01
Teams often discuss Argo CD versus Flux as a preference debate. The harder question is ownership: who controls sync, environments, secrets, drift, rollback, and developer feedback?
Case 04 · Flagship
GitOps: Argo CD & Flux
GitOps is not just a deployment tool choice. It is a platform contract for how teams promote, observe, roll back, and audit Kubernetes state.
01
How it works
From Git intent to a reviewable sync.
GitOps delivery by Andrey Lesnikov — declare desired state, sync with Argo CD or Flux, prove health, and design rollback before pressure.
-
01
Declare desired state
Repos layouts, overlays, and secret references make intent reviewable before anything reaches the cluster.
-
02
Sync with ownership
Argo CD or Flux applies state under clear promotion rules — tool choice follows the platform contract, not the other way around.
-
03
Prove health
Sync waves, health checks, and drift detection keep cluster reality honest against Git.
-
04
Rollback on purpose
Rollback paths are designed while calm so production pressure does not invent the recovery story.
02
Evidence
From problem to proof.
How the system is framed, operated, and proven — not a slide deck summary.
02
A GitOps platform defines repository layout, environment overlays, sync waves, health checks, policy boundaries, secret handling, and rollback contracts.
03
Argo CD offers strong visual operations; Flux fits controller-native workflows. The right decision depends on team model, governance, and platform ownership.
04
gitops-duel runs Argo CD and Flux side by side on kind and benchmarks them with N=3 samples (median, min/max). Profile equal-10s: time to ready 3.759 s (Argo CD) vs 6.167 s (Flux), self-heal 3.666 s vs 12.767 s, deletion recovery 3.130 s vs 70.208 s, commit→ready 19.068 s vs 8.289 s (Demo results run 38131680035, docs/results.md). The ui-backend is hardened: namespaced RBAC, allowlisted git-manifests hosts and size limits; API bearer token is always required for /api (PR #30) — startup fails without UI_API_TOKEN unless AUTH_DISABLED=true for local lab (GitOps Duel CI run 38137426553). Lab timings on sample nginx apps, not production sync SLOs.
Constraints
Multi-environment promotion, drift detection, rollback safety, secret handling, and developer feedback loops.
03
Related
Nearby systems.
Argo CD App of Apps
As platforms grow, application onboarding, add-ons, and environment drift become hard to reason about
Platform bootstrapable from Git
Multi-Region GitOps
Multi-region systems need repeatable promotion and rollback without turning every deployment into manual coordination
Regional drift stays auditable
Architecture Rehearsal
Teams discover architectural blast radius only after a change lands in production
Pre-deploy break risk → verified after change
Available for meaningful infrastructure conversations