GitOps — cheat sheet
A one-page lookup for the concepts and tools used across this course. Grouped by task; the course pages
cover the why behind each one — this page is just the what.
Core model
| Task |
Reach for |
| Deciding what should be running |
git — the declarative, version-controlled source of truth |
| Applying changes to the target environment |
an in-cluster operator (ArgoCD, FluxCD), not a human or an external pipeline |
| Keeping live state matching git over time |
continuous reconciliation — the operator's ongoing compare-and-apply loop |
Pull vs. push
| Task |
Guidance |
| Deciding who holds deploy credentials |
the operator, inside the target environment — never an external CI runner |
| Recognizing true GitOps vs. "we also use git" |
check for a continuously reconciling operator, not just a git repo somewhere in the pipeline |
| Reducing blast radius of a compromised CI pipeline |
pull-based GitOps — a compromised pipeline can at most merge a reviewable git change, not deploy directly |
| Task |
Reach for |
| Want a visual sync dashboard, manual sync button |
ArgoCD |
| Want composable, API/CRD-driven controllers |
FluxCD (GitOps Toolkit) |
| Progressive delivery (canary, blue/green) alongside GitOps |
Argo Rollouts (with ArgoCD) or Flagger (with FluxCD) |
Drift and rollback
| Task |
Guidance |
| Detecting an out-of-band manual change |
drift detection on the operator's normal reconciliation loop |
| Deciding whether drift is auto-reverted or just flagged |
a configuration choice — know which mode a given environment runs in |
| Undoing a bad deploy |
revert the git commit — the operator reconciles the cluster back automatically |
| Applying an emergency fix under a GitOps-managed cluster |
land it in git (fast-tracked PR if needed) — a manual live patch won't persist |
How this connects
What GitOps is (page 1) establishes git as the declarative source of truth with continuous reconciliation;
pull-based vs. push-based deploys (page 2) covers the credential/trust model that shift buys; ArgoCD and
FluxCD (page 3) covers the two operators that implement the pattern for Kubernetes; drift detection and
rollback by revert (page 4) covers the two operational payoffs — catching out-of-band changes and undoing a
bad deploy with a single git operation.