Our team is already using Terraform to manage our AWS environment, but we are struggling with "configuration drift" where manual changes in the console make our code obsolete. I’ve heard that GitOps can solve this by making Git the single source of truth. How does the workflow actually change for an infrastructure team? Specifically, in 2024, what tools are leading the way for non-Kubernetes resources, and how do we handle the "loop" that automatically corrects the cloud state when it deviates from our Git repo?
3 answers
The core shift in GitOps is moving from a "Push" model to a "Pull" model. In traditional CI/CD, your Jenkins or GitHub Actions runner "pushes" changes to the cloud using a provider's API. In GitOps, an agent (controller) sits inside your environment and constantly compares the live state to your Git repository. In 2024, the best practice is to use Crossplane or Terraform Controllers (like Flux's TF-controller). Crossplane is particularly powerful because it turns your cloud services (S3 buckets, RDS instances) into custom resources that look and act just like Kubernetes objects. This allows you to manage "Off-Cluster" resources using the same GitOps heart-beat that manages your applications.
The most important part of the GitOps lifecycle is the Reconciliation Loop. If someone goes into the AWS Console and manually changes a security group rule, the GitOps controller detects the "drift" and automatically overwrites the manual change to match the code in Git—wouldn't that finally kill the "hidden manual fix" problem that plagues most DevOps teams?
Don't forget about Secret Management! Since everything is in Git, you must use tools like Sops or Sealed Secrets to encrypt your sensitive infrastructure data before pushing it to your repository.
Great point, Amanda. GitOps without encrypted secrets is a security disaster waiting to happen. In 2024, integrating External Secrets Operator to pull from AWS Secrets Manager directly into your GitOps flow is the gold standard.
Robert, you hit the nail on the head. That "self-healing" capability is the primary reason to switch. For anyone starting this in 2024, I recommend looking at OpenTofu (the open-source fork of Terraform) combined with ArgoCD. ArgoCD provides a brilliant UI that visually shows you exactly which infrastructure components are "OutOfSync" with your Git repo. It makes auditing your cloud environment as simple as looking at a green or red status icon.