{ "schema": 1, "slug": "gitops", "title": "GitOps", "full_name": "GitOps Engineering", "category": "Delivery & Automation", "tagline": "Run apps, clusters and cloud infrastructure from Git with Argo CD, Flux and continuous reconciliation.", "summary": "A focused specialist path for engineers who already know Kubernetes basics: OpenGitOps principles, Kustomize and Helm, Argo CD and Flux in depth, progressive delivery and promotion, secrets and policy, fleet management and GitOps for infrastructure with Crossplane and OpenTofu controllers.", "description": "GitOps is an operating model in which the desired state of a system is declared in version control and software agents continuously pull and reconcile it. The four OpenGitOps principles (declarative, versioned and immutable, pulled automatically, continuously reconciled) turn every change into a reviewed commit, every rollback into a revert, and every manual edit in the cluster into detectable drift.\n\nIn 2026 GitOps is the default way to deliver to Kubernetes. CNCF's 2025 end user survey found Argo CD running in nearly 60% of respondents' clusters, Flux has added OCI artifacts, Helm 4 support and an operator with an MCP server for AI-assisted troubleshooting, and the frontier has moved to environment promotion, supply chain verification, fleet-scale operations and reconciling cloud infrastructure with Crossplane and OpenTofu controllers.\n\nThis path assumes you can already deploy and debug workloads on Kubernetes. It goes far deeper than the GitOps stage of the DevOps path and is a core skill set for platform engineering, where GitOps is often the delivery engine behind golden paths. Expect to work hands-on with both Argo CD and Flux so you can choose the right tool for each context.", "icon": "merge", "accent": "#F97316", "level": "Intermediate → Expert", "duration_weeks": 16, "weekly_hours": 8, "audience": [ "DevOps engineers who deploy to Kubernetes and want a safer, auditable delivery model", "Platform engineers building self-service delivery and fleet management for many teams", "SREs who want drift detection, easy rollback and change history for production", "Cloud infrastructure engineers looking to manage cloud resources through Kubernetes-native reconciliation", "Engineers preparing for the CGOA, CAPA or CNPE certifications" ], "prerequisites": [ "Working knowledge of Kubernetes: Pods, Deployments, Services, namespaces and kubectl", "Comfort with Git branching, pull requests and code review", "Ability to read and write YAML and basic shell scripts", "Experience with at least one CI system such as GitHub Actions or GitLab CI/CD", "Access to a local cluster (kind or k3d) and ideally one managed cloud cluster" ], "outcomes": [ "Explain and apply the four OpenGitOps principles and choose between push and pull delivery", "Design repository layouts and Kustomize or Helm configurations for multiple environments", "Operate Argo CD 3.x and Flux 2.x in production, including HA, RBAC and multi-tenancy", "Implement metric-driven canary releases and automated environment promotion with an audit trail", "Deliver secrets safely and enforce policy as code in CI and at admission", "Verify signed commits and OCI artifacts so only trusted changes reach clusters", "Manage add-ons and applications across a fleet of clusters with ApplicationSets or Flux", "Provision and drift-correct cloud infrastructure with Crossplane and the OpenTofu Tofu Controller" ], "trends": [ "Argo CD 3.5 (August 2026) moved the Source Hydrator and impersonation to beta and added Git commit signature verification, internal mTLS, Helm 4 support and ApplicationSets in any namespace.", "Flux made image update automation GA in 2.7, added Helm v4 support with server-side apply in 2.8 and a CLI plugin system in 2.9, while the Flux Operator ships an MCP server for AI-assisted GitOps troubleshooting.", "OCI registries are becoming a second state store: Flux delivers manifests as signed OCI artifacts and Argo CD added native OCI sources in 3.1.", "Promotion is the new frontier: the rendered manifests pattern, Argo CD's Source Hydrator and Kargo replace environment branches with verified, auditable promotion steps.", "Infrastructure GitOps has matured: Crossplane graduated in CNCF in November 2025 with v2 making resources namespaced, and OpenTofu joined CNCF in 2025 with Flux-based Tofu Controller support.", "Policy as code is mainstream: Kyverno graduated in CNCF in March 2026, and Kubernetes ValidatingAdmissionPolicy offers built-in CEL-based guardrails." ], "roles": [ { "title": "GitOps Engineer", "description": "Designs repository structures, controller setups and promotion flows, and keeps Argo CD or Flux healthy as the number of apps and clusters grows." }, { "title": "Platform Engineer", "description": "Uses GitOps as the delivery engine behind an internal developer platform, offering golden paths, ApplicationSets or ResourceSets and self-service environments to product teams." }, { "title": "Release Engineer", "description": "Owns progressive delivery and promotion: canaries, analysis, approvals and the audit trail that shows exactly what changed in each