Guides

What Is GitOps? Beginner Guide with a Real Flow

By Ravindra Bagale, DevOps trainer · LinkedIn · Published: 28 October 2026 · Last updated: 28 October 2026

Store desired Kubernetes state in Git, change it only via PR, let a sync agent apply, detect drift, and roll back with git revert.

Language: English · मराठी · हिंदी

Why GitOps

Auditable, reversible cluster changes.

Why: Snowflake kubectl sessions cannot be replayed. What: Git truth + sync agent. How: PR is the ticket.

Example 1: Desired state in Git

Type this:

mkdir -p /tmp/gitops/apps/web && printf '%s\n' 'apiVersion: apps/v1' 'kind: Deployment' 'metadata: {name: web}' 'spec: {replicas: 2}' > /tmp/gitops/apps/web/deploy.yaml && cat /tmp/gitops/apps/web/deploy.yaml

You will see:

apiVersion: apps/v1

What it means: Git holds what should run — not a wiki guess.

Example 2: PR is the change ticket

Type this:

printf '%s\n' 'ok: every image tag bump goes through a pull request review'

You will see:

ok: every image tag bump goes through a pull request review

What it means: No kubectl edit prod in GitOps land.

Example 12: Definition one-liner

Type this:

printf '%s\n' 'GitOps: Git is source of truth; automated sync makes the cluster match'

You will see:

GitOps: Git is source of truth; automated sync makes the cluster match

What it means: Interview opener.

Concept 1: Sync and drift

Controller applies and detects.

Why: Manual edits fight the agent. What: OutOfSync; heal or educate. How: Least privilege kubecreds.

Example 3: Sync agent idea

Type this:

printf '%s\n' 'Controller compares Git desired state to live cluster and applies the diff'

You will see:

Controller compares Git desired state to live cluster and applies the diff

What it means: Argo CD / Flux are common controllers.

Example 4: Drift detection

Type this:

printf '%s\n' 'If someone kubectl-ed a change, GitOps shows OutOfSync and can heal'

You will see:

If someone kubectl-ed a change, GitOps shows OutOfSync and can heal

What it means: Drift is visible — Infosys audit win.

Example 7: Who can apply

Type this:

printf '%s\n' 'Humans merge PRs; the controller applies — least privilege on cluster creds'

You will see:

Humans merge PRs; the controller applies — least privilege on cluster creds

What it means: Fewer humans with prod kubeconfig.

Concept 2: Promote and roll back

Merges promote; reverts undo.

Why: SSH hotfixes leave no history. What: Overlays/folders; git revert. How: CI updates image tags in Git.

Example 5: Promote via Git

Type this:

printf '%s\n' 'dev overlay → stage → prod folders or branches; merge promotes'

You will see:

dev overlay → stage → prod folders or branches; merge promotes

What it means: Promotion is a merge, not an SSH.

Example 6: Image tag update

Type this:

printf '%s\n' 'sed example: image: registry.example.internal/web:1.4.2'

You will see:

sed example: image: registry.example.internal/web:1.4.2

What it means: CI writes the tag into Git; sync deploys.

Example 8: Rollback = revert commit

Type this:

printf '%s\n' 'git revert the bad tag commit; sync brings old version back'

You will see:

git revert the bad tag commit; sync brings old version back

What it means: History explains every prod change.

Concept 3: Scale and secrets

App-of-apps; sealed secrets.

Why: Cleartext passwords fail audits. What: Root app pattern; external secrets. How: Terraform can be PR-gated too.

Example 9: Not only Kubernetes

Type this:

printf '%s\n' 'GitOps idea also appears for Terraform plans gated by PR — cluster sync is the classic demo'

You will see:

GitOps idea also appears for Terraform plans gated by PR — cluster sync is the classic demo

What it means: Stay focused on K8s sync for this guide.

Example 10: App of apps pattern hint

Type this:

printf '%s\n' 'One root app points at a folder of child apps — team scale pattern'

You will see:

One root app points at a folder of child apps — team scale pattern

What it means: Capgemini multi-team clusters use this.

Example 11: Secrets still special

Type this:

printf '%s\n' 'Do not put raw passwords in Git — sealed secrets / external stores'

You will see:

Do not put raw passwords in Git — sealed secrets / external stores

What it means: GitOps does not mean secrets in cleartext.

GitOps card

1 Desired state in Git 2 PR review 3 Sync agent applies 4 Drift = OutOfSync 5 Rollback = git revert 6 No raw secrets in Git

Suppose: Constant OutOfSync

Someone mutating live; enable auto-heal or stop manual edits.

Suppose: Bad release

Revert the commit; let sync roll back.

Check yourself (quiz)

commit → PR → sync → match → revert if needed. Did you understand? Let us try it once more.