How do you implement GitOps for declarative infrastructure and application management?
GitOps uses Git as the single source of truth for declarative infrastructure and applications. Principles: declarative configuration (desired state defined in Git, not imperative commands), version controlled (all changes go through Git with full audit history), automated (software agents ensure the live system matches the declared state), and self-healing (drift from desired state is automatically corrected). Implementation: store all Kubernetes manifests, Helm charts, or Kustomize configurations in a Git repository, deploy an operator (ArgoCD or Flux) in the cluster that watches the Git repository, and the operator continuously reconciles the cluster state with the repository state. ArgoCD: install in the Kubernetes cluster, create Application resources that point to Git repositories, ArgoCD detects changes in Git and syncs to the cluster, dashboard shows sync status and diff between desired and live state, and rollback is as simple as reverting a Git commit. Workflow: developer makes a code change, CI pipeline builds and pushes a container image, CI updates the image tag in the GitOps repository (automated via image updater or manual PR), ArgoCD detects the change and syncs the cluster, and the new version is deployed. Benefits: complete audit trail (Git history shows who changed what and when), easy rollback (git revert), consistent environments (same configuration for staging and production with environment overlays), and disaster recovery (recreate any environment from Git). Multi-environment: use Kustomize overlays or Helm values files for environment-specific configuration (dev, staging, production), implement promotion workflows (merge to staging branch deploys to staging, merge to main deploys to production). Security: implement branch protection (require reviews for production changes), sign commits for non-repudiation, implement RBAC on ArgoCD for team-level access control, and encrypt secrets in Git (sealed-secrets, SOPS, or external secrets operator).