GitOps uses Git as the single source of truth for both application and infrastructure configuration, with automated processes reconciling actual state to match what's declared in Git. This guide covers the core concepts and a practical starting approach.
The Core GitOps Principle
Rather than manually applying changes to infrastructure (running commands directly against production), you commit your desired state to Git, and an automated process ensures the actual running system matches that declared state — Git becomes the audit trail and single source of truth for "what should be running."
How GitOps Differs from Traditional CI/CD
Traditional CI/CD typically pushes changes (a pipeline runs and directly applies changes to servers); GitOps typically pulls — an agent running in your infrastructure continuously checks Git for the desired state and reconciles any drift, rather than an external process pushing changes in.
Building Blocks for a Simple GitOps Approach
See Infrastructure as Code Basics: Managing VPS Config with Terraform and How to Version Control Your Server Configuration — version-controlling your infrastructure configuration is the foundational prerequisite; GitOps adds the automated reconciliation layer on top.
A Simple GitOps Pattern Without Kubernetes
#!/bin/bash
# Runs periodically via cron/systemd timer
cd /opt/infra-config
git pull
ansible-playbook site.ymlA basic GitOps-style pattern: periodically pulling the latest committed configuration and applying it — simpler than full GitOps tooling, but captures the core "Git as source of truth, automated reconciliation" principle.
GitOps for Kubernetes (Where It's Most Commonly Used)
Dedicated GitOps tools designed specifically for Kubernetes continuously monitor a Git repository containing Kubernetes manifests, automatically applying any changes and correcting drift — the most mature and common context where "GitOps" as a formal practice is applied, given Kubernetes' inherently declarative resource model.
Benefits of the GitOps Approach
- Complete audit trail — every infrastructure change has a corresponding Git commit with author, timestamp, and reasoning
- Easy rollback — reverting infrastructure is as simple as reverting the relevant Git commit
- Drift detection — the reconciliation process naturally surfaces any manual, out-of-band changes that diverge from the declared state
Handling Secrets in a GitOps Workflow
See How to Manage Secrets in a CI/CD Pipeline — secrets genuinely shouldn't be committed directly to Git even in a GitOps model; use a proper secrets manager referenced by your configuration, or specialized encrypted-secrets-in-Git tooling designed for this specific GitOps challenge.
Starting Simple
Full GitOps tooling (particularly Kubernetes-specific tools) may be more machinery than a smaller VPS-based setup genuinely needs — the core principle (version-controlled infrastructure config, automated/consistent application of that config) can be adopted incrementally without necessarily needing dedicated GitOps platform tooling for a simpler setup.
When GitOps Formal Tooling Makes Sense
As your infrastructure grows more complex (particularly with Kubernetes, or managing many environments), dedicated GitOps tooling's more sophisticated drift detection, reconciliation, and multi-environment management genuinely earns its additional complexity.
Continue Reading
- Infrastructure as Code Basics: Managing VPS Config with Terraform
- How to Version Control Your Server Configuration
- How to Use Ansible for Server Configuration Management
Browse more articles in DevOps & CI/CD.
