GitOps with ArgoCD and Flux: Declarative Deployment and Drift Detection

GitOps is a deployment model where Git is the single source of truth for the cluster's desired state, and a controller running inside the cluster continuously reconciles that state by pulling from Git.

Core properties

• Deployment is declarative: you commit YAML or Helm/Kustomize to Git; the controller applies it.
• Rollback is git revert; audit is git log; drift detection is continuous because the controller keeps reconciling.
• Pull-based security: the cluster pulls from Git; CI never needs cluster credentials, which is a big win for regulated environments.

ArgoCD

• Opinionated with a strong UI. An Application CRD points at a Git path + destination cluster/namespace with a sync policy.
• ApplicationSet templates many Applications — add an environment, an Application appears.
• Multi-cluster from a management cluster; strong RBAC via Projects; progressive delivery via Argo Rollouts.
• Helm gotcha — renders with helm template by default, so helm history is empty; rollback is Git revert.

Flux

• Modular set of controllers: source-controller, kustomize-controller, helm-controller, notification-controller, image-automation-controller.
• HelmRelease creates REAL Helm releases so helm history and helm rollback work natively.
• Image automation watches registries and commits new tags back to Git automatically — closes the loop without a separate CI bump job.
• Lightweight, per-cluster deployment; UI story is weaker out of the box (use Weave GitOps or Flux UI add-ons).

Secrets

• Never commit plain secrets. Three options: Sealed Secrets (encrypt to cluster public key), SOPS (KMS-encrypted YAML; Flux has native support), External Secrets Operator (sync from AWS Secrets Manager / Vault / Azure Key Vault).
• ESO is the modern default — secrets stay in a purpose-built vault, ESO syncs on demand, rotation handled by the vault.

Progressive delivery

• Argo Rollouts replaces Deployment with a canary or blue-green spec that runs automated analysis (Prometheus queries) before promoting.
• Flagger does similar canary work integrating with service mesh traffic weighting; works with plain Deployments.

Decision guidance

• Pick ArgoCD for UI-driven multi-team visibility and multi-cluster fan-out from a central control plane.
• Pick Flux for native Helm release support, image automation, and a Kubernetes-native building-block approach.
• Both are CNCF graduated and production-grade.

Common gotchas

• Auto-sync plus prune in prod without branch protection is dangerous — require PR review and CODEOWNERS.
• Operator-managed CR fields drift (e.g., status) — mark them as IgnoreDifferences.
• Large repos slow reconciliation — split sources or scope Applications by path.
• RBAC on the env Git repo IS the access control — anyone who merges can change the cluster.