The GitOps discipline — the synthesis

GitOps is a discipline. The discipline is the consistent application of a small number of choices across every controller, repository, cluster, and promotion. A team that has chosen cluster-admin, prune without diffs, plaintext secrets, no self-heal, and a single repo has adopted the controller and abandoned the discipline.

The five choices as one architecture

The five anti-patterns in this part and their fixes compose.

    flowchart TB
        subgraph Controller
            A1["Scoped ServiceAccount per project"] --> A2["Per-cluster controllers"]
            A2 --> A3["AppProject with sourceRepos and destinations"]
        end
        subgraph Sync
            B1["Dry-run diff paired with sync"] --> B2["Sandbox for first prune"]
            B2 --> B3["Prune=false override for hotfix"]
        end
        subgraph Secrets
            C1["No plaintext in repo"] --> C2["Sealed Secrets or SOPS or External Secrets"]
            C2 --> C3["Pre-commit, CI, forge scanning"]
        end
        subgraph Drift
            D1["Self-heal enabled"] --> D2["IgnoreDifferences for legitimate fields"]
            D2 --> D3["Reconciliation budget alert"]
        end
        subgraph Promotion
            E1["Per-environment AppProject"] --> E2["Per-cluster controllers"]
            E2 --> E3["Promotion-by-ref with reviewable PR"]
        end
        Controller --> Sync
        Sync --> Secrets
        Secrets --> Drift
        Drift --> Promotion
        Promotion --> Controller

The architecture has five components and four seams:

• Controller and Sync. A cluster-admin controller applied to a prune-enabled Application with no diff is a controller that can delete any resource in any cluster.
• Sync and Secrets. A controller that holds the SOPS key on a cluster-admin ServiceAccount is a controller whose key compromise is a secret compromise.
• Secrets and Drift. A controller that decrypts a secret but does not self-heal reports the divergence but does not reconcile.
• Drift and Promotion. A controller that self-heals production against a single-repo source promotes every change to production.

The discipline, not the tools

The discipline is independent of the controller. Argo CD, Flux, and the OpenGitOps standards implement the same discipline.

The discipline has four properties that any implementation must satisfy:

• The repository is the source of truth.
• The controller reconciles the cluster to the repository. Self-heal is the default.
• The controller’s privilege is the minimum the manifests require.
• The promotion flow crosses each environment boundary explicitly.

A controller that does not satisfy all four is a sync engine with a privilege boundary the team has not tested.

The retrofit path

A team adopting the discipline on an existing platform faces the cost of every fix in this part.

    flowchart LR
        A["Inventory the current state"] --> B["Encrypt or reference the secrets"]
        B --> C["Scope the controllers per project"]
        C --> D["Enable diffs and sandboxes for prune"]
        D --> E["Enable self-heal with IgnoreDifferences"]
        E --> F["Adopt promotion-by-ref"]
        F --> G["Run a reconciliation budget"]

The order is deliberate. Inventory first. Secrets second.

Each step has a transition window. The team operates the old and new in parallel.

The trade-offs

The discipline imposes four costs:

• Operational complexity. Per-environment AppProjects, per-cluster controllers, promotion-by-ref.
• Promoter latency. Promotion-by-ref is slower.
• Tool discipline. Pre-commit hooks, CI scans, drift alerts.
• Vendor lock-in by principle.

The trade-offs are not avoidable. Each case of pragmatism overriding the discipline is logged and reviewed.

Production discipline

1. The five choices are made together.
2. The discipline outlives the controller.
3. The retrofit is incremental.
4. Pragmatism is logged.

Cross-course references

• This course, Part CI (GitOpsAnti-patterns) - the five anti-patterns.
• This course, Part CXVI (Governance) - the review process.

Quiz