For over a decade, Continuous Delivery (CD) was Push-Based: a CI server (like Jenkins or GitHub Actions) would run kubectl apply or SSH into production servers using a privileged administrative credential stored in CI secrets.
GitOps inverts this paradigm into a Pull-Based, declarative model where Git is the Single Source of Truth for your entire infrastructure and application state.
100%
Rendering interactive visual diagram...
The 4 OpenGitOps Principles
The CNCF OpenGitOps standard defines 4 mandatory principles:
- Declarative: The entire desired state of the system is described declaratively (e.g. Kubernetes manifests, Helm charts, Kustomize overlays).
- Versioned and Immutable: The desired state is stored in version control (Git) with full commit history, audit trails, and cryptographic commit signatures.
- Pulled Automatically: Software agents (like ArgoCD) running inside the cluster continuously pull the desired state from Git.
- Continuously Reconciled: The agent detects any deviation (drift) between desired Git state and live cluster state, and automatically reconciles the cluster back to match Git.
Push vs. Pull CD: Detailed Architectural Comparison
| Dimension | Push-Based CD (GitHub Actions kubectl) | Pull-Based GitOps (ArgoCD) |
|---|---|---|
| Cluster Credentials | Stored externally in CI runner secrets | Kept strictly inside the cluster (zero external exposure) |
| Drift Detection | None (manual kubectl edits go unnoticed) | Continuous real-time detection (alerts or auto-reverts) |
| Rollback Strategy | Run previous CI pipeline build | git revert <commit-hash> (takes 5 seconds) |
| Audit Log | Scattered across CI pipeline run logs | Clean, immutable Git commit log |
| Disaster Recovery | Manual, slow reconstruction | Point ArgoCD to the Git repo on a new cluster |
The Two-Repository Architecture
In production, application source code and deployment manifests are separated into two distinct Git repositories:
100%
Rendering interactive visual diagram...
Why Separate Repositories?
- Prevents CI Infinite Loops: Changing a deployment manifest doesn't trigger a full 20-minute application code build/test cycle.
- Strict RBAC Access: Developers have write access to the App Repo, but only Senior DevOps engineers / automated CI bots have write access to the GitOps Manifests Repo.
- Clean Audit History: The Manifest repo commit log shows exact release history (e.g.
Deploy v1.2.0 to production).