environment and why." }, { "title": "Site Reliability Engineer", "description": "Relies on GitOps for drift detection, fast rollback by revert and a complete change history, and wires controller signals into alerting and incident response." }, { "title": "Cloud Infrastructure Engineer", "description": "Manages cloud resources through reconciling controllers such as Crossplane or the Tofu Controller, exposing safe infrastructure APIs to application teams." } ], "stages": [ { "title": "GitOps Principles & Foundations", "level": "Intermediate", "duration_weeks": 2, "description": "The OpenGitOps principles, the Kubernetes reconciliation machinery that makes them work, and how to structure Git repositories for GitOps.", "milestone": "You can explain the four OpenGitOps principles, compare push and pull delivery, and design a repository layout for apps and environments.", "topics": [ { "title": "OpenGitOps Principles & the Reconciliation Loop", "description": "GitOps is defined by four OpenGitOps principles: desired state that is declarative, versioned and immutable, pulled automatically and continuously reconciled. Understand them deeply, because every later tool decision is a trade-off against these principles.", "est_hours": 6, "optional": false, "concepts": [ "declarative vs imperative configuration", "versioned and immutable desired state", "pull-based agents vs push-based CI deploys", "control loops and reconciliation", "desired state, actual state and drift", "state store and reconciler terminology", "where GitOps ends and CI begins" ], "tools": [ "Kubernetes", "Git" ], "resources": [ { "title": "OpenGitOps principles", "url": "https://opengitops.dev/", "type": "docs", "free": true }, { "title": "Kubernetes: Controllers", "url": "https://kubernetes.io/docs/concepts/architecture/controller/", "type": "docs", "free": true }, { "title": "Certified GitOps Associate (CGOA) Training — DevOpsSchool", "url": "https://www.devopsschool.com/certification/certified-gitops-associate-cgoa.html", "type": "course", "free": false } ] }, { "title": "Kubernetes API Machinery for GitOps", "description": "GitOps controllers are Kubernetes controllers that apply manifests on your behalf. Learn how the API server merges, owns and reports on objects so you can predict sync results, diffs and health status instead of being surprised by them.", "est_hours": 6, "optional": false, "concepts": [ "server-side apply and field managers", "CRDs and custom controllers", "owner references, finalizers and garbage collection", "status conditions and resource health", "kstatus readiness", "controller service accounts and RBAC" ], "tools": [ "Kubernetes" ], "resources": [ { "title": "Kubernetes: Server-Side Apply", "url": "https://kubernetes.io/docs/reference/using-api/server-side-apply/", "type": "docs", "free": true }, { "title": "Kubernetes: Custom Resources", "url": "https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/", "type": "docs", "free": true } ] }, { "title": "Repository Design & Git Workflows", "description": "Repository layout decides how safely you can change, review and promote. Learn the trade-offs between monorepo and polyrepo, why application source and deployment config are usually separated, and why a directory per environment beats long-lived environment branches.", "est_hours": 5, "optional": false, "concepts": [ "app repository vs config repository", "monorepo vs polyrepo", "directory-per-environment vs branch-per-environment", "pull requests as change requests", "branch protection and CODEOWNERS", "signed commits", "the CI-to-GitOps handoff" ], "tools": [ "Git", "GitHub", "GitLab" ], "resources": [ { "title": "Flux: Ways of structuring your repositories", "url": "https://fluxcd.io/flux/guides/repository-structure/", "type": "guide", "free": true }, { "title": "Argo CD: Best Practices", "url": "https://argo-cd.readthedocs.io/en/stable/user-guide/best_practices/", "type": "docs", "free": true } ] } ] }, { "title": "Declarative Config: Kustomize, Helm & Rendered Manifests", "level": "Intermediate", "duration_weeks": 2, "description": "Model applications and environments as declarative configuration, and render and validate it before any controller sees it.", "milestone": "You can package an app for dev, staging and production with Kustomize or Helm, and render, validate and diff the final manifests in CI.", "topics": [ { "title": "Kustomize Overlays & Components", "description": "Kustomize patches plain YAML without templates and is built into kubectl, Argo CD and Flux. Learn to keep a clean base and express each environment as a small, reviewable overlay.", "est_hours": 5, "optional": false, "concepts": [ "bases and overlays", "strategic merge and JSON 6902 patches", "components for optional features", "ConfigMap and Secret generators", "replacements and image transformers", "kustomize build in CI" ], "tools": [ "Kustomize" ], "resources": [ { "title": "Kustomize reference", "url": "https://kubectl.docs.kubernetes.io/references/kustomize/", "type": "docs", "free": true }, { "title": "Kubernetes: Declarative Management with