In this lesson, you will learn how to transition from imperative deployment commands to a declarative model where your Git repository acts as the authoritative record for your cluster's desired state.
Moving Beyond Imperative Deployments
In traditional CI/CD workflows, you might execute kubectl apply or Helm upgrade commands directly from a pipeline runner. While functional, this creates a "drift" risk: the actual state of your Kubernetes cluster depends on the history of execution logs rather than a clear, static definition. If a manual change is made via kubectl edit, your CI/CD system remains unaware, leading to configuration drift and audit gaps.
GitOps solves this by treating the Git repository as the Single Source of Truth. Instead of your pipeline "pushing" changes to the cluster, an agent running inside the cluster continuously observes the Git repository and "pulls" the desired configuration, reconciling the cluster state to match the code.
The GitOps Loop
By adopting this pattern, your Git repository contains the full declarative state of your infrastructure and applications. Consider a directory structure representing your environment:
# environments/production/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: web-app
spec:
replicas: 3
template:
spec:
containers:
- name: web-app
image: my-repo/app:v1.2.0
When you merge a pull request changing the replicas to 5, the GitOps controller detects the divergence between the current cluster state and the new Git commit. It automatically triggers a rollout. Because your audit trail is now strictly tied to Git commits—which you have already configured to require Signed Commits—you gain a perfect, immutable history of every change applied to your environment.
This architecture ensures that if someone manually alters a resource, the GitOps controller will immediately overwrite the unauthorized change, forcing the cluster back into alignment with your version-controlled specification. You no longer manage infrastructure; you manage the declaration of what the infrastructure should be.
Key Takeaway: By designating Git as the exclusive source of truth, you eliminate manual configuration drift and ensure that your infrastructure state is always transparent, auditable, and reproducible.