GitOps

Promotion is a Git commit, not a deploy job. You change the production manifests to reference the exact image the staging environment already runs, merge that pull request, and the cluster agent converges production onto it.

App-of-apps is a root GitOps definition whose content is more GitOps definitions: the controller reconciles the root, the root creates the children, and the children deploy the workloads. Adding a component becomes one commit.

That pipeline satisfies two of the four GitOps properties: the desired state is declarative and versioned in Git. It misses the other two, since nothing pulls that state automatically and nothing reconciles continuously, so drift between merges is never seen or corrected.

Under push, the runner holds cluster credentials for every environment, so the attacker gets immediate admin-level access to all of them. Pull removes that credential, but not a poisoned image or a malicious commit, which the in-cluster agent will apply faithfully.

Bootstrapping is the single imperative step that installs the GitOps agent and points it at a Git path. Everything after that, including the agent's own configuration, is reconciled from Git, so a rebuilt cluster converges back automatically.

The agent's next reconcile compares live state against the revision in Git, sees the difference and reports the resource as out of sync. Whether the edit is reverted depends on whether automatic correction is enabled; with detection only, it is reported but left alone.

The controller applies the whole set in one pass, so a custom resource whose CRD is not yet registered is rejected by the API server. GitOps handles this either by retrying until it converges, or by declaring explicit ordering so the CRDs land first.

Applying manifests and keeping the cluster converged move to the agent; CI keeps building, testing, scanning, publishing the artifact and recording the desired state. The pipeline loses synchronous deploy feedback — its job finishes before the change is actually running.

Separating manifests from source keeps automated version bumps from re-triggering builds, lets deployment changes be reviewed and permissioned differently from code, and lets one app deploy to many environments. The cost is that a single logical change now spans two repositories and two pull requests.

Generation removes copy-paste drift and makes onboarding a cluster a one-line commit against an inventory that becomes the source of truth. The cost is blast radius: one template edit changes all 50 clusters at once, and the reviewed diff shows one line rather than fifty rendered manifests.

Git owns only the fields you actually declare. Values written after admission — API-server defaults, injected sidecars, autoscaler-managed replica counts, operator patches — and everything under status have other owners, so you either stop declaring that field or exclude it from the diff.

Deletion (prune) acts on absence, so anything that makes the rendered source look empty — a rename, a wrong path, a branch checkout — reads as an intentional removal. Bound it by scoping ownership narrowly, protecting stateful objects, and never pruning on a render failure.

Environment branches diverge because each carries its own environment-specific values, so every promotion merge conflicts on the same files and drags unrelated changes along. The common alternative is one branch with a directory per environment, where promotion is an explicit edit to the production directory.

Encrypting secrets into Git keeps one source of truth and works for bootstrap, but rotation needs a commit and old ciphertext lives in history forever. An operator fetching from an external manager keeps only a reference in Git, so rotation is external — at the cost of a live runtime dependency.

No. Pull-based delivery needs a reconciling agent for the target's API, which is mature for Kubernetes and rare elsewhere. Mandate it for cluster workloads and keep push with short-lived, narrowly scoped credentials for VMs and serverless.

End-to-end latency is the build and publish time, plus the commit landing in the config repository, plus up to one poll interval before the agent notices, plus apply and rollout. A push notification cuts the detection wait but is lossy, and cluster-side drift raises no repository event at all.

The in-cluster agent makes outbound connections only — to the Git host and the image registry — so no inbound path to the API server is needed at all. You give up synchronous deploy feedback and inbound webhooks, so syncs fall back to interval polling and status must be pushed outward.

Decide on isolation strength, upgrade coupling, and operational cost. A shared control plane gives one inventory and one thing to run but couples every tenant to one version and one failure domain; per-tenant instances give hard isolation at the price of N upgrades and no single view.

Automate the bump into dev, automate staging behind passing tests, and make production an automated pull request that a human approves. Keep environments from diverging by enforcing that only an allowlisted set of keys may differ between overlays, checked on every pull request.