Kustomize", "url": "https://kubernetes.io/docs/tasks/manage-kubernetes-objects/kustomization/", "type": "tutorial", "free": true } ] }, { "title": "Helm Charts in a GitOps World", "description": "Helm remains the main packaging format for third-party software. Learn to consume and author charts declaratively, store them in OCI registries, and understand what Helm 4 (released November 2025) changes, including server-side apply and Wasm plugins.", "est_hours": 6, "optional": false, "concepts": [ "chart structure and templating", "layering values per environment", "OCI chart registries", "Helm 4: server-side apply, kstatus waiting and Wasm plugins", "helm template vs controller-managed releases", "values schemas and chart testing", "post-renderers" ], "tools": [ "Helm" ], "resources": [ { "title": "Helm documentation", "url": "https://helm.sh/docs/", "type": "docs", "free": true }, { "title": "Helm 4 Released (Helm blog)", "url": "https://helm.sh/blog/helm-4-released/", "type": "article", "free": true }, { "title": "Kubernetes & Helm Training — DevOpsSchool", "url": "https://www.devopsschool.com/courses/kubernetes/", "type": "course", "free": false } ] }, { "title": "Rendered Manifests & Config Validation", "description": "Templates hide what will actually change in the cluster. The rendered manifests pattern commits fully hydrated YAML so reviewers see real diffs; combine it with schema and policy validation in CI so broken config never reaches a controller.", "est_hours": 5, "optional": false, "concepts": [ "rendered (hydrated) manifests pattern", "Argo CD Source Hydrator", "dry vs hydrated branches", "schema validation with kubeconform", "diff previews on pull requests", "detecting unintended environment drift" ], "tools": [ "GitHub Actions", "Argo CD" ], "resources": [ { "title": "Argo CD: Source Hydrator", "url": "https://argo-cd.readthedocs.io/en/stable/user-guide/source-hydrator/", "type": "docs", "free": true }, { "title": "kubeconform", "url": "https://github.com/yannh/kubeconform", "type": "docs", "free": true } ] } ] }, { "title": "Argo CD in Depth", "level": "Intermediate", "duration_weeks": 3, "description": "Run Argo CD, the most widely adopted GitOps controller, from a single application to multi-tenant, templated delivery.", "milestone": "You can operate a highly available, multi-tenant Argo CD 3.x instance that manages many applications through ApplicationSets.", "topics": [ { "title": "Argo CD Core: Applications, Sync & Health", "description": "Learn the Application and AppProject model, how Argo CD compares desired and live state, and how sync options control pruning and self-healing. These are the settings that decide whether drift is merely reported or automatically reverted.", "est_hours": 8, "optional": false, "concepts": [ "Applications and AppProjects", "automated sync, prune and self-heal", "sync waves, phases and hooks", "health checks and custom Lua health", "diff customisation and server-side diff", "multiple sources per Application", "app-of-apps pattern" ], "tools": [ "Argo CD" ], "resources": [ { "title": "Argo CD documentation", "url": "https://argo-cd.readthedocs.io/en/stable/", "type": "docs", "free": true }, { "title": "Argo CD: Sync Phases and Waves", "url": "https://argo-cd.readthedocs.io/en/stable/user-guide/sync-waves/", "type": "docs", "free": true }, { "title": "Argo Training and Certification Course — DevOpsSchool", "url": "https://www.devopsschool.com/courses/argo/", "type": "course", "free": false } ] }, { "title": "ApplicationSets & Templated Delivery", "description": "ApplicationSets generate many Applications from one template, which is how teams scale Argo CD across services, environments and clusters. Learn the generators and the safety controls that stop one bad template from deleting everything.", "est_hours": 7, "optional": false, "concepts": [ "list, Git, cluster, matrix and merge generators", "pull request generator for preview environments", "Go templating", "progressive syncs", "ApplicationSets in any namespace", "preserve and deletion policies" ], "tools": [ "Argo CD" ], "resources": [ { "title": "Argo CD: ApplicationSet controller", "url": "https://argo-cd.readthedocs.io/en/stable/operator-manual/applicationset/", "type": "docs", "free": true } ] }, { "title": "Operating Argo CD: HA, RBAC & Multi-Tenancy", "description": "A shared Argo CD becomes critical infrastructure. Learn to run it highly available, integrate SSO and RBAC, isolate tenants with AppProjects and plan safe upgrades across the 3.x releases.", "est_hours": 7, "optional": false, "concepts": [ "HA installation and controller sharding", "repo-server caching and scaling", "SSO and RBAC policies", "AppProject restrictions for tenants", "impersonation of sync service accounts", "notifications and webhooks", "upgrading across minor versions" ], "tools": [ "Argo CD" ], "resources": [ { "title": "Argo CD: High Availability", "url": "https://argo-cd.readthedocs.io/en/stable/operator-manual/high_availability/", "type": "docs", "free": true }, { "title": "Argo CD: RBAC Configuration", "url": "https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/", "type": "docs", "free": true }, { "title": "Argo CD: Upgrading