Run apps, clusters and cloud infrastructure from Git with Argo CD, Flux and continuous reconciliation.
A focused specialist path for engineers who already know Kubernetes basics: OpenGitOps principles, Kustomize and Helm, Argo CD and Flux in depth, progressive delivery and promotion, secrets and policy, fleet management and GitOps for infrastructure with Crossplane and OpenTofu controllers.
GitOps is an operating model in which the desired state of a system is declared in version control and software agents continuously pull and reconcile it. The four OpenGitOps principles (declarative, versioned and immutable, pulled automatically, continuously reconciled) turn every change into a reviewed commit, every rollback into a revert, and every manual edit in the cluster into detectable drift.
In 2026 GitOps is the default way to deliver to Kubernetes. CNCF's 2025 end user survey found Argo CD running in nearly 60% of respondents' clusters, Flux has added OCI artifacts, Helm 4 support and an operator with an MCP server for AI-assisted troubleshooting, and the frontier has moved to environment promotion, supply chain verification, fleet-scale operations and reconciling cloud infrastructure with Crossplane and OpenTofu controllers.
This path assumes you can already deploy and debug workloads on Kubernetes. It goes far deeper than the GitOps stage of the DevOps path and is a core skill set for platform engineering, where GitOps is often the delivery engine behind golden paths. Expect to work hands-on with both Argo CD and Flux so you can choose the right tool for each context.
groups Who this path is for
DevOps engineers who deploy to Kubernetes and want a safer, auditable delivery model
Platform engineers building self-service delivery and fleet management for many teams
SREs who want drift detection, easy rollback and change history for production
Cloud infrastructure engineers looking to manage cloud resources through Kubernetes-native reconciliation
Engineers preparing for the CGOA, CAPA or CNPE certifications
key Before you start
Working knowledge of Kubernetes: Pods, Deployments, Services, namespaces and kubectl
Comfort with Git branching, pull requests and code review
Ability to read and write YAML and basic shell scripts
Experience with at least one CI system such as GitHub Actions or GitLab CI/CD
Access to a local cluster (kind or k3d) and ideally one managed cloud cluster
verified What you will be able to do
Explain and apply the four OpenGitOps principles and choose between push and pull delivery
Design repository layouts and Kustomize or Helm configurations for multiple environments
Operate Argo CD 3.x and Flux 2.x in production, including HA, RBAC and multi-tenancy
Implement metric-driven canary releases and automated environment promotion with an audit trail
Deliver secrets safely and enforce policy as code in CI and at admission
Verify signed commits and OCI artifacts so only trusted changes reach clusters
Manage add-ons and applications across a fleet of clusters with ApplicationSets or Flux
Provision and drift-correct cloud infrastructure with Crossplane and the OpenTofu Tofu Controller
The roadmap
7 stages · 22 topics · ~127 hours of focused learning. Work through the stages in order; optional topics are electives you can come back to.
The OpenGitOps principles, the Kubernetes reconciliation machinery that makes them work, and how to structure Git repositories for GitOps.
OpenGitOps Principles & the Reconciliation Loop
schedule6h
GitOps is defined by four OpenGitOps principles: desired state that is declarative, versioned and immutable, pulled automatically and continuously reconciled. Understand them deeply, because every later tool decision is a trade-off against these principles.
GitOps controllers are Kubernetes controllers that apply manifests on your behalf. Learn how the API server merges, owns and reports on objects so you can predict sync results, diffs and health status instead of being surprised by them.
Repository layout decides how safely you can change, review and promote. Learn the trade-offs between monorepo and polyrepo, why application source and deployment config are usually separated, and why a directory per environment beats long-lived environment branches.
Model applications and environments as declarative configuration, and render and validate it before any controller sees it.
Kustomize Overlays & Components
schedule5h
Kustomize patches plain YAML without templates and is built into kubectl, Argo CD and Flux. Learn to keep a clean base and express each environment as a small, reviewable overlay.
Helm remains the main packaging format for third-party software. Learn to consume and author charts declaratively, store them in OCI registries, and understand what Helm 4 (released November 2025) changes, including server-side apply and Wasm plugins.
Templates hide what will actually change in the cluster. The rendered manifests pattern commits fully hydrated YAML so reviewers see real diffs; combine it with schema and policy validation in CI so broken config never reaches a controller.
Run Argo CD, the most widely adopted GitOps controller, from a single application to multi-tenant, templated delivery.
Argo CD Core: Applications, Sync & Health
schedule8h
Learn the Application and AppProject model, how Argo CD compares desired and live state, and how sync options control pruning and self-healing. These are the settings that decide whether drift is merely reported or automatically reverted.
