> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GitOps Explained Desired State Drift and Reconciliation

> Explains GitOps principles, the declarative desired state model, reconciliation loops, drift detection and remediation strategies to keep Kubernetes clusters auditable and consistent with Git.

Welcome to GitOps and Continuous Delivery.

Imagine this scenario: it's two a.m. and your pager goes off — production is down. You SSH into the cluster to investigate and find something has changed, but there is no record of what was changed, when, or by whom. You're effectively flying blind. That is the world before GitOps.

In this lesson we explain what GitOps solves, define the four pillars of GitOps, show how the reconciliation loop works, and describe drift detection and remediation patterns that restore order and auditability to production.

![A slide titled "Learning Objectives" with a blue gradient sidebar and four colorful numbered markers. The items list GitOps topics: problems GitOps solves, the four pillars (declarative, versioned, pulled, reconciled), the reconciliation loop, and drift detection/self-healing.](https://mintcdn.com/kodekloud-c4ac6d9a/seqLTE3JlSrVAtw9/images/Prep-Course-Certified-Cloud-Native-Platform-Engineering-CNPE/GitOps-and-Continuous-Delivery/GitOps-Explained-Desired-State-Drift-and-Reconciliation/gitops-learning-objectives-pillars-reconciliation-drift.jpg?fit=max\&auto=format\&n=seqLTE3JlSrVAtw9\&q=85\&s=e79fef67bd85a2da2a42f32d9cdcd39f)

Problem statement

Many Kubernetes environments still allow developers and operators to make live changes directly with tools like `kubectl`. These ad-hoc edits, often made under time pressure, create a fragmented change history and reduce visibility:

* No central record of changes, authors, or timestamps.
* Conflicting or overlapping edits from multiple teams.
* Harder root-cause analysis, longer outages, and fragile recovery procedures.

When changes are applied directly to clusters without a single source of truth, production stability depends on memory and manual coordination rather than on an observable, auditable deployment process.

![A diagram titled "Deployment Roulette" showing three uncoordinated teams (Team A Dev, Team B Ops, Team C SRE) each pushing into a single production cluster, resulting in a warning box labeled "Conflicting changes."](https://mintcdn.com/kodekloud-c4ac6d9a/seqLTE3JlSrVAtw9/images/Prep-Course-Certified-Cloud-Native-Platform-Engineering-CNPE/GitOps-and-Continuous-Delivery/GitOps-Explained-Desired-State-Drift-and-Reconciliation/deployment-roulette-uncoordinated-teams-conflict.jpg?fit=max\&auto=format\&n=seqLTE3JlSrVAtw9\&q=85\&s=c01f14acbdcccfa423d5110170c95d13)

Why this happens

The root cause is the imperative model: you run commands that change the cluster immediately, and unless you also persist those changes into a versioned store, the cluster becomes a source of truth that is hard to audit.

Common imperative commands:

```bash theme={null}
$ kubectl scale deploy/api --replicas=5
$ kubectl set image deploy/web nginx:1.21
```

These commands mutate live state but do not automatically create a versioned, auditable record of the intended desired state.

Declarative model and GitOps

In the declarative model you express the desired state as files (YAML/JSON, Helm charts, Kustomize overlays), commit them to Git, and let automated controllers converge the cluster to that desired state. Git provides:

* Version history and timestamps
* Commit authorship for auditability
* Simple rollback by reverting commits

GitOps is the operational model that treats Git as the single source of truth: you "declare" the desired state and automation continuously reconciles the cluster to match that declaration.

![A presentation slide titled "Git as the Single Source of Truth" showing a Git repository icon labeled "Git Repositories (Source of Truth)" with an arrow pointing to a document icon labeled "Declarative Description (YAML/JSON)" under the heading "GITOPS: AN OPERATIONAL MODEL."](https://mintcdn.com/kodekloud-c4ac6d9a/seqLTE3JlSrVAtw9/images/Prep-Course-Certified-Cloud-Native-Platform-Engineering-CNPE/GitOps-and-Continuous-Delivery/GitOps-Explained-Desired-State-Drift-and-Reconciliation/gitops-git-single-source-truth.jpg?fit=max\&auto=format\&n=seqLTE3JlSrVAtw9\&q=85\&s=ff03b49dd788e5e969d58a283109185a)

