DevOps has matured significantly over the past decade. As more organizations adopt a DevOps mindset, the ecosystem around it keeps expanding — DevSecOps, AIOps, SecOps, and more. GitOps is one of the newer concepts emerging from this space.

At its core, GitOps enables developers to use Git to create CI/CD pipelines that automate development and operations across multi-cloud and multi-cluster container orchestration environments.

1. How GitOps Fits Into DevOps

Most engineers are already familiar with DevOps, so let's skip the basics and focus on where GitOps fits in.

GitOps is a technique integrated into the DevOps lifecycle. Originally, it was a method for storing, managing, and retrieving deployment descriptors for container orchestrators like Kubernetes and Docker Swarm. Today, it has expanded to cover:

• IaC documents — Terraform, CloudFormation
• Software configuration — Ansible, Puppet
• Application definitions — Helm, Kustomize
• Any declarative config that can live in a Git repo

Think of GitOps as the deployment and operations layer of the DevOps lifecycle — specifically optimized for cloud-native, declarative environments.

2. The Two GitOps Deployment Models

GitOps has two implementation strategies: Push-based and Pull-based. Understanding the difference is critical.

2.1 Push-Based Deployment

Code Change → CI Pipeline → kubectl apply → Cluster

In Push mode, an external system (your CI pipeline) has credentials to access the cluster and pushes changes directly after a code change triggers it.

Characteristics:

• Acts as a "god view" — the CI system has broad cluster access
• Triggered by code changes only
• ⚠️ If someone manually modifies cluster config, drift goes undetected
• ⚠️ Cluster credentials must live outside the cluster (in CI) — security risk

2.2 Pull-Based Deployment

Code Change → Git Repo ← Agent polls → Cluster self-updates

In Pull mode, an agent running inside the cluster periodically polls the Git repo. When it detects a difference between the desired state (Git) and the actual state (cluster), it automatically reconciles.

Characteristics:

• Leverages in-cluster permissions — no external credentials needed
• Continuously monitors for drift, not just on code change triggers
• ✅ Manual cluster changes are automatically detected and reverted
• ✅ Git remains the only way to change cluster state

Push vs Pull — Side by Side

Bottom line: Push is simpler to set up. Pull is safer and more resilient. For production Kubernetes environments, Pull-based GitOps is the recommended approach.

3. GitOps Is One Way to Implement DevOps

It's important to be clear: GitOps is not a replacement for DevOps — it's one implementation path within it.

GitOps uses Git as the single source of truth and combines it with tools like Flux CD or Argo CD to achieve continuous deployment. But the full DevOps lifecycle covers much more:

• Continuous Build
• Code Scanning & Quality Gates
• Unit & Integration Testing
• Continuous Deployment ← this is where GitOps lives
• Logging, Monitoring & Alerting

GitOps handles the CD layer exceptionally well. For everything else, you still need a broader DevOps toolchain.

4. The Full GitOps Toolchain

GitOps emerged later than DevOps, which means its toolchain is newer and more cloud-native by design. Here's what a complete GitOps stack looks like in practice:

Each layer is replaceable — the key is that Git sits at the center, and every change flows through it.

5. Summary

GitOps doesn't replace DevOps — it sharpens it for cloud-native environments. If your team is running Kubernetes in production and still relying on Push-based deployments with credentials scattered across CI systems, GitOps Pull mode is worth a serious look.

Next in this series: GitOps Continuous Delivery — Immutable Infrastructure & Declarative Orchestration (Part 3)

Follow the series for upcoming hands-on articles on Tekton pipelines and Argo CD application management.