ApplicationSets generate many Applications from one template, which is how teams scale Argo CD across services, environments and clusters. Learn the generators and the safety controls that stop one bad template from deleting everything.
A shared Argo CD becomes critical infrastructure. Learn to run it highly available, integrate SSO and RBAC, isolate tenants with AppProjects and plan safe upgrades across the 3.x releases.
Flux is a set of focused controllers rather than one server with a UI. Learn how sources, Kustomizations and HelmReleases fit together, how to order them with dependencies and how Flux detects and corrects drift.
Flux can deliver manifests as signed OCI artifacts instead of cloning Git in every cluster, and can write new image tags back to Git; image update automation became GA in Flux 2.7. Learn both and when Git-less delivery is the right trade-off.
The Flux Operator manages Flux installations declaratively and adds ResourceSets for templated, self-service application definitions, including ephemeral pull-request environments. Its MCP server lets AI assistants inspect and troubleshoot Flux pipelines within your Kubernetes RBAC.
Release safely with metric-driven canaries, and promote verified changes from environment to environment with an audit trail.
Argo Rollouts: Canary & Blue-Green
schedule6h
Reconciliation gets the new version into the cluster; progressive delivery decides how much traffic it gets. Learn Argo Rollouts strategies and analysis so a bad release is aborted by metrics before most users notice.
Flagger is the progressive delivery companion in the Flux ecosystem. Learn its Canary resource and metric checks if your platform standardises on Flux.
GitOps tells each cluster what to run, but not how a change moves from dev to production. Learn promotion patterns, from automated pull requests that bump image tags to Kargo's warehouses, freight and stages with verification gates and approvals.
Keep secrets out of Git, enforce guardrails with policy as code, and harden the GitOps supply chain and the controllers themselves.
Secrets Management in GitOps
schedule6h
Plain Kubernetes Secrets must never be committed. Compare encrypting secrets in Git (SOPS, Sealed Secrets) with referencing an external store (External Secrets Operator with Vault or a cloud secret manager), and choose based on rotation and audit needs.
Policies turn team agreements into automated guardrails. Learn Kyverno (CNCF graduated in March 2026), OPA Gatekeeper and the built-in ValidatingAdmissionPolicy, and run the same policies in CI as at admission so developers get feedback before merge.
In GitOps, write access to the config repository is effectively write access to production. Learn the threat model and the controls: signed commits and artifacts verified before sync, least-privilege controllers and multi-tenancy lockdown.
Extend GitOps from one cluster to fleets and from applications to cloud infrastructure, then observe it and scale it.
Multi-Cluster & Fleet Management
schedule7h
Most organisations run many clusters per region, environment or customer. Learn the hub-and-spoke and agent-per-cluster topologies, how to target clusters by labels and how to roll out changes in waves to limit blast radius.
GitOps for Infrastructure: Crossplane & OpenTofu Controllers
schedule8h
The same reconcile loop can manage cloud resources. Use Crossplane v2 compositions to offer self-service infrastructure APIs, or the Flux-based Tofu Controller to plan and apply OpenTofu and Terraform continuously with drift detection.
Controllers fail quietly unless you watch them. Export Argo CD and Flux metrics and events, alert on sync failures and drift, and build a troubleshooting routine that traces a problem from commit to pod.
Large fleets stress Git hosts, repo servers and the Kubernetes API. Learn the levers that keep reconciliation fast and cheap: sharding, webhooks instead of polling, OCI sources, caching and a repository layout that limits manifest regeneration.
Milestone: You can manage add-ons and apps across many clusters, provision cloud infrastructure through reconciling controllers, and detect, alert on and remediate drift.
emoji_events
You made it. Keep sharpening with the projects and certifications below.
The tool stack
28 tools and platforms used across this path. Focus on concepts first — tools change, principles don’t.
Build these to prove your skills. Publish each one on GitHub with a clear README and architecture diagram.
01Beginner
Self-Managing Argo CD on a Local Cluster
Bootstrap a kind cluster where Argo CD manages its own installation and a sample application through the app-of-apps pattern, with Kustomize overlays for dev, staging and prod in one config repository. Demonstrate drift being self-healed after a manual kubectl edit.
Argo CD
Kustomize
Kubernetes
Git
02Intermediate
Signed OCI Delivery with Flux
Build a CI pipeline that pushes the image and the rendered manifests as a cosign-signed OCI artifact. Configure Flux to verify the signature before applying and use image automation to open pull requests for new semver tags.