The four pillars of GitOps

Below is a concise reference for the four core principles every GitOps workflow implements.

| Pillar | What it means | Example / Tools |
| - | - | - |
| Declarative | Describe the desired state (what) not the steps (how). | Kubernetes manifests, Helm charts, Kustomize |
| Versioned | Store desired-state files in Git for history, audit, and rollback. | `git` commits, PRs, protected branches |
| Pulled (pull-based) | Agents inside the cluster pull from Git, reducing external credential exposure. | Argo CD, Flux |
| Reconciled (continuous) | Controllers continuously compare and converge live state to Git. | Auto-sync, manual approval, PR workflows |

![A slide titled "Git as the Single Source of Truth" showing four colored pillars labeled Declarative, Versioned, Pulled, and Reconciled with small icons and short explanations. Each pillar summarizes a Git principle — desired-state files, full history/rollback, agents pulling from Git, and continuous drift detection/correction.](https://mintcdn.com/kodekloud-c4ac6d9a/seqLTE3JlSrVAtw9/images/Prep-Course-Certified-Cloud-Native-Platform-Engineering-CNPE/GitOps-and-Continuous-Delivery/GitOps-Explained-Desired-State-Drift-and-Reconciliation/git-single-source-of-truth-pillars.jpg?fit=max\&auto=format\&n=seqLTE3JlSrVAtw9\&q=85\&s=16164d76cd685810df2896fc6463222a)

Pull-based GitOps improves security posture: controllers running inside the cluster (with scoped credentials) fetch declarative manifests from Git. CI systems don’t need permanent cluster admin credentials to deploy changes.

Reconciliation loop — the engine of GitOps

The reconciliation loop is the continuous cycle controllers use to enforce Git as the source of truth. Conceptually it runs through these stages:

* Code & push: Developers change manifests and push commits to Git.
* Watch / Detect: The GitOps controller (e.g., Argo CD or Flux) sees the change via webhook or polling.
* Compare: The controller diffs the desired state in Git against the live cluster, resource-by-resource.
* Sync / Apply: If differences exist, the controller creates the necessary create/update/delete operations to converge the cluster to Git.

These steps repeat continuously: the controller is always watching, comparing, and ready to synchronize.

![A colorful circular diagram titled "The Reconciliation Loop" showing four stages—Code & Push, Detect & Compare, Sync & Deploy, and Continuous Watch—illustrating a continuous deployment/reconciliation process.](https://mintcdn.com/kodekloud-c4ac6d9a/seqLTE3JlSrVAtw9/images/Prep-Course-Certified-Cloud-Native-Platform-Engineering-CNPE/GitOps-and-Continuous-Delivery/GitOps-Explained-Desired-State-Drift-and-Reconciliation/reconciliation-loop-deploy-cycle.jpg?fit=max\&auto=format\&n=seqLTE3JlSrVAtw9\&q=85\&s=143f984d4fa442ca30446134fcc2a1a7)

Example flow

* You update a Deployment manifest to change an image tag from `v1.0` to `v2.0` and push the commit to Git.
* The controller detects the commit (webhook or polling) and diffs the live Deployment.
* The image mismatch is found; the controller updates the Deployment to `v2.0`.
* No human intervention is required; the controller continuously enforces the declared state.

Drift detection and remediation strategies

Drift occurs when the live cluster diverges from Git. Controllers can be configured to remediate drift in multiple ways depending on governance and risk tolerance:

1. Auto-sync (self-healing)
   * The controller automatically reverts out-of-band changes to match Git. This strictly enforces Git-as-source-of-truth and reduces long-lived divergence.

2. Alert + manual sync
   * The controller detects drift and alerts operators. A human inspects and triggers a sync if appropriate — useful in environments with strict change control.

3. Diff + PR workflow
   * If an intentional change was made directly in the cluster, the controller can create a pull request to update Git, preserving the intentional change while keeping Git authoritative.

Auto-sync can unintentionally overwrite emergency fixes applied directly to the cluster. If you use auto-sync, implement safeguards (alerts, maintenance windows, or temporary disabling) to avoid losing critical incident work.

