DevOps6 min read

GitOps

Implement GitOps with ArgoCD and Flux - Git as the single source of truth for Kubernetes deployments, automated reconciliation, and drift detection.

GitOpsKubernetesArgoCDFluxContinuous Delivery

skill: GitOps category: DevOps tags: [GitOps, Kubernetes, ArgoCD, Flux, Continuous Delivery] readingTime: 6

GitOps means the desired cluster state lives entirely in Git - operators declare what they want, and the GitOps controller continuously reconciles actual state to match. The benefit: every change is auditable (git blame), rollback is git revert, and manual kubectl changes are automatically undone (drift correction).

Workflow

Set up ArgoCDArgoCD watches Git repositories and continuously syncs Kubernetes resources to match. Every git commit triggers a deployment - no CI system needs kubectl access.
Structure the GitOps repositoryA well-structured GitOps repo makes it clear what's deployed where. Separate infrastructure (cluster-wide) from applications (team-specific).
Use Kustomize for environment overlaysKustomize patches base manifests for each environment without duplicating YAML - staging has 1 replica at a smaller instance, production has 5.
Update image tags with CICI builds and pushes a new image, then updates the image tag in the GitOps repo - ArgoCD sees the git change and deploys automatically.
Implement progressive delivery with Argo RolloutsProgressive delivery reduces deployment risk - canary releases send 10% of traffic to the new version before full rollout, with automatic rollback on error rate increase.

Output Format

GitOps: ArgoCD Application with automated sync + selfHeal, Kustomize overlays per environment, CI updates image tag via git commit, Argo Rollouts for canary with Prometheus analysis.

ArgoCD Application: syncPolicy.automated { prune: true, selfHeal: true }
Kustomize: base + overlays/{staging,production}
CI: kustomize edit set image + git commit → ArgoCD auto-deploys
Rollout: canary steps (10% → analysis → 50% → 100%)

Examples

Input

Output

Edge Cases & Gotchas

Secret management in GitOps - Secrets cannot go in the GitOps repo in plaintext. Use External Secrets Operator (pulls from AWS Secrets Manager/Vault), Sealed Secrets (encrypts for git), or Vault CSI Provider.
ArgoCD app-of-apps - Use the app-of-apps pattern: one ArgoCD Application manages all other Application manifests stored in git, so ArgoCD itself is GitOps'd.
Syncing CRDs before dependent resources - CRDs must be applied before resources that use them. Use sync-wave annotations to control apply order: argocd.argoproj.io/sync-wave: "-1" for CRDs.
Rollback strategy - GitOps rollback = git revert + push. ArgoCD detects the revert and re-syncs to the previous state. Much faster and more reliable than kubectl rollout undo.

When to Break These Rules

Use simpler deployment scripts (helm upgrade, kubectl apply) for small projects or solo teams - GitOps adds repository structure overhead that's not worth it below a certain team size.
Use Spinnaker or a full CD platform instead of ArgoCD when you need multi-cloud deployment, advanced canary strategies across non-Kubernetes targets, or complex approval workflows.

Reference Files

https://argo-cd.readthedocs.io/en/stable/
https://fluxcd.io/docs/