Introduction#
GitOps applies software engineering practices to infrastructure: Git is the source of truth, and automated controllers reconcile the desired state. A practical implementation requires more than just committing manifests; it demands policy controls, promotion workflows, and drift detection.
Repository Structure#
A scalable layout separates application source from deployment definitions:
apps/for application manifests or Helm charts.clusters/for environment-specific overlays.policies/for security and compliance rules.
This separation allows application teams to work independently while platform teams control environment policy.
Promotion Workflow#
Promotions should be a Git operation, not an imperative command. Use pull requests to promote a version through environments.
Recommended flow:
- CI builds an artifact and updates the staging overlay.
- GitOps controller syncs staging and validates health.
- Promotion PR updates the production overlay with the same artifact tag.
Drift Detection and Enforcement#
Controllers should continuously detect drift between desired and actual state. When drift occurs, either reconcile automatically or generate alerts.
A Python validation step can enforce that only approved images are deployed.
1
2
3
4
5
6
7
8
9
import re
import sys
image = sys.argv[1]
if not re.match(r"^registry\.example\.com/.*:v\d+\.\d+\.\d+$", image):
raise SystemExit("Image tag does not follow semantic version policy.")
print("Image tag validated.")
Use this validation in CI to block mis-tagged promotions.
Secrets and Configuration#
Never store secrets directly in Git. Use sealed secrets, external secret operators, or workload identities. Treat secrets as runtime dependencies, not versioned content.
Operational Considerations#
- Enable sync waves to control dependency order.
- Set automated rollback rules when health checks fail.
- Collect telemetry on reconciliation drift and sync errors.
Summary#
GitOps succeeds when Git is the only path to change and the automation enforcing it is observable, policy-driven, and secure. Treat GitOps as a system of controls rather than just a deployment mechanism.