![A presentation slide titled "Drift Detection and Self-Healing" showing a GitHub response icon and three remediation options: Auto‑Sync (self‑healing), Alert + Manual Sync, and Diff + PR Workflow. Short descriptions say the controller can auto‑revert to Git, alert a human to approve a sync, or create a PR to update Git.](https://mintcdn.com/kodekloud-c4ac6d9a/seqLTE3JlSrVAtw9/images/Prep-Course-Certified-Cloud-Native-Platform-Engineering-CNPE/GitOps-and-Continuous-Delivery/GitOps-Explained-Desired-State-Drift-and-Reconciliation/drift-detection-self-healing-git-remediation.jpg?fit=max\&auto=format\&n=seqLTE3JlSrVAtw9\&q=85\&s=4945a0bb995fc3b242ed410a14c9678b)

Common sources of drift

| Source | Why it causes drift | Example |
| - | - | - |
| Manual `kubectl` changes | Quick fixes or exploratory edits are not persisted to Git. | `kubectl edit deploy/my-app` |
| Emergency incident responses | Operators make temporary fixes that never get committed. | Scale-up to mitigate load during incident |
| Other controllers | Autoscalers or mutation controllers change live resources (replicas, resources, annotations). | HPA adjusts replicas; VPA changes resource requests |
| Auxiliary controllers | Admission controllers or mutating webhooks inject annotations/labels. | Sidecar injectors or policy mutators |

The guiding principle remains: either reconcile the cluster to Git, or update Git with intentional, approved cluster changes.

![A presentation slide titled "Drift Detection and Self‑Healing" with a blue panel listing common causes: 1) manual kubectl changes ("quick fix"), 2) emergency incident response, and 3) other controllers (HPA, VPA).](https://mintcdn.com/kodekloud-c4ac6d9a/seqLTE3JlSrVAtw9/images/Prep-Course-Certified-Cloud-Native-Platform-Engineering-CNPE/GitOps-and-Continuous-Delivery/GitOps-Explained-Desired-State-Drift-and-Reconciliation/drift-detection-self-healing-causes.jpg?fit=max\&auto=format\&n=seqLTE3JlSrVAtw9\&q=85\&s=eecdf54c078728bcdcc88913a6f563a0)

Key takeaways

* Treat Git as the single source of truth: all desired state should live in version-controlled repositories.
* Prefer the declarative model over imperative commands: describe what you want, and let automation handle how to get there.
* Use continuous reconciliation to prevent and correct drift.
* Pull-based controllers improve security by minimizing the need for external systems to hold cluster credentials.

Controllers continuously compare live cluster state to Git and act according to configured policies (auto-sync, manual approval, or PR-driven updates). Relying on Git and continuous reconciliation gives you auditability, reproducibility, and safer production operations.

![A presentation slide titled "Key Takeaways" that lists three points about Git/GitOps: Git as the single source of truth, GitOps using a declarative model with automation to enforce desired state, and the pull-based approach improving security by letting the cluster pull changes from Git.](https://mintcdn.com/kodekloud-c4ac6d9a/seqLTE3JlSrVAtw9/images/Prep-Course-Certified-Cloud-Native-Platform-Engineering-CNPE/GitOps-and-Continuous-Delivery/GitOps-Explained-Desired-State-Drift-and-Reconciliation/git-key-takeaways-declarative-automation-pull.jpg?fit=max\&auto=format\&n=seqLTE3JlSrVAtw9\&q=85\&s=7348f0e1f5ae8e1466f51cee0b61574c)

Links and references

* [Git official site](https://git-scm.com/)
* [kubectl reference](https://kubernetes.io/docs/reference/kubectl/overview/)
* [Argo CD documentation](https://argo-cd.readthedocs.io/en/stable/)
* [Flux project](https://fluxcd.io/)
* [Kubernetes Horizontal Pod Autoscaler (HPA)](https://kubernetes.io/docs/concepts/workloads/controllers/horizontal-pod-autoscaler/)
* [Vertical Pod Autoscaler (VPA)](https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler)

> **[Watch Video](https://learn.kodekloud.com/user/courses/prep-course-certified-cloud-native-platform-engineer-cnpe/module/dff5382b-dbe7-4cac-bd2b-d5a47028945e/lesson/c28403c7-4078-4ed2-a273-ec35b204e887)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.