overview", "url": "https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/", "type": "docs", "free": true } ] } ] }, { "title": "Flux in Depth", "level": "Intermediate", "duration_weeks": 2, "description": "Use Flux's composable controllers, OCI artifacts and image automation, and the Flux Operator for lifecycle and self-service.", "milestone": "You can bootstrap Flux, deliver apps from Git and OCI sources with dependencies and health checks, and automate image updates safely.", "topics": [ { "title": "Flux Toolkit: Sources, Kustomizations & HelmReleases", "description": "Flux is a set of focused controllers rather than one server with a UI. Learn how sources, Kustomizations and HelmReleases fit together, how to order them with dependencies and how Flux detects and corrects drift.", "est_hours": 7, "optional": false, "concepts": [ "flux bootstrap", "GitRepository, OCIRepository and HelmRepository sources", "Kustomization and HelmRelease reconciliation", "dependsOn and health checks", "drift detection and correction for Helm releases", "post-build variable substitution", "alerts, providers and receivers" ], "tools": [ "Flux", "Kustomize", "Helm" ], "resources": [ { "title": "Flux documentation", "url": "https://fluxcd.io/flux/", "type": "docs", "free": true }, { "title": "Flux: GitOps Toolkit components", "url": "https://fluxcd.io/flux/components/", "type": "docs", "free": true }, { "title": "Flux Training and Certification Course — DevOpsSchool", "url": "https://www.devopsschool.com/courses/flux/", "type": "course", "free": false } ] }, { "title": "OCI Artifacts & Image Update Automation", "description": "Flux can deliver manifests as signed OCI artifacts instead of cloning Git in every cluster, and can write new image tags back to Git; image update automation became GA in Flux 2.7. Learn both and when Git-less delivery is the right trade-off.", "est_hours": 5, "optional": false, "concepts": [ "flux push artifact", "OCIRepository with cosign verification", "Git-less delivery trade-offs", "ImageRepository, ImagePolicy and ImageUpdateAutomation", "semver and timestamp policies", "direct commits vs pull-request updates" ], "tools": [ "Flux", "Sigstore" ], "resources": [ { "title": "Flux: OCI cheatsheet", "url": "https://fluxcd.io/flux/cheatsheets/oci-artifacts/", "type": "guide", "free": true }, { "title": "Flux: Automate image updates to Git", "url": "https://fluxcd.io/flux/guides/image-update/", "type": "guide", "free": true } ] }, { "title": "Flux Operator, ResourceSets & AI-Assisted GitOps", "description": "The Flux Operator manages Flux installations declaratively and adds ResourceSets for templated, self-service application definitions, including ephemeral pull-request environments. Its MCP server lets AI assistants inspect and troubleshoot Flux pipelines within your Kubernetes RBAC.", "est_hours": 3, "optional": true, "concepts": [ "FluxInstance for install and upgrades", "ResourceSet templating", "ephemeral preview environments", "Flux MCP server", "keeping a human in the loop for AI actions" ], "tools": [ "Flux Operator" ], "resources": [ { "title": "Flux Operator documentation", "url": "https://fluxoperator.dev/", "type": "docs", "free": true }, { "title": "Flux MCP Server", "url": "https://fluxoperator.dev/mcp-server/", "type": "docs", "free": true } ] } ] }, { "title": "Progressive Delivery & Environment Promotion", "level": "Advanced", "duration_weeks": 2, "description": "Release safely with metric-driven canaries, and promote verified changes from environment to environment with an audit trail.", "milestone": "You can run an automated canary that rolls back on bad metrics and promote a release through dev, staging and production with approvals.", "topics": [ { "title": "Argo Rollouts: Canary & Blue-Green", "description": "Reconciliation gets the new version into the cluster; progressive delivery decides how much traffic it gets. Learn Argo Rollouts strategies and analysis so a bad release is aborted by metrics before most users notice.", "est_hours": 6, "optional": false, "concepts": [ "Rollout resource vs Deployment", "canary steps and pauses", "blue-green with preview services", "AnalysisTemplates backed by Prometheus", "traffic routing with Gateway API or a service mesh", "automated abort and rollback", "working alongside Argo CD sync" ], "tools": [ "Argo Rollouts", "Prometheus", "Istio" ], "resources": [ { "title": "Argo Rollouts documentation", "url": "https://argo-rollouts.readthedocs.io/en/stable/", "type": "docs", "free": true }, { "title": "Gateway API documentation", "url": "https://gateway-api.sigs.k8s.io/", "type": "docs", "free": true } ] }, { "title": "Flagger with Flux", "description": "Flagger is the progressive delivery companion in the Flux ecosystem. Learn its Canary resource and metric checks if your platform standardises on Flux.", "est_hours": 4, "optional": true, "concepts": [ "Canary custom resource", "canary, A/B and blue-green strategies", "metric templates and thresholds", "webhooks and load-test hooks", "mesh and Gateway API providers" ], "tools": [ "Flagger", "Flux" ], "resources": [ { "title": "Flagger