KCNA — GitOps Principles
GitOps Principles
GitOps is a modern approach to continuous delivery that uses Git as the single source of truth for both application code and infrastructure configuration. It’s a core KCNA exam topic.
What Is GitOps?
GitOps applies DevOps best practices — version control, collaboration, compliance, and CI/CD — to infrastructure automation.
The core idea: The desired state of your system is stored in Git. An automated agent ensures the actual state matches the desired state.
Git Repository (Desired State)
│
▼
GitOps Agent
(ArgoCD/Flux)
│
Reconciliation
Loop (compare)
│
▼
Kubernetes Cluster (Actual State)
The Four Principles of GitOps
(Defined by the OpenGitOps project, a CNCF Sandbox project)
1. Declarative
The entire system is described declaratively — YAML manifests, Helm charts, Kustomize overlays.
2. Versioned and Immutable
The desired state is stored in Git — providing full version history, audit trail, and the ability to roll back to any previous state.
3. Pulled Automatically
Software agents (ArgoCD, Flux) automatically pull the desired state from Git and apply it to the cluster.
4. Continuously Reconciled
Agents continuously monitor the actual state and reconcile any drift back to the desired state in Git.
Push vs Pull Deployment
Push-Based (Traditional CI/CD)
Developer → Git → CI Pipeline → kubectl apply → Cluster
(push)
- CI pipeline has cluster credentials
- Pipeline pushes changes to the cluster
- Security risk: credentials stored in CI system
Pull-Based (GitOps)
Developer → Git → GitOps Agent (in cluster) → Reconcile → Cluster
(pull from Git)
- GitOps agent runs inside the cluster
- Agent pulls changes from Git — no external system needs cluster access
- More secure: credentials stay in the cluster
| Aspect | Push-Based | Pull-Based (GitOps) |
|---|---|---|
| Who applies changes | External CI system | In-cluster agent |
| Credential location | CI system (external) | Inside the cluster |
| Drift detection | None | Continuous reconciliation |
| Rollback | Rerun pipeline / manual | git revert |
| Audit trail | CI logs | Git history |
GitOps Workflow
1. Developer creates a Pull Request with manifest changes
2. Reviewer approves and merges the PR
3. GitOps agent detects the change in Git
4. Agent compares Git state (desired) with cluster state (actual)
5. Agent applies changes to reconcile the difference
6. Cluster now matches Git
Handling Drift
If someone manually changes the cluster (e.g., kubectl edit), the GitOps agent will:
- Detect the drift between Git and the cluster
- Revert the manual change to match Git
- Git always wins — it’s the source of truth
This prevents configuration drift and ensures consistency.
Repository Strategies
Single Repository (Monorepo)
Application code and Kubernetes manifests in the same repo.
my-app/
├── src/ # Application code
├── Dockerfile
└── k8s/ # Kubernetes manifests
├── deployment.yaml
└── service.yaml
Pros: Simple, everything in one place
Cons: Application changes trigger infrastructure pipelines
Separate Repositories
Application code in one repo, Kubernetes manifests in another.
my-app-code/ my-app-config/
├── src/ ├── base/
├── Dockerfile │ ├── deployment.yaml
└── tests/ │ └── service.yaml
└── overlays/
├── dev/
├── staging/
└── production/
Pros: Clean separation, different access controls, CI triggers only app builds
Cons: More repositories to manage
The separate repository approach is generally recommended for GitOps.
Key Benefits of GitOps
| Benefit | Description |
|---|---|
| Audit Trail | Every change is tracked in Git history — who, what, when, why |
| Rollback | git revert to undo any change — fast, reliable rollbacks |
| Consistency | Cluster always matches Git — no manual drift |
| Security | No external system needs cluster credentials |
| Collaboration | Pull Requests for infrastructure changes — code review for ops |
| Disaster Recovery | Re-create the entire cluster from Git in minutes |
KCNA Exam Tips
- GitOps uses Git as the single source of truth for desired state
- Know the four principles: Declarative, Versioned, Pulled Automatically, Continuously Reconciled
- Pull-based deployment (GitOps) is more secure than push-based — credentials stay in the cluster
- GitOps agents detect and fix drift — manual changes are reverted
- ArgoCD and Flux are the two main GitOps tools (both CNCF Graduated)
- Rollback =
git revert— the cluster automatically reconciles - OpenGitOps is a CNCF Sandbox project that defines GitOps principles
What’s Next?
Learn about Helm — the package manager for Kubernetes.
