GitOps
GitOps extends Infrastructure as Code by making a Git repository the canonical, immutable source for both application manifests and infrastructure configuration. A GitOps operator continuously compares the live system against the state declared in Git, automatically remediating any divergence.
The Four Principles (OpenGitOps)
- Declarative — Desired system state expressed in declarations, not imperative scripts
- Versioned & Immutable — State stored in Git with complete history and rollback capability
- Pulled Automatically — Software agents pull desired state rather than CI pushing into production
- Continuously Reconciled — Agents actively enforce desired state and alert on drift
Primary Tools
ArgoCD and Flux are the two dominant GitOps operators for Kubernetes. Both watch Git repositories and synchronise cluster state, but differ in architecture: ArgoCD uses a centralised UI and server, while Flux operates as a set of composable controllers.
Security Advantage
Because deployments are pull-based, production clusters never require inbound CI/CD credentials. The GitOps operator pulls from the repository — CI never pushes directly into the cluster — substantially reducing the blast radius of a compromised pipeline.
Ready to put this into practice?
Our team has deployed these architectures across 100+ client engagements.