GitOps — Pull-Based Deployment Model

OpenGitOps 4 principles: declarative, versioned+immutable, pulled automatically, continuously reconciled. ArgoCD and Flux implement the pull model — in-cluster agents watch Git and reconcile desired vs actual state.

Overview

Git as the source of truth

GitOps is a set of practices where the desired state of infrastructure and applications lives in Git. An automated operator continuously reconciles actual state to match it.

The four OpenGitOps principles

OpenGitOps (CNCF) defines GitOps through four core principles.

1. Declarative — The whole system state describes WHAT it should look like, not HOW to get there — Kubernetes YAML manifests are declarative; imperative kubectl commands are not GitOps
2. Versioned and immutable — Desired state is stored in Git; every change is tracked, auditable and reversible — No direct cluster changes: everything goes through Git
3. Pulled automatically — Agents inside the cluster pull desired state from Git and apply it — The key difference from push-based CI/CD, where the pipeline runs kubectl apply from outside
4. Continuously reconciled — Agents keep observing actual state and correct any drift — A manual kubectl edit that changes a Deployment in Git is reverted when self-heal is on (a deleted pod is recreated by its ReplicaSet, not by GitOps)

Push vs pull

> [!IMPORTANT] ArgoCD and Flux are the two dominant GitOps operators implementing these principles.

Key concepts

Pull vs Push Model: Push: CI pipeline authenticates to Kubernetes and runs kubectl apply — credentials stored in CI, outside-in. Pull: an agent inside the cluster watches Git and pulls changes — cluster needs no external credentials. Pull model is more secure.
ArgoCD: Declarative GitOps operator for Kubernetes. Watches Git repos, Helm charts, or Kustomize overlays and syncs the cluster. Provides a UI showing sync status, health, and diff. Supports ApplicationSets for managing many clusters.
Flux: CNCF-graduated GitOps toolkit. Modular controllers for Git sources, Helm releases, Kustomizations. More lightweight than ArgoCD; no built-in UI.
Drift Detection: GitOps operator continuously compares actual cluster state to desired state in Git. When drift is detected (manual kubectl change), the operator alerts or automatically reconciles back.

When to use it

Kubernetes deployments requiring auditability, rollback, and drift detection
Multi-cluster environments with a central Git repo as source of truth
Compliance environments requiring every infrastructure change to have a PR review
Platform engineering teams separating application code repos from deployment config repos

Interview questions

What are the four OpenGitOps principles?
How does ArgoCD implement GitOps?