Infrastructure as Code
Advanced 14 min read Infrastructure as Code

GitOps Basics

Git is not just history — it's the source of truth

GitOps makes git the single source of desired state: a reconciler (ArgoCD, Flux) continuously syncs the cluster/cloud to what the repo declares, with automatic drift repair and auditable history.

GitOpsArgoCDFluxsyncdriftreconcileapplication repo
Prerequisites: State Management
Before we start

What you will learn

  • Explain the reconciling loop: repo → cluster/cloud drift repair
  • Set up app-of-apps / kustomize / helm-driven sync
  • Establish sync waves, promotion and rollback procedures
In 60 seconds

You commit manifests (YAML/Helm/Kustomize). A controller (ArgoCD/Flux) watches the repo, syncs to the target cluster, and self-heals drift by re-declaring. CI only builds images; CD is the controller.

Introduction

What is this?

Core loop: desired state (git) → controller watch (poll/webhook) → diff vs live → sync (apply/helm) → drift repaired on cadence. Components: app source (path, repo, target revision), destination (cluster/namespace), sync policy (automated + prune + selfHeal), health assessment (kubectl diff). Advanced: sync waves/annotations for ordering, ignoreDifferences, prunePolicy, multi-cluster management (one repo → N clusters via values/kustomize overlays), promote env promotion (branch/per-app promotion across clusters), rollback via `kubectl/ArgoCD rollback` or reverting commit + sync, git-auth (readonly tokens, webhooks).

Motivation

Why do you need it?

  • Everything is reviewable in PRs: the diff IS the change request.
  • Drift self-heals instead of being found on a screen Monday morning.
  • Rollback = revert a commit and let the controller undo reality.
  • Auditability: each infra state has an immutable commit hash attached.
Think about it

Mental model

Imagine

An orchestra playing from the same score, with a conductor who fixes a wrong note

Think of

GitOps reconciliation

The score (git) never changes mid-performance; if a violinist drifts (drift), the conductor (controller) brings them back to the notated note (desired state).

Mechanics

How it works

  • Manifests/kustomize/helmets live in an app repo / folder per environment.
  • Controller watches the branch and prunes/applies per policies.
  • Applied state is compared on every sync (poll or webhook).
  • selfHeal=true reverts any out-of-band mutation to repo truth in the next loop.
  • Promotion = updating the environment's target revision pointer (or branch).

GitOps loop.

Git repo
Controller
Target cluster
Drift
Reconcile
Hands-on

Examples

ArgoCD Application (declarative sync)

ArgoCD Application (declarative sync)
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata: { name: checkout, namespace: argocd }
spec:
  destination: { server: "https://kubernetes.default.svc", namespace: prod }
  source:
    repoURL: https://github.com/acme/manifests
    path: envs/prod
    targetRevision: main
  syncPolicy:
    automated: { prune: true, selfHeal: true }

Point an application at a git path; reconciliation, pruning and self-healing become declarative policies.

Real world

In production

  • App promotions: env manifests in git, ArgoCD syncs prod only from approved PR state.
  • Multi-cluster: one repo, per-cluster overlays, one controller pair per cluster.
  • Terraform data: GitOps for workloads + IaC backend for provisioning — complementary, not rivals.
Guidelines

Best practices

  • Keep secrets out of the app repo (external-secrets/SealedSecrets/helm-value schemes).
  • Use prune + selfHeal carefully with clear blast-radius; start prune with a dry-run diff.
  • Store promotion as a commit for full provenance (branch per env or reference).
  • Set ignoreDifferences for expected runtime mutations (replicas drift by HPA).
  • Use webhooks for immediate sync; polling as fallback for isolated control-plane.
Watch out

Common mistakes

  • gitops-loader but manual kubectl edits (selfHeal off forever) → drift already happened.
  • Baking env secrets into the app repo (the leak you'll meet again).
  • prune:true without a review habit → a wrong manifest deletes real workloads.
  • Applying git changes to the live pointer but never committing the promotion.
When things break

Debugging tips

  • App 'OutOfSync' → compare repo diff vs live with the tool's diff view.
  • Sync stuck → check the controller logs and the health of the target namespace object.
  • selfHeal reverting HPA scale → add ignoreDifferences on that field or manage HPA in git.
  • Promotion 'didn't take' → verify the targetRevision ref and that the branch advanced past commit.
Interviews

Interview checkpoint

Practice

Hands-on lab

Sync a Cluster from Git and Watch Self-Heal
45 min · advanced
In progress
Objectives
  • Install Argo CD (or Flux) on a local cluster
  • Register an app pointed at a git repo
  • Make an out-of-band edit and watch selfHeal repair it

Sync a Cluster from Git and Watch Self-Heal

45 min · advanced

0/4 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/2
1

Which flag makes the controller delete out-of-spec resources on sync?

2

GitOps' core invariant is:

Go deeper

Official documentation

Argo CD docs
docs
Flux v2
docs
GitOps principles
spec