TOPIC IAC
GitOps git as the single source of truth for deployments
IN 10 SECONDS
A Git repository holds the desired state of your infrastructure and applications. An operator (ArgoCD, Flux) continuously syncs the cluster to match the repo. Any change is made via pull request — reviewed, merged, then automatically applied. No kubectl on production machines.
GOTCHA Secrets in Git? Never. Use SealedSecrets, External Secrets Operator, or SOPS to encrypt secrets before committing. A GitOps repo should never contain plaintext passwords.
HOW A GITOPS DEPLOYMENT FLOWS
01 Developer opens a PR modifying Kubernetes manifests, Helm values, or Kustomize overlays.
02 CI pipeline lints, validates, and optionally renders the manifests. If checks pass, the PR is merged.
03 GitOps operator polls or is webhook-notified of the new commit on the target branch.
04 Operator diffs the cluster's live state against the new desired state from Git.
05 Operator applies the diff — creates, updates, or deletes resources — and reports back the sync status.
POKE IT YOURSELF
argocd app sync APP_NAME — manually trigger a sync
argocd app get APP_NAME — check sync status and health
Drill this topic →
~75 sec read