GitOps Architecture: Declarative Delivery with ArgoCD & Flux

Traditional CI/CD pipelines use a Push-Based Model: the CI runner inside GitHub Actions or GitLab holds high-privilege cluster admin credentials and connects directly into production Kubernetes clusters to execute kubectl apply. This creates a severe security vulnerability. GitOps flips this paradigm into a Pull-Based Model where a lightweight operator running inside the cluster continuously monitors a Git repository and pulls changes automatically.

Git as the Single Source of Truth

With GitOps, no human developer or external CI runner ever needs write access to production Kubernetes API servers. All cluster changes—scaling pods, changing environment variables, updating container tags—occur via Git Pull Requests.

The 4 Core Principles of OpenGitOps

1. Declarative Descriptions: The entire desired state of the system (deployments, ingress, configmaps, secrets) is declared in declarative YAML manifests.
2. Versioned & Immutable Storage: The desired state is stored in Git, which serves as the single source of truth and provides a full cryptographic commit history.
3. Automated Pull Reconciliations: Software agents (like ArgoCD or Flux) running inside the cluster continuously pull the desired state from Git.
4. Continuous Drift Correction: If someone manually changes a pod replica count via kubectl in production, the GitOps controller detects the divergence and immediately overwrites the cluster back to match the Git commit!

Push-Based CI/CD vs Pull-Based GitOps

Feature	Push-Based CI/CD (GitHub Actions)	Pull-Based GitOps (ArgoCD / Flux)
Cluster Credentials	Cluster admin credentials stored in external CI runner (Security risk).	Credentials never leave the cluster. Internal agent pulls from Git.
Firewall Ingress Ports	Must open inbound cluster firewall ports to external CI runners.	Zero inbound firewall ports opened (only outbound HTTPS to Git).
Drift Detection	None. Once pushed, CI has no idea if someone tampered with the cluster.	Continuous real-time drift detection and self-healing.
Rollback Experience	Requires re-running a complex CI/CD pipeline job.	Run `git revert` on the Git repository; cluster syncs in seconds.

Frequently Asked Questions (FAQ) - Student & Interview Review

Q1. What is an ArgoCD Application CRD?

In ArgoCD, an 'Application' is a Kubernetes Custom Resource Definition (CRD) that connects a specific Git repository and path (the desired state) to a specific target Kubernetes cluster and namespace (the actual state).

Q2. How does GitOps manage sensitive secrets without exposing them in public Git?

GitOps uses encrypted secret operators such as Sealed Secrets (Bitnami) or External Secrets Operator (ESO). Encrypted ciphertexts are safely committed to Git, and a private in-cluster operator decrypts them using cloud KMS or AWS Secrets Manager.

Explore Related Cloud Computing Tutorials & Next Steps

Broaden your enterprise cloud architecture and DevOps expertise across our curriculum:

Kubernetes (K8s) Cluster Architecture

How GitOps controllers watch Kubernetes Custom Resource Definitions (CRDs) to reconcile drift.

Cloud CI/CD Pipelines & Automation

Separate CI container builds from CD deployment by pushing updated manifests to a dedicated GitOps repository.

Hybrid & Multi-Cloud Strategy

Deploy identical application releases simultaneously across on-premises and multi-cloud Kubernetes clusters.

120+ Cloud Computing Interview Questions

Master technical interview questions on GitOps principles, ArgoCD sync waves, and disaster recovery.