Introduction to GitOps & Argo CD
Your Git repository becomes the single source of truth for what runs in production.
You’ve learned to build images, write Kubernetes manifests, and run CI/CD pipelines. But how should changes actually reach the cluster? GitOps answers that with a simple, powerful idea: Git is the source of truth, and a controller continuously makes the cluster match it. Argo CD is the most popular tool for doing GitOps on Kubernetes.
🎯 Learning Objectives
- Understand what GitOps is and its core principles
- See how “push” deployments differ from GitOps “pull”
- Understand what Argo CD does
- Know the key Argo CD concepts: Application, sync, and drift
What is GitOps?
GitOps means managing your infrastructure and deployments declaratively in Git, and using an automated agent to reconcile reality with what’s committed.
The principles:
- Declarative — the entire desired state is described in files (Kubernetes YAML, Helm, Kustomize).
- Versioned & immutable — that state lives in Git, so you get history, review, and rollback for free.
- Pulled automatically — an agent in the cluster pulls the desired state and applies it.
- Continuously reconciled — the agent constantly checks that the live cluster matches Git, and corrects drift.
💡 The one-line definition
GitOps = “the cluster should always look exactly like the Git repo says it should.” If they differ, that’s a bug to be corrected — automatically.
Push vs. Pull Deployments
| Traditional Push | GitOps Pull | |
|---|---|---|
| Who applies changes | CI pipeline runs kubectl apply |
An agent inside the cluster |
| Credentials | CI needs cluster admin creds | Cluster creds never leave the cluster |
| Source of truth | Whatever CI last ran | Git, always |
| Drift detection | None | Continuous |
| Rollback | Re-run an old pipeline | git revert |
Push: CI ──kubectl apply──▶ Cluster (CI holds cluster keys)
Pull: Git ◀──watches── Argo CD (in cluster) ──applies──▶ ClusterThe pull model is more secure (cluster credentials stay inside the cluster) and self-correcting.
What is Argo CD?
Argo CD is a GitOps controller that runs inside your Kubernetes cluster. It watches one or more Git repositories containing your manifests and continuously makes the cluster match them.
It gives you:
- A web UI and CLI showing every app’s sync status and health
- Automatic drift detection — it knows the moment live state diverges from Git
- Automated or manual sync — apply changes automatically or with a click
- Easy rollback — point back at a previous Git commit
Key Concepts
| Concept | Meaning |
|---|---|
| Application | An Argo CD object linking a Git source to a cluster destination |
| Sync | Applying the Git state to the cluster |
| Sync status | Synced (matches Git) or OutOfSync (drifted) |
| Health status | Whether the resources are actually healthy/running |
| Drift | When live cluster state differs from Git |
The mental model: you define an Application, Argo CD compares Git to the cluster, reports Synced/OutOfSync, and (optionally) syncs automatically.
🧪 Hands-on Lab
Push or Pull?
For each scenario, decide whether it describes a traditional push deployment or GitOps pull:
- Someone runs
kubectl edit deploymentdirectly on the cluster. - A controller notices the cluster no longer matches Git and reverts the change.
- A CI job with cluster admin credentials applies manifests at the end of a build.
🧠 Knowledge Check
In GitOps, what is the single source of truth for what runs in the cluster?
Why is the GitOps 'pull' model considered more secure than 'push'?
💼 Interview Preparation
What problems does GitOps solve compared to running kubectl apply from CI?
Summary
You now understand GitOps, how pull-based deployment differs from push, and the role of Argo CD along with its core concepts (Application, sync, drift). Next, you’ll install Argo CD and deploy your first application from Git.