on out-of-band changes

Tooling options #

  • Argo CD
  • Flux CD
  • Helm + Kustomize overlays for environment composition

Guardrails #

  • branch protection and CODEOWNERS
  • signed commits and image verification
  • policy-as-code (Kyverno/OPA) before and after deploy
  • restricted break-glass procedures for emergencies