Flux
GitHub Actions
Sigstore
Helm
03Intermediate
Secrets and Guardrails for a GitOps Repository
Deliver application secrets with External Secrets Operator backed by Vault and a SOPS-encrypted bootstrap secret. Enforce Kyverno policies in CI and at admission: no latest tags, resource limits required and only signed images allowed.
External Secrets Operator
Vault
SOPS
Kyverno
04Advanced
Canary Releases with Automated Promotion
Combine an Argo Rollouts canary using Prometheus analysis with Kargo promotion across dev, staging and production, with manual approval before production. Show an automatic abort on a bad release and the audit trail of every promotion.
Argo Rollouts
Kargo
Argo CD
Prometheus
05Advanced
Fleet GitOps for Three Clusters
Use ApplicationSets with the cluster generator to roll out platform add-ons to labelled clusters in waves, created declaratively with Cluster API or a managed service. Add Grafana dashboards and alerts for sync failures and drift.
Argo CD
Cluster API
Prometheus
Grafana
06Advanced
Self-Service Infrastructure API
Publish a Crossplane v2 composition that lets developers request a namespaced database through a simple claim, and manage the shared network with the Tofu Controller and OpenTofu. Demonstrate drift detection and automatic reconciliation after a manual cloud console change.
Crossplane
OpenTofu
Tofu Controller
Flux
Certifications worth earning
Certifications that validate this path’s skills. Always confirm the current exam version on the official page before booking.
workspace_premiumAssociate
Certified GitOps Associate (CGOA)
CNCF / Linux Foundation
The vendor-neutral GitOps credential, covering terminology, the OpenGitOps principles, patterns and tooling.
Designs repository structures, controller setups and promotion flows, and keeps Argo CD or Flux healthy as the number of apps and clusters grows.
badge
Platform Engineer
Uses GitOps as the delivery engine behind an internal developer platform, offering golden paths, ApplicationSets or ResourceSets and self-service environments to product teams.
badge
Release Engineer
Owns progressive delivery and promotion: canaries, analysis, approvals and the audit trail that shows exactly what changed in each environment and why.
badge
Site Reliability Engineer
Relies on GitOps for drift detection, fast rollback by revert and a complete change history, and wires controller signals into alerting and incident response.
badge
Cloud Infrastructure Engineer
Manages cloud resources through reconciling controllers such as Crossplane or the Tofu Controller, exposing safe infrastructure APIs to application teams.
Frequently asked questions
What is GitOps, and how is it different from running kubectl apply in a CI pipeline?add
In push-based CI/CD, the pipeline holds cluster credentials and applies changes once. In GitOps, an agent inside the cluster pulls the desired state from Git or an OCI registry and keeps reconciling it, so drift is detected and corrected, credentials stay in the cluster and every change has a reviewed commit behind it.
Should I learn Argo CD or Flux first?add
Start with Argo CD if you want the most widely adopted tool with a rich UI and strong multi-tenancy, which many job postings ask for. Learn Flux too: its composable controllers, OCI-first delivery and Flux Operator suit platform teams that prefer everything as Kubernetes resources. The concepts transfer, so knowing both makes you far more versatile.
Does GitOps only work with Kubernetes?add
The OpenGitOps principles are tool-agnostic, but Kubernetes is where the ecosystem is most mature because its controllers already reconcile desired state. Cloud infrastructure can be managed the same way through Crossplane or the Tofu Controller, which run on Kubernetes but provision resources anywhere.
How do you handle secrets in GitOps?add
Never commit plain Secrets. Either encrypt them in Git with SOPS or Sealed Secrets, or commit only a reference and let External Secrets Operator fetch the value from Vault or a cloud secret manager. External stores are usually better for rotation and audit at scale.
How do I promote a change from staging to production with GitOps?add
Promotion is a change to the production configuration, typically a pull request that updates an image tag or chart version in the production directory. Tools such as Kargo, Argo CD Image Updater and Flux image automation automate this with verification gates and approvals, avoiding long-lived environment branches.
Which GitOps certification should I take?add
The Certified GitOps Associate (CGOA) is the vendor-neutral starting point and tests principles and patterns. Add the Certified Argo Project Associate (CAPA) if you work with Argo, and the CKA or CNPE to prove hands-on Kubernetes and platform skills.
Do I still need Terraform or OpenTofu if I adopt GitOps?add
Usually yes. Many teams use Terraform or OpenTofu to create clusters and foundational cloud resources, then GitOps for everything inside the cluster. You can also bring IaC into the GitOps loop with the Tofu Controller, or replace parts of it with Crossplane compositions.