GitOps stores desired declarative system state in Git and uses an in-environment agent to reconcile that state. On Azure, Flux extensions can reconcile AKS or Azure Arc-enabled Kubernetes. GitOps improves auditability and drift correction, but it requires repository governance, safe secret delivery, dependency ordering, health checks, and emergency procedures.
A push pipeline authenticates to the cluster and applies changes. A GitOps agent inside the environment pulls a declared revision and reconciles continuously. The CI pipeline still builds and tests artifacts; it updates an environment repository or opens a promotion pull request rather than holding cluster-admin credentials.
Do not store plaintext secrets. Use Key Vault CSI/provider, External Secrets under an approved design, or encrypted secret workflows with controlled keys.
Ways to build
Choose the Azure tool you want to use. The underlying resource stays the same.
Open the AKS resource → GitOps → Create. Choose the Flux extension, repository URL, branch, path, cluster or namespace scope, reconciliation interval, and an approved authentication method. Review the configuration and wait until the compliance/reconciliation state is healthy.
Progressive delivery exposes a release to increasing traffic or user segments while checking health. Use App Service slots, Container Apps revisions, AKS canary tools, or Front Door origin weighting. Define success metrics and automatic abort before rollout.
A canary needs comparable traffic and enough samples. Ten requests with no errors do not validate a high-volume release.
A deployment puts code in the environment. A feature flag changes runtime behavior for selected users without redeploying. Azure App Configuration provides feature-management support. Flags need owners, expiry dates, secure evaluation context, default behavior, telemetry, and removal after rollout. Do not use a client-visible flag to protect a server-side authorization rule.
Revert the Git commit or promote the last known-good artifact digest. The reconciler restores declared state. If a manual emergency change is required, record it and reconcile the repository immediately; otherwise GitOps will undo it.
Data migrations and external side effects may not be reversible. Use expand/contract schemas, compensating actions, and roll-forward plans.
Pruning deletes resources removed from Git. Enable it only after repository scope and ownership are clear. Protect shared namespaces, CRDs, persistent volumes, and cluster-level resources. Use separate reconcilers/repos and RBAC for platform and application scopes.