GitOps is an operational model for managing infrastructure and application deployments where a Git repository is the authoritative, single source of truth for the desired state of the entire system. Changes to infrastructure or applications are made by committing to Git — and an automated reconciliation agent continuously ensures that the live system matches the declared state in the repository.
The term was coined by Weaveworks in 2017, but the underlying principle — declarative infrastructure, version-controlled state, automated convergence — builds on decades of infrastructure-as-code thinking.
The GitOps workflow
In a GitOps model: (1) An engineer edits a manifest file (YAML, Helm values, Terraform) and opens a pull request. (2) The PR goes through code review and automated testing. (3) The PR is merged to the main branch. (4) A GitOps controller (such as Flux CD or Argo CD) detects the change and applies it to the live environment. The live system is pulled to match the desired state — not pushed by a deployment script. This pull-based model is more secure because the cluster initiates outbound connections to Git, rather than accepting inbound deployment commands.
Why GitOps matters for compliance
In regulated industries — banking, insurance, healthcare — every change to production infrastructure must be auditable. With a traditional push-based deployment model (kubectl apply from a CI pipeline, or worse, manual changes), the audit trail is incomplete: you can see that a deployment happened, but not always who approved it, what changed, or how to roll it back to a known-good state.
With GitOps, the Git commit history is the audit trail. Every change has an author, a reviewer, a timestamp, and a diff showing exactly what changed. Rollback is a git revert. RBI's requirements for change management and audit logging are satisfied without any additional tooling.
Extending GitOps beyond applications
GitOps can govern more than application deployments. AravaliStack uses GitOps for: infrastructure manifests (cluster configuration, node pools), security policies (OPA rules, network policies), cost budgets (OpenCost budget declarations), ML training jobs (reproducible experiment definitions), and certificate management. When Git is the single control plane, every change to every layer of the platform is auditable, reviewable, and reversible.