CI/CDGitOps = Git là single source of truth cho cả app code lẫn infrastructure state — cluster tự reconcile để match Git, không có ai kubectl apply bằng tay. Nguyên tắc cốt lõi:
- Declarative — toàn bộ state mô tả bằng YAML/Helm/Kustomize trong Git;
- Versioned & immutable — mọi thay đổi qua PR, history rõ ràng;
- Pulled automatically — agent trong cluster pull config từ Git, không push từ CI;
- Continuously reconciled — agent detect drift và tự sửa. ArgoCD: agent chạy trong K8s cluster, watch Git repo, sync resources tới namespace target
UI đẹp, hỗ trợ multi-cluster, app-of-apps pattern, sync waves, hooks.
Truy cập qua argocd CLI hoặc web UI. Flux (CNCF graduated): nhỏ gọn hơn ArgoCD, không có UI native (dùng Flux extension hoặc Weave GitOps), tích hợp tốt với Kustomize và Helm Controllers, có Image Automation Controller tự bump image tag khi có release mới. Lợi ích GitOps: audit trail (mọi deploy đều có commit), rollback bằng git revert, disaster recovery (cluster gone? re-create từ Git), no CI credentials in cluster (pull thay vì push — bảo mật hơn). Trade-off: thêm 1 component (Argo/Flux) phải maintain; debug khó hơn khi sync fail; phải educate team về branch strategy cho config repo.
GitOps = Git is the single source of truth for both app code and infrastructure state — the cluster reconciles itself to match Git; nobody runs kubectl apply manually. Core principles:
- Declarative — entire state described in YAML/Helm/Kustomize in Git;
- Versioned & immutable — every change goes through a PR with clear history;
- Pulled automatically — an agent inside the cluster pulls config from Git, not pushed from CI;
- Continuously reconciled — the agent detects drift and self-heals. ArgoCD: an agent running in the K8s cluster, watches a Git repo, syncs resources to a target namespace
Nice UI, multi-cluster support, app-of-apps pattern, sync waves, hooks.
Access via the argocd CLI or web UI. Flux (CNCF graduated): more lightweight than ArgoCD, no native UI (use the Flux extension or Weave GitOps), great Kustomize and Helm Controller integration, has an Image Automation Controller that auto-bumps image tags on new releases. GitOps benefits: audit trail (every deploy is a commit), rollback via git revert, disaster recovery (cluster gone? recreate from Git), no CI credentials in the cluster (pull instead of push — more secure). Trade-offs: one extra component (Argo/Flux) to maintain; debugging is harder when sync fails; team must learn branch strategy for the config repo.