documentation", "url": "https://docs.flagger.app/", "type": "docs", "free": true } ] }, { "title": "Environment Promotion with Kargo", "description": "GitOps tells each cluster what to run, but not how a change moves from dev to production. Learn promotion patterns, from automated pull requests that bump image tags to Kargo's warehouses, freight and stages with verification gates and approvals.", "est_hours": 5, "optional": false, "concepts": [ "promotion as a pull request", "automated image tag updates", "Kargo warehouses, freight and stages", "verification and manual approvals", "release freezes", "audit trail and rollback by revert" ], "tools": [ "Kargo", "Argo CD" ], "resources": [ { "title": "Kargo documentation", "url": "https://docs.kargo.io/", "type": "docs", "free": true } ] } ] }, { "title": "Secrets, Policy & GitOps Security", "level": "Advanced", "duration_weeks": 2, "description": "Keep secrets out of Git, enforce guardrails with policy as code, and harden the GitOps supply chain and the controllers themselves.", "milestone": "You can deliver secrets safely, block non-compliant manifests in CI and at admission, and ensure only signed changes reach the cluster.", "topics": [ { "title": "Secrets Management in GitOps", "description": "Plain Kubernetes Secrets must never be committed. Compare encrypting secrets in Git (SOPS, Sealed Secrets) with referencing an external store (External Secrets Operator with Vault or a cloud secret manager), and choose based on rotation and audit needs.", "est_hours": 6, "optional": false, "concepts": [ "why base64 is not encryption", "SOPS with age or cloud KMS", "Sealed Secrets and controller key management", "External Secrets Operator and SecretStores", "Vault dynamic secrets", "rotation and revocation", "Secrets Store CSI driver" ], "tools": [ "SOPS", "Sealed Secrets", "External Secrets Operator", "Vault" ], "resources": [ { "title": "External Secrets Operator documentation", "url": "https://external-secrets.io/latest/", "type": "docs", "free": true }, { "title": "Flux: Manage Kubernetes secrets with SOPS", "url": "https://fluxcd.io/flux/guides/mozilla-sops/", "type": "guide", "free": true }, { "title": "HashiCorp Vault Training and Certification Course — DevOpsSchool", "url": "https://www.devopsschool.com/courses/vault/", "type": "course", "free": false } ] }, { "title": "Policy as Code & Admission Control", "description": "Policies turn team agreements into automated guardrails. Learn Kyverno (CNCF graduated in March 2026), OPA Gatekeeper and the built-in ValidatingAdmissionPolicy, and run the same policies in CI as at admission so developers get feedback before merge.", "est_hours": 5, "optional": false, "concepts": [ "validating, mutating and generating policies", "Kyverno CLI in CI", "OPA Gatekeeper and Rego", "ValidatingAdmissionPolicy with CEL", "policy reports and audit mode", "exceptions and gradual enforcement" ], "tools": [ "Kyverno", "OPA" ], "resources": [ { "title": "Kyverno documentation", "url": "https://kyverno.io/docs/", "type": "docs", "free": true }, { "title": "OPA Gatekeeper documentation", "url": "https://open-policy-agent.github.io/gatekeeper/website/docs/", "type": "docs", "free": true }, { "title": "Kubernetes: Validating Admission Policy", "url": "https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/", "type": "docs", "free": true } ] }, { "title": "Securing the GitOps Supply Chain & Controllers", "description": "In GitOps, write access to the config repository is effectively write access to production. Learn the threat model and the controls: signed commits and artifacts verified before sync, least-privilege controllers and multi-tenancy lockdown.", "est_hours": 5, "optional": false, "concepts": [ "GitOps threat model", "commit signature verification before sync", "cosign-signed OCI artifacts", "SLSA provenance", "least-privilege controller RBAC and impersonation", "Flux multi-tenancy lockdown", "deploy keys and short-lived Git credentials" ], "tools": [ "Sigstore", "Argo CD", "Flux" ], "resources": [ { "title": "Flux security documentation", "url": "https://fluxcd.io/flux/security/", "type": "docs", "free": true }, { "title": "Argo CD: Security", "url": "https://argo-cd.readthedocs.io/en/stable/operator-manual/security/", "type": "docs", "free": true }, { "title": "SLSA: Supply-chain Levels for Software Artifacts", "url": "https://slsa.dev/", "type": "docs", "free": true } ] } ] }, { "title": "Fleet, Infrastructure GitOps & Scale", "level": "Expert", "duration_weeks": 3, "description": "Extend GitOps from one cluster to fleets and from applications to cloud infrastructure, then observe it and scale it.", "milestone": "You can manage add-ons and apps across many clusters, provision cloud infrastructure through reconciling controllers, and detect, alert on and remediate drift.", "topics": [ { "title": "Multi-Cluster & Fleet Management", "description": "Most organisations run many clusters per region, environment or customer. Learn the hub-and-spoke and agent-per-cluster topologies, how to target clusters by labels and how to roll out changes in waves to limit blast radius.", "est_hours": 7, "optional": false, "concepts": [ "hub-and-spoke vs agent-per-cluster", "cluster registration and labels", "ApplicationSet cluster generator", "Flux per cluster from a shared fleet repository", "Cluster API for declarative cluster lifecycle", "fleet add-on managers such as Sveltos and Open Cluster Management", "staged rollouts and blast radius" ], "tools": [ "Argo CD", "Flux", "Cluster API" ], "resources": [ { "title": "Argo CD: Cluster generator", "url": "https://argo-cd.readthedocs.io/en/stable/operator-manual/applicationset/Generators-Cluster/", "type": "docs", "free": true }, { "title": "The Cluster API Book", "url": "https://cluster-api.sigs.k8s.io/", "type": "book", "free": true }, { "title": "Open Cluster Management", "url": "https://open-cluster-management.io/", "type": "docs", "free": true } ] }, { "title": "GitOps for Infrastructure: Crossplane & OpenTofu Controllers", "description": "The same reconcile loop can manage cloud resources. Use Crossplane v2 compositions to offer self-service infrastructure APIs, or the Flux-based Tofu Controller to plan and apply OpenTofu and Terraform continuously with drift detection.", "est_hours": 8, "optional": false, "concepts": [ "Crossplane providers and managed resources", "XRDs, compositions and functions", "namespaced composite resources in Crossplane v2", "Tofu Controller plan, approve and apply", "infrastructure drift detection and remediation", "state and cloud credential handling" ], "tools": [ "Crossplane", "OpenTofu", "Terraform", "Tofu Controller" ], "resources": [ { "title": "Crossplane documentation", "url": "https://docs.crossplane.io/", "type": "docs", "free": true }, { "title": "Tofu Controller documentation", "url": "https://flux-iac.github.io/tofu-controller/", "type": "docs", "free": true }, { "title": "OpenTofu Training and Certification Course — DevOpsSchool", "url": "https://www.devopsschool.com/courses/opentofu/", "type": "course", "free": false } ] }, { "title": "Drift Detection, Observability & Troubleshooting", "description": "Controllers fail quietly unless you watch them. Export Argo CD and Flux metrics and events, alert on sync failures and drift, and build a troubleshooting routine that traces a problem from commit to pod.", "est_hours": 6, "optional": false, "concepts": [ "out-of-sync vs drifted vs degraded", "self-heal vs alert-only policies", "controller metrics in Prometheus", "Grafana dashboards for sync and reconcile", "notifications to chat and incident tools", "deriving DORA metrics from GitOps events", "AI-assisted troubleshooting via MCP" ], "tools": [ "Prometheus", "Grafana", "Argo CD", "Flux" ], "resources": [ { "title": "Flux monitoring", "url": "https://fluxcd.io/flux/monitoring/", "type": "docs", "free": true }, { "title": "Argo CD: Metrics", "url": "https://argo-cd.readthedocs.io/en/stable/operator-manual/metrics/", "type": "docs", "free": true }, { "title": "Prometheus Training and Certification Course — DevOpsSchool", "url": "https://www.devopsschool.com/courses/prometheus/", "type": "course", "free": false } ] }, { "title": "Scaling GitOps", "description": "Large fleets stress Git hosts, repo servers and the Kubernetes API. Learn the levers that keep reconciliation fast and cheap: sharding, webhooks instead of polling, OCI sources, caching and a repository layout that limits manifest regeneration.", "est_hours": 5, "optional": false, "concepts": [ "controller sharding and horizontal scaling", "webhook-triggered reconciliation", "reconcile intervals and jitter", "Git host rate limits and OCI as a state store", "monorepo performance and manifest generation paths", "resource exclusions" ], "tools": [ "Argo CD", "Flux" ], "resources": [ { "title": "Flux: Sharding and horizontal scaling", "url": "https://fluxcd.io/flux/installation/configuration/sharding/", "type": "docs", "free": true }, { "title": "Argo CD: High Availability and scaling", "url": "https://argo-cd.readthedocs.io/en/stable/operator-manual/high_availability/", "type": "docs", "free": true } ] } ] } ], "projects": [ { "title": "Self-Managing Argo CD on a Local Cluster", "description": "Bootstrap a kind cluster where Argo CD manages its own installation and a sample application through the app-of-apps pattern, with Kustomize overlays for dev, staging and prod in one config repository. Demonstrate drift being self-healed after a manual kubectl edit.", "difficulty": "Beginner", "skills": [ "Argo CD", "Kustomize", "Kubernetes", "Git" ] }, { "title": "Signed OCI Delivery with Flux", "description": "Build a CI pipeline that pushes the image and the rendered manifests as a cosign-signed OCI artifact. Configure Flux to verify the signature before applying and use image automation to open pull requests for new semver tags.", "difficulty": "Intermediate", "skills": [ "Flux", "GitHub Actions", "Sigstore", "Helm" ] }, { "title": "Secrets and Guardrails for a GitOps Repository", "description": "Deliver application secrets with External Secrets Operator backed by Vault and a SOPS-encrypted bootstrap secret. Enforce Kyverno policies in CI and at admission: no latest tags, resource limits required and only signed images allowed.", "difficulty": "Intermediate", "skills": [ "External Secrets Operator", "Vault", "SOPS", "Kyverno" ] }, { "title": "Canary Releases with Automated Promotion", "description": "Combine an Argo Rollouts canary using Prometheus analysis with Kargo promotion across dev, staging and production, with manual approval before production. Show an automatic abort on a bad release and the audit trail of every promotion.", "difficulty": "Advanced", "skills": [ "Argo Rollouts", "Kargo", "Argo CD", "Prometheus" ] }, { "title": "Fleet GitOps for Three Clusters", "description": "Use ApplicationSets with the cluster generator to roll out platform add-ons to labelled clusters in waves, created declaratively with Cluster API or a managed service. Add Grafana dashboards and alerts for sync failures and drift.", "difficulty": "Advanced", "skills": [ "Argo CD", "Cluster API", "Prometheus", "Grafana" ] }, { "title": "Self-Service Infrastructure API", "description": "Publish a Crossplane v2 composition that lets developers request a namespaced database through a simple claim, and manage the shared network with the Tofu Controller and OpenTofu. Demonstrate drift detection and automatic reconciliation after a manual cloud console change.", "difficulty": "Advanced", "skills": [ "Crossplane", "OpenTofu", "Tofu Controller", "Flux" ] } ], "certifications": [ { "name": "Certified GitOps Associate (CGOA)", "provider": "CNCF / Linux Foundation", "url": "https://training.linuxfoundation.org/certification/certified-gitops-associate-cgoa/", "level": "Associate", "note": "The vendor-neutral GitOps credential, covering terminology, the OpenGitOps principles, patterns and tooling." }, { "name": "Certified Argo Project Associate (CAPA)", "provider": "CNCF / Linux Foundation", "url": "https://training.linuxfoundation.org/certification/certified-argo-project-associate-capa/", "level": "Associate", "note": "Validates knowledge of Argo CD and Argo Rollouts alongside Argo Workflows and Events, the most common GitOps stack." }, { "name": "Certified Kubernetes Administrator (CKA)", "provider": "CNCF / Linux Foundation", "url": "https://training.linuxfoundation.org/certification/certified-kubernetes-administrator-cka/", "level": "Professional", "note": "Hands-on proof of the cluster administration and troubleshooting skills you need to run GitOps controllers in production." }, { "name": "Certified Cloud Native Platform Engineer (CNPE)", "provider": "CNCF / Linux Foundation", "url": "https://training.linuxfoundation.org/certification/certified-cloud-native-platform-engineer-cnpe/", "level": "Professional", "note": "A performance-based platform engineering exam in which GitOps and continuous delivery is the largest domain at 25%." }, { "name": "GitOps Certified Professional (GCOCP)", "provider": "DevOpsSchool", "url": "https://www.devopsschool.com/certification/gitops-certified-professional.html", "level": "Professional", "note": "A hands-on, project-based GitOps certification covering Argo CD, Flux and the delivery patterns in this path." } ], "tools_catalog": [ { "name": "Argo CD", "category": "GitOps", "website": "https://argo-cd.readthedocs.io/", "ds_course_url": "https://www.devopsschool.com/courses/argo/" }, { "name": "Argo Rollouts", "category": "CI/CD & Release", "website": "https://argoproj.github.io/rollouts/", "ds_course_url": "https://www.devopsschool.com/courses/argo/" }, { "name": "Cluster API", "category": "Containers & Kubernetes", "website": "https://cluster-api.sigs.k8s.io/", "ds_course_url": "" }, { "name": "Crossplane", "category": "Infrastructure as Code & Automation", "website": "https://www.crossplane.io/", "ds_course_url": "" }, { "name": "External Secrets Operator", "category": "Policy as Code & Secrets", "website": "https://external-secrets.io/", "ds_course_url": "" }, { "name": "Flagger", "category": "CI/CD & Release", "website": "https://flagger.app/", "ds_course_url": "" }, { "name": "Flux", "category": "GitOps", "website": "https://fluxcd.io/", "ds_course_url": "https://www.devopsschool.com/courses/flux/" }, { "name": "Flux Operator", "category": "GitOps", "website": "https://fluxoperator.dev/", "ds_course_url": "" }, { "name": "Git", "category": "Foundations & Languages", "website": "https://git-scm.com/", "ds_course_url": "https://www.devopsschool.com/courses/git/" }, { "name": "GitHub", "category": "Foundations & Languages", "website": "https://github.com/", "ds_course_url": "https://www.devopsschool.com/courses/github/" }, { "name": "GitHub Actions", "category": "CI/CD & Release", "website": "https://github.com/features/actions", "ds_course_url": "https://www.devopsschool.com/courses/github/" }, { "name": "GitLab", "category": "Foundations & Languages", "website": "https://about.gitlab.com/", "ds_course_url": "https://www.devopsschool.com/courses/gitlab/" }, { "name": "Grafana", "category": "Observability", "website": "https://grafana.com/", "ds_course_url": "https://www.devopsschool.com/courses/grafana/" }, { "name": "Helm", "category": "Containers & Kubernetes", "website": "https://helm.sh/", "ds_course_url": "https://www.devopsschool.com/courses/kubernetes/" }, { "name": "Istio", "category": "Networking & Network