GitOps: A Modern Approach to DevOps

TL;DR

GitOps is just one sharp idea: Git is the source of truth for what should be running, and automation is responsible for making reality match that description. Done well, it replaces “kubectl heroics” with audited commits, clear rollbacks, and clusters that quietly correct drift for you.

“If your production state lives in a shell history, you do not have GitOps—you have archaeology.”

Introduction

Most teams arrive at GitOps after one too many “what changed?” incidents.

Someone ran a one‑liner against production “just this once.” It fixed the issue—until the next deploy reverted it, or until no one could remember the fix. Worse, you discover that staging and production no longer match, and releasing has become a trust exercise.

GitOps is a way out of that mess. It does not require new beliefs. It simply insists that:

• Desired state lives in Git.
• Changes happen via commits and pull requests, not ad‑hoc commands.
• Automation, not humans, applies those changes to your clusters.

Once you lean into that, a lot of good things fall out: better audit trails, simpler rollbacks, and less drama.

What is GitOps?

GitOps is a set of practices that rely on:

• Declarative configs: Desired state lives in versioned manifests—YAML, HCL, or similar.
• Automated reconciliation: A controller continuously compares live state to Git and nudges reality toward what Git says.
• Immutable history: Every change is reviewed, traceable, and revertible via normal Git operations.
• Pull-based delivery: Clusters pull approved changes—no long‑lived credentials that allow CI to push into production.

Key Principles of GitOps

1. Everything-as-code: Infrastructure, apps, policies, and even alerting are captured in repositories.
2. Reviewable changes: Pull requests gate production; no silent edits in consoles.
3. Continuous reconciliation: Controllers detect and correct drift, including manual tampering.
4. Strong separation: Build pipelines produce artifacts; GitOps controllers handle deployments.
5. Observability of state: You can answer “what is running and why?” by looking at Git and controller status.

Implementing GitOps

1) Choose Tools and Topology

Popular GitOps tools include:

• Flux: A Kubernetes‑native GitOps tool.
• Argo CD: A declarative GitOps continuous delivery tool for Kubernetes.

Topology patterns:

• App of Apps (Argo CD): Bootstrap multiple apps via a parent manifest.
• Mono vs multi‑repo: Start mono for simplicity; graduate to per‑team repos as you scale.

2) Define Declarative State (Apps + Infra + Policy)

Keep manifests clean, avoid templating overuse, and use overlays per environment. Include policies (OPA/Gatekeeper), RBAC, quotas, and network policies alongside app manifests.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-app
        image: my-app:latest

3) Set Up Continuous Delivery (Pull‑Based)

Configure your GitOps tool to monitor your Git repository and apply changes automatically. CI publishes signed images; Git manifests reference immutable digests; the controller applies changes.

For Flux:

flux bootstrap github \
  --owner=my-github-user \
  --repository=my-repo \
  --branch=main \
  --path=./clusters/my-cluster

4) Observe and Operate

Use dashboards and logs to monitor reconciliation status, health, and drift. Alert on out‑of‑sync apps and controller errors. Establish runbooks for rollbacks: revert commits to restore prior state, and let the controller handle the rest.

5) Security and Compliance

• Immutable artifacts: Pin image digests; sign with Cosign or similar.
• Least‑privilege: The GitOps controller has read‑only access to repos and minimal cluster RBAC.
• Policy-as-code: OPA/Kyverno enforce guardrails on every pull request.
• Audit trails: Pull request comments record approvals and rationale.

Benefits of GitOps

• Consistency: Runtime matches desired state; drift is detected and corrected.
• Auditability: Every change is reviewable and attributable.
• Velocity with safety: Faster changes with guardrails instead of heroics.
• Compliance: Policy enforcement and change tracking simplify audits and evidence gathering.

Conclusion

GitOps is the operating system for modern platform teams. Start small (single cluster, mono‑repo), enforce policies from day one, and evolve topology as you scale. Let Git and controllers do the heavy lifting—your engineers will ship faster, safer, and with less toil, and your clusters will stop depending on whoever remembers the right kubectl incantation.

Stay tuned for more DevOps tutorials and best practices grounded in what actually works in production.