'%3e%3crect%20width='64'%20height='64'%20fill='url(%23fk)'/%3e%3crect%20width='64'%20height='64'%20fill='url(%23bk)'/%3e%3c!--%20Concentric%20radar%20rings%20--%3e%3cpath%20d='M64.0%2014.0A14%2014%200%200%201%2050.0%200.0'%20fill='none'%20stroke='%23fff'%20stroke-opacity='.25'%20stroke-width='1.3'/%3e%3cpath%20d='M64.0%2024.0A24%2024%200%200%201%2040.0%200.0'%20fill='none'%20stroke='%23fff'%20stroke-opacity='.25'%20stroke-width='1.3'/%3e%3cpath%20d='M64.0%2034.0A34%2034%200%200%201%2030.0%200.0'%20fill='none'%20stroke='%23fff'%20stroke-opacity='.25'%20stroke-width='1.3'/%3e%3cpath%20d='M64.0%2044.0A44%2044%200%200%201%2020.0%200.0'%20fill='none'%20stroke='%23fff'%20stroke-opacity='.25'%20stroke-width='1.3'/%3e%3cpath%20d='M64.0%2054.0A54%2054%200%200%201%2010.0%200.0'%20fill='none'%20stroke='%23fff'%20stroke-opacity='.25'%20stroke-width='1.3'/%3e%3c!--%20Thicker,%20high-visibility%20signal%20lime%20arc%20(stroke-width%205.2%20for%20small%20navbar%20display)%20--%3e%3cpath%20d='M54.8%2033.2A34%2034%200%200%201%2030.2%206.5'%20fill='none'%20stroke='%23C8F55B'%20stroke-width='5.2'%20stroke-linecap='round'/%3e%3c/g%3e%3c/svg%3e)
The principles
- The desired state is declared, for example as Kubernetes manifests.
- It is stored in Git and versioned.
- An agent in the cluster pulls changes and applies them.
- The agent keeps correcting drift.
The tools
Argo CD and Flux are two widely used CNCF projects that do this for Kubernetes. They watch a repository and reconcile the cluster with it.
Benefits
- Every change is reviewed and recorded.
- Rollback is a revert.
- Rebuilding an environment is repeatable.
Adding policy
Policy-as-code tools check changes against rules before they are applied, for example blocking images from unapproved registries. Keep secrets out of Git, and use a secrets manager instead.
Sources and further reading
- OpenGitOps. GitOps Principles. opengitops.dev.
- Argo CD. argo-cd.readthedocs.io.
IICTP is a new independent credential and is not ISO/IEC 17024 accredited.