Automation", "website": "https://istio.io/", "ds_course_url": "https://www.devopsschool.com/courses/istio/" }, { "name": "Kargo", "category": "GitOps", "website": "https://kargo.io/", "ds_course_url": "" }, { "name": "Kubernetes", "category": "Containers & Kubernetes", "website": "https://kubernetes.io/", "ds_course_url": "https://www.devopsschool.com/courses/kubernetes/" }, { "name": "Kustomize", "category": "Containers & Kubernetes", "website": "https://kustomize.io/", "ds_course_url": "" }, { "name": "Kyverno", "category": "Policy as Code & Secrets", "website": "https://kyverno.io/", "ds_course_url": "" }, { "name": "OPA", "category": "Policy as Code & Secrets", "website": "https://www.openpolicyagent.org/", "ds_course_url": "https://www.devopsschool.com/courses/opa/" }, { "name": "OpenTofu", "category": "Infrastructure as Code & Automation", "website": "https://opentofu.org/", "ds_course_url": "https://www.devopsschool.com/courses/opentofu/" }, { "name": "Prometheus", "category": "Observability", "website": "https://prometheus.io/", "ds_course_url": "https://www.devopsschool.com/courses/prometheus/" }, { "name": "Sealed Secrets", "category": "Policy as Code & Secrets", "website": "https://github.com/bitnami/sealed-secrets", "ds_course_url": "" }, { "name": "Sigstore", "category": "Security & Supply Chain", "website": "https://www.sigstore.dev/", "ds_course_url": "" }, { "name": "SOPS", "category": "Policy as Code & Secrets", "website": "https://getsops.io/", "ds_course_url": "" }, { "name": "Terraform", "category": "Infrastructure as Code & Automation", "website": "https://developer.hashicorp.com/terraform", "ds_course_url": "https://www.devopsschool.com/courses/terraform/" }, { "name": "Tofu Controller", "category": "GitOps", "website": "https://flux-iac.github.io/tofu-controller/", "ds_course_url": "" }, { "name": "Vault", "category": "Policy as Code & Secrets", "website": "https://developer.hashicorp.com/vault", "ds_course_url": "https://www.devopsschool.com/courses/vault/" } ], "faqs": [ { "q": "What is GitOps, and how is it different from running kubectl apply in a CI pipeline?", "a": "In push-based CI/CD, the pipeline holds cluster credentials and applies changes once. In GitOps, an agent inside the cluster pulls the desired state from Git or an OCI registry and keeps reconciling it, so drift is detected and corrected, credentials stay in the cluster and every change has a reviewed commit behind it." }, { "q": "Should I learn Argo CD or Flux first?", "a": "Start with Argo CD if you want the most widely adopted tool with a rich UI and strong multi-tenancy, which many job postings ask for. Learn Flux too: its composable controllers, OCI-first delivery and Flux Operator suit platform teams that prefer everything as Kubernetes resources. The concepts transfer, so knowing both makes you far more versatile." }, { "q": "Does GitOps only work with Kubernetes?", "a": "The OpenGitOps principles are tool-agnostic, but Kubernetes is where the ecosystem is most mature because its controllers already reconcile desired state. Cloud infrastructure can be managed the same way through Crossplane or the Tofu Controller, which run on Kubernetes but provision resources anywhere." }, { "q": "How do you handle secrets in GitOps?", "a": "Never commit plain Secrets. Either encrypt them in Git with SOPS or Sealed Secrets, or commit only a reference and let External Secrets Operator fetch the value from Vault or a cloud secret manager. External stores are usually better for rotation and audit at scale." }, { "q": "How do I promote a change from staging to production with GitOps?", "a": "Promotion is a change to the production configuration, typically a pull request that updates an image tag or chart version in the production directory. Tools such as Kargo, Argo CD Image Updater and Flux image automation automate this with verification gates and approvals, avoiding long-lived environment branches." }, { "q": "Which GitOps certification should I take?", "a": "The Certified GitOps Associate (CGOA) is the vendor-neutral starting point and tests principles and patterns. Add the Certified Argo Project Associate (CAPA) if you work with Argo, and the CKA or CNPE to prove hands-on Kubernetes and platform skills." }, { "q": "Do I still need Terraform or OpenTofu if I adopt GitOps?", "a": "Usually yes. Many teams use Terraform or OpenTofu to create clusters and foundational cloud resources, then GitOps for everything inside the cluster. You can also bring IaC into the GitOps loop with the Tofu Controller, or replace parts of it with Crossplane compositions." } ], "related": [ "devops", "platform-engineering", "sre", "devsecops" ], "key_tools": [ "Argo CD", "Flux", "Kustomize", "Helm", "Argo Rollouts", "Crossplane" ], "course_url": "https://www.devopsschool.com/courses/gitops/", "seo_title": "GitOps Learning Path 2026: Argo CD, Flux & Roadmap", "seo_description": "A 2026 GitOps roadmap for Kubernetes engineers: OpenGitOps principles, Argo CD, Flux, Helm, Kustomize, Kargo, secrets, policy, fleets and Crossplane.", "url": "https://www.devopsschool.com/path/gitops/", "updated_at": "2026-10-26 08:58:45" }