What is GitOps?

GitOps is an operational framework for the continuous deployment of digital infrastructure, configurations, and compliance policies. GitOps uses Git’s version control system with declarative infrastructure as code (IAC) to describe the desired state of a system, including the configuration of machines, operating systems, and clusters. When using GitOps, a code commit to a Git repository can initiate deployment to a specific environment. GitOps controllers monitor production environments to detect drift from the desired state and can pull from Git to correct the running system’s state. GitOps is a key efficiency mechanism for organizations that deploy and manage infrastructure across cloud-based and containerized environments.

GitOps has several benefits that can have a significant impact on an organization’s operations.

Accelerate deployment velocity

Using GitOps, any infrastructure and application configurations or environment changes can be immediately reflected in the live system with automated deployment. This automated deployment process allows up to thousands of incremental changes per day with immediate results, speeding infrastructure development and operations teams’ workflows. With a versioned history of code changes, any new deployment with errors can be rolled back to a previous stable version.

Decrease management complexity across projects

GitOps creates repeatable workflows and pipelines for developers and infrastructure engineers to follow. With repeatable processes, operations tasks become less complex and more repeatable, decreasing manual processes in configuration.

Enhance security and compliance

When you declare policy as code as part of your projects, you can help ensure that each deployment meets compliance standards as defined in your Git repository. Codifying and versioning security and compliance controls helps you meet legislative requirements and industry rules, and gives you an audit trail with a versioned log of these changes.

Automate system stability

Controller software can examine the state of a running system against the versioned code history to determine whether there is drift. In cases where you find drift, controller software can pull from the codebase and insert updates into the running system where possible, to realign its state.

The way that GitOps works depends on your Git configuration or GitOps tool of choice. However, there are some common functions in all environments.

Git repository

You store source code to describe software, infrastructure, policy, and other configurations in Git source repositories, all using the same version control system. This code follows the same Git best practices as software development, including branching for experimental features and bug fixes, and keeping the main source repository clean. Infrastructure engineers make pull requests to retrieve a branch, so they can work on it locally, whereas a push to the branch shares their updates to the infrastructure code. Pull requests are different from the pull operations that controller software makes.

The way you organize source repositories depends on your needs. For instance, some repos simply have different folders for app code, infrastructure code, and configuration code, whereas others have separate repos for each. Using separate repositories is the easiest way to manage permissions across a project, whereas a single repository makes dependency tracking easier.

These source repositories are the desired state of your system’s configurations and environments. The repos contain files such as Kubernetes manifests, YAML, JSON, and ENV configuration files.

GitOps tools

Organizations can use specialized GitOps, infrastructure as code, and policy engine tools to help build, manage, and scale projects and environments. These tools hook into cloud environments and services, and DevOps environments, allowing integration into multi-vendor situations.

GitOps controllers and continuous drift checks

GitOps controllers are the software modules that monitor the state of your system as compared to the state of the system in Git. GitOps controllers, or GitOps operators, can also perform a pull from Git to sync the current system with the desired state stored in Git.

The running state of an application in production is compared to the declared system state in Git’s version history, as the single source of truth, to see whether there are discrepancies or drift. If there is drift beyond the bounds of your settings, the GitOps controller manages the application sync with your Git repository to align again.

Automated policy enforcement and policy engines

By including policy as code as a part of your declarative configuration in your source code, Git can automate policy enforcement across projects before they reach production environments. Policy as code is increasingly considered a core GitOps principle and is critical for any organization serious about compliance. With policy as code, other code changes must pass through policy gates before they can move to the next stage. GitOps controllers can also check if deployed resources deviate from the described policies in Git and alert human operators or take automated remediation steps.

Traditional Continuous Integration and Continuous Delivery (CI/CD) are core functions of DevOps, which is the automation of the software development and delivery lifecycle.

GitOps can cover the CI/CD processes for software development and delivery; however, it is mainly used for infrastructure, configuration, and policy change management and control. For example, an organization using GitOps might not do any of its own software application development, but instead roll out virtualized infrastructure sites for clients to run their own applications.

GitOps best practices follow best practices from Git and CI/CD workflows.

Follow repeatable Git patterns

For repeatability between projects, follow the same directory structures, tagging practices, and branch naming strategies across all projects. You can list these Git guidelines in an organization-wide playbook. Set up global hierarchies, tags, and defaults within your Git systems and enforce them by using CI/CD checks.

Use multiple environments with gate conditions

Infrastructure should always be tested before deployment to a production environment. In practice, this means having multiple environments for different activities, including configuration and infrastructure changes. For instance, consider using a test environment and a scaled deployment environment. Gate the production environment so that code has to first pass CI/CD test checks in and runtime tests within your test environments and deployment pipelines.

Automate drift alerts in deployments

To maintain infrastructure that adheres to set performance goals in production, automate alerts for drift. You can also compare the performance metrics of the infrastructure in production to other, previous versions. You can also set up GitOps workflows to roll back infrastructure if there is significant drift.

Use meaningful commit messages

Each commit must have a meaningful comment for the reason behind a change and its expected outcome. Provide guidelines to developers and engineers that describe how to write a meaningful commit message.

Use versioned artifacts alongside version history

For each deployed application version, store the deployable artifact and any associated generated files alongside.

Isolate secrets

Secrets, such as API keys, credentials, and certificates, should not be stored in Git repos. Instead, use secrets management tools that integrate with your systems for automated secret retrieval and use.

Infrastructure as code is the source code stored in Git repositories that describes a deployable environment. Using this code, actions such as Git push can become infrastructure automations to deploy the described system. GitOps helps with the operationalization and management of infrastructure as code.

Infrastructure resource usage rises and falls depending on user demand and system requirements. If GitOps controllers are monitoring your deployments for specific usage levels, you can deploy new configurations based on rising or falling resource use. In this case, the controller can identify a change in resource use that deploys a different infrastructure configuration for maximum resource efficiency.

AWS services are designed to integrate with modern GitOps environments and tooling so that organizations can deploy, manage, and configure AWS cloud resources with Git. Here are some services that can help you with implementing GitOps on AWS for infrastructure and application management:

• AWS CloudFormation helps you speed up cloud provisioning with infrastructure as code. AWS CloudFormation's Git Sync feature allows you to synchronize your modern cloud infrastructure stacks from a remote Git repo for GitOps deployments.
• Amazon Managed Service for Prometheus provides highly available, secure, and managed monitoring for your containerized systems, allowing you to monitor drift in production, plus monitor your GitOps controllers.
• Amazon Elastic Kubernetes Service (EKS) allows you to build, run, and scale production-ready Kubernetes applications easily across any environment. Amazon EKS allows you to integrate GitOps tooling and run controllers on your Kubernetes clusters.

Get started with GitOps on AWS by creating a free account today.