$ run as a normal user# run as root (or with sudo)
Know the four principles
The OpenGitOps project defines GitOps in four rules.
| Principle | Meaning |
|---|---|
| Declarative | The whole system is described as wanted state (YAML, Helm, Kustomize) |
| Versioned and immutable | That state is stored in Git, with full history |
| Pulled automatically | An agent pulls the state from Git; no push from outside |
| Continuously reconciled | The agent checks again and again, and fixes drift |
Compare push and pull deployments
Classic CI/CD pushes into the cluster from outside. GitOps pulls from inside.
| Push (CI runs kubectl/helm) | Pull (GitOps agent) | |
|---|---|---|
| Cluster credentials | Stored in CI | Stay in the cluster |
| Drift (manual changes) | Not noticed | Found and fixed |
| Audit trail | CI logs | Git history = every change |
| Rollback | Re-run an old pipeline | git revert |
Remember
In GitOps, CI still builds and tests the image; it only updates the image tag in the config repository. The agent does the deployment.
Know the main tools
Two CNCF graduated projects lead GitOps on Kubernetes.
| Tool | Strengths |
|---|---|
| Argo CD | Web UI, Application objects, app-of-apps, ApplicationSets, SSO and RBAC |
| Flux | Small, CLI-first, Kustomize and Helm controllers, image automation |
Both reconcile Git (or OCI artifacts, Helm repositories) into clusters. Pick one per platform.
See the benefits for security
GitOps is also a security control.
- No admin credentials in CI or on laptops — fewer keys to steal.
- Every change is reviewed (branch protection) and signed (signed commits).
- Drift is reverted: a manual "quick fix" or an attacker's change does not survive.
- Disaster recovery: point a new cluster at the repository, and it rebuilds itself.