# GitOps

> Running infrastructure by editing files in Git and letting an agent make reality match.

- Level: Advanced
- Topics: Cloud, Software
- URL: https://tidbit.legios.com.ar/gitops/
- In Spanish: [GitOps](https://tidbit.legios.com.ar/es/gitops/)

**GitOps** is a way of operating systems, mostly on Kubernetes, where a Git repository is the single source of truth for what should be running. The repository holds declarative files that describe the desired state: which apps, which container image versions, how many replicas, which settings. To change production you do not run commands against the cluster; you open a pull request, it gets reviewed, and it is merged.

An agent running inside the cluster, such as Argo CD or Flux, watches the repository. When the desired state changes, it pulls the change and applies it. More importantly, it keeps comparing what Git says with what is actually running and corrects any difference, a loop called **reconciliation**. If someone edits something by hand at 3 a.m., the agent notices the drift and puts it back, or at least flags it.

The benefits come from Git itself. Every change has an author, a review and a timestamp, which makes audits and incident reviews much easier. Rolling back is reverting a commit. A whole environment can be rebuilt from the repository. And because the agent pulls from inside, the CI system does not need admin credentials to the cluster. The OpenGitOps project sums it up in four principles: declarative, versioned and immutable, pulled automatically, and continuously reconciled. The costs: secrets need special handling, since they should not sit in Git in plain text, and teams have to get used to never "just fixing it" by hand.

## An analogy

A thermostat. You do not light the boiler yourself; you set the temperature you want, and the thermostat keeps checking the room and correcting it. In GitOps, the repository is the dial and the agent is the thermostat.

## Keep in mind

- Git holds the desired state; the cluster is made to match it.
- An agent like Argo CD or Flux pulls changes and corrects drift continuously.
- Every change is a reviewed commit; rolling back is a revert.
- Secrets and manual fixes need discipline and extra tooling.

## Go deeper

- [OpenGitOps principles](https://opengitops.dev/)
- [Argo CD documentation](https://argo-cd.readthedocs.io/en/stable/)
- [Flux](https://fluxcd.io/)

## Related terms

- [Operating system](https://tidbit.legios.com.ar/operating-system/): The base software that runs a device and lets every app share its hardware.
- [Kubernetes](https://tidbit.legios.com.ar/kubernetes/): The system that runs and babysits containers across many machines.
- [Git](https://tidbit.legios.com.ar/git/): A time machine for code: every change saved, by whom and why.
- [Container](https://tidbit.legios.com.ar/container/): A sealed box with a program and everything it needs to run anywhere.
- [Code review](https://tidbit.legios.com.ar/code-review/): Having another person read a code change before it becomes part of the product.
- [AI agent](https://tidbit.legios.com.ar/ai-agent/): An LLM that can take actions, check the results and keep going until the job is done.
- [Rollback](https://tidbit.legios.com.ar/rollback/): Going back to the last version that worked when a new one causes problems.