Infrastructure
GitOps Explained: The Engineer's Guide to Declarative Infrastructure Management
A comprehensive guide for engineers on implementing GitOps principles for automated, declarative, and auditable infrastructure and application delivery.
GitOps is a modern operational framework that uses a Git repository as the single source of truth for managing both infrastructure and applications. It extends the principles of Infrastructure as Code (IaC) by applying DevOps best practices like version control, collaboration, compliance, and CI/CD to system management. Instead of using imperative scripts or manual commands to configure a system, the desired state is declared in files within a Git repository, and an automated process ensures the live environment converges to that state.
This approach solves critical challenges in modern software delivery, providing a clear, auditable trail of every change, which drastically improves security and compliance. By managing infrastructure through pull requests, teams gain robust review and approval workflows. Automated reconciliation agents, such as Argo CD or Flux, continuously monitor the repository and the live state, correcting any configuration drift and ensuring reliability, consistency, and a faster mean time to recovery (MTTR) across all environments.
Latest briefings on GitOps Explained: The Engineer's Guide to Declarative Infrastructure Management
Infra
Vercel Just Opened Its Container Registry Publicly
Vercel now allows developers to make their container repositories public. This lets any Vercel user pull and use images, simplifying distribution for open-source projects and public tools, a feature common on other major cloud platforms.
Ashish Kale ·
AI
Spotify Built an AI to Rewrite Its Entire Codebase
Spotify created an AI coding agent called "Honk" to automatically update its massive codebase. This helps them manage technical debt and standardize code across thousands of repositories, offering a model for large-scale software maintenance.
Neeraj Dhiman ·
Infra
AWS Tool Stops AI Agents From Making Risky Moves
AWS has launched Dogwood, a new open-source tool for AI agents. It prevents them from taking individually valid actions that become dangerous in sequence, giving developers more control over agent safety and reliability.
Ashish Kale ·
Infra
GitLab Wants to Be Your Only Secrets Manager
GitLab's Secrets Manager now works with Terraform and Kubernetes via the External Secrets Operator. This lets teams stop managing separate secret stores, simplifying workflows and boosting security by having one central place for all credentials.
Ashish Kale ·
Infra
AI Agents Don't Need Their Own Kubernetes Pods
A new approach for running AI agents on Kubernetes argues that assigning one pod per agent is wasteful. Instead, a shared pool of worker pods can run many agents, saving resources and improving efficiency for AI-native applications.
Ashish Kale ·
AI
Vercel Built a Language for AI to Write Code
Vercel Labs has released an experimental programming language called Zero, designed for AI agents, not humans. This signals a future where developers manage AI that writes code, aiming for faster, more automated software creation.
Neeraj Dhiman ·
Infra
Vercel Boosts Sandbox Compute Power Over Tenfold
Vercel has significantly increased the capacity of its Sandbox feature for Pro and Enterprise users. The update allows for 10,000 concurrent sandboxes and a tenfold increase in CPU allocation, enabling more complex, large-scale applications like AI tools.
Ashish Kale ·
Infra
Manage All Your AI Models Through Your AWS Bill
Vercel's AI Gateway is now on the AWS Marketplace, letting teams buy and manage access to hundreds of AI models directly through their AWS account. This simplifies billing and cost control for companies using multiple AI services.
Ashish Kale ·
Data
ClickHouse Cloud Autoscaling Now Reacts in Seconds
ClickHouse Cloud rebuilt its autoscaling system to react to demand in seconds instead of minutes. This new 'fast path' approach helps prevent performance bottlenecks during traffic spikes and improves resource efficiency for its cloud database service.
Taranpreet Singh ·
Infra
Build Platforms That Actually Help Your Developers
Microservices expert Chris Richardson explains how to build internal platforms that reduce developer cognitive load. He outlines six key patterns to help teams ship features faster without getting bogged down by infrastructure complexity.
Ashish Kale ·
Data
PostgreSQL Tool Lowers Risk With Granular Permissions
E-Maj, a PostgreSQL extension for database management, released version 5.0.0. It now allows non-superusers to use the tool, significantly improving security by limiting administrator privileges and simplifying automated scripting for developers.
Taranpreet Singh ·
Infra
Vercel Adds a Firewall to Guard Your Files
Vercel has launched its Web Application Firewall for Blob storage, available on all plans. This lets developers protect stored files like images and AI media from unwanted traffic, preventing high costs and security risks.
Ashish Kale ·
Infra
HashiCorp Vault Now Secures Kubernetes From the Outside
HashiCorp released a public beta of a new Vault feature for Kubernetes. It lets you manage the encryption keys for your cluster's sensitive data outside of Kubernetes itself, adding a powerful new layer