Git as your single source of truth

GitOps is an operational framework that applies DevOps best practices used for application development—version control, collaboration, compliance, and CI/CD—to infrastructure automation.

Core principles

Declarative Configuration The entire system is described declaratively. Kubernetes manifests, Terraform modules, and application configs are stored as code.

Version Controlled Git is the single source of truth. All changes go through pull requests with code review, creating a complete audit trail.

Automated Delivery Approved changes are automatically applied to the target environment. No manual kubectl or terraform commands.

Continuous Reconciliation Agents continuously compare actual state with desired state and correct any drift automatically.

<Admonition type="tip" title="GitOps vs Traditional CI/CD"> Traditional CI/CD pushes changes to clusters. GitOps pulls desired state from Git. This "pull" model is more secure (no cluster credentials in CI), enables drift detection, and provides automatic recovery from manual changes. </Admonition>

GitOps Implementation

End-to-end implementation of GitOps practices for your organization.

What's included:

• Architecture Design — Repository structure, branching strategy, environment promotion
• Tool Selection — ArgoCD, Flux, or hybrid approach based on requirements
• Platform Setup — GitOps operators, RBAC, SSO integration
• Migration — Incremental onboarding of existing applications
• Training — Hands-on workshops for development and operations teams

GitOps Assessment

Evaluate your readiness and create a roadmap for GitOps adoption.

Assessment covers:

• Current deployment practices and pain points
• Kubernetes maturity evaluation
• Git workflow and branching strategy review
• Security and compliance requirements
• Team skills and training needs
• Recommended implementation approach

Ongoing GitOps Support

Managed support for your GitOps platform and practices.

Support includes:

• Platform upgrades and maintenance
• Troubleshooting failed deployments
• Performance optimization
• Security patching
• Best practices guidance

We have deep expertise across the GitOps ecosystem. Explore our detailed guides for each tool.

Continuous Delivery

<DetailIconCards>

<a href="/guides/services/gitops/argocd" description="Declarative GitOps CD for Kubernetes with powerful UI and SSO" icon="gear">ArgoCD</a>

<a href="/guides/services/gitops/flux" description="CNCF graduated GitOps toolkit with modular components" icon="gear">Flux CD</a>

<a href="/guides/services/gitops/argo-workflows" description="Container-native workflow engine for CI/CD pipelines" icon="gear">Argo Workflows</a>

</DetailIconCards>

ArgoCD

The most popular GitOps tool for Kubernetes with excellent visualization and enterprise features.

Key capabilities:

• Intuitive web UI for application visualization
• SSO integration (OIDC, LDAP, SAML)
• RBAC with project-based access control
• Multi-cluster deployment support
• ApplicationSets for templating at scale
• Progressive delivery with Argo Rollouts

Learn more →

Flux CD

CNCF graduated project with a modular, composable architecture.

Key capabilities:

• Source controllers for Git, Helm, S3, OCI
• Kustomize and Helm native support
• Image automation and policy enforcement
• Multi-tenancy with GitRepository isolation
• Notification controller for alerts
• Progressive delivery with Flagger

Learn more →

Argo Workflows

Container-native workflow engine for orchestrating parallel jobs on Kubernetes.

Key capabilities:

• DAG-based workflow orchestration
• Parallel execution with fan-out/fan-in
• Event-driven triggers with Argo Events
• Artifact management (S3, GCS, Minio)
• Cron scheduling for recurring workflows
• Integration with ArgoCD for CI/CD

Learn more →

Configuration Management

Tool	Best For
Helm	Templated applications with values overrides
Kustomize	Patch-based customization without templates
Jsonnet	Complex configurations with programming logic
CUE	Type-safe configuration with validation

Secret Management

Secure secrets in GitOps workflows:

• Sealed Secrets — Encrypt secrets for safe Git storage
• External Secrets Operator — Sync from Vault, AWS Secrets Manager, Azure Key Vault
• SOPS — Mozilla's editor for encrypted files with Flux native support
• Vault Secrets Operator — Native HashiCorp Vault integration

<Admonition type="warning" title="Never Commit Plain Secrets"> Plain Kubernetes Secrets are base64-encoded, not encrypted. Always use one of the above tools to encrypt secrets before committing to Git. </Admonition>

Phase 1: Foundation

Repository structure setup

├── apps/
│   ├── base/           # Base manifests
│   ├── overlays/
│   │   ├── dev/        # Development overrides
│   │   ├── staging/    # Staging overrides
│   │   └── prod/       # Production overrides
├── infrastructure/
│   ├── controllers/    # Ingress, cert-manager, etc.
│   └── monitoring/     # Prometheus, Grafana
└── clusters/
    ├── dev/            # Dev cluster config
    ├── staging/        # Staging cluster config
    └── prod/           # Production cluster config

GitOps platform deployment

• ArgoCD or Flux installation
• SSO and RBAC configuration
• Notification setup (Slack, Teams, PagerDuty)

Phase 2: Application Onboarding

Incremental migration strategy:

1. Start with non-critical applications
2. Establish patterns and templates
3. Train teams on new workflows
4. Migrate remaining applications progressively

Environment promotion:

• Automated dev deployments on merge
• Staging promotion via PR
• Production deployment with approvals

Phase 3: Advanced Patterns

Multi-cluster management

• Centralized control plane
• Cluster-specific configurations
• Cross-cluster application deployment

Progressive delivery

• Canary deployments with automatic rollback
• Blue-green deployments
• A/B testing integration
• Feature flags with GitOps

For Development Teams

• Self-service deployments — Deploy without ops tickets
• Faster feedback — See deployment status in Git
• Easy rollbacks — Revert is just a git revert
• Consistent environments — Dev matches prod

For Operations Teams

• Reduced toil — No manual deployments
• Drift prevention — Automatic reconciliation
• Complete audit trail — Every change in Git history
• Disaster recovery — Rebuild from Git

For Security & Compliance

• Policy as code — OPA/Gatekeeper integration
• Mandatory review — All changes require approval
• Immutable audit log — Git history cannot be altered
• Least privilege — No direct cluster access needed

Multi-environment Management

Manage dev, staging, and production with consistent configurations and controlled promotion.

Multi-cluster Deployments

Deploy the same applications across multiple Kubernetes clusters with cluster-specific customizations.

Compliance Requirements

Meet SOC2, HIPAA, and PCI-DSS requirements with complete audit trails and mandatory approvals.

Platform Engineering

Build internal developer platforms where teams can self-service deploy applications safely.

Standard Support

• Business hours support (8x5)
• 4-hour response for critical issues
• Monthly GitOps platform reviews
• Quarterly upgrade planning

Premium Support

• Extended hours support (16x7)
• 1-hour response for critical issues
• Weekly deployment reviews
• Dedicated Slack channel

Enterprise Support

• 24/7 support coverage
• 15-minute response for critical issues
• Dedicated GitOps engineer
• Proactive optimization and training

---

<InfoBlock layout="stack"> <p>Ready to implement GitOps? Start with a free assessment to evaluate your current practices and create a roadmap for adoption.</p> <a href="/guides/services/technology-consulting">Request Assessment</a> </InfoBlock>

• GitOps Implementation Case Study
• Kubernetes Management
• Infrastructure as Code Adoption
• DevOps as a Service

---

Should I use ArgoCD or Flux? ArgoCD offers a better UI and is easier for teams new to GitOps. Flux is more composable and integrates better with Helm and image automation. Both are production-ready—choose based on your team's preferences.

How do I handle environment-specific configurations? Use Kustomize overlays or Helm values files per environment. Store base configurations in one directory, with environment-specific patches in separate overlays (dev, staging, prod).

What happens if someone makes a manual change to the cluster? GitOps agents detect drift and automatically revert manual changes to match the Git-defined state. This ensures your cluster always matches your declared configuration.

How do I handle database migrations with GitOps? Database migrations should be handled separately from application deployments. Use Kubernetes Jobs or init containers triggered by GitOps, but ensure migrations are idempotent and backward-compatible.

Can I use GitOps for non-Kubernetes infrastructure? Yes, tools like Crossplane and Terraform Cloud can be integrated with GitOps workflows to manage cloud infrastructure declaratively from Git.

How do I implement approvals for production deployments? Use Git branch protection rules requiring PR approvals for production branches. ArgoCD also supports sync windows and manual sync requirements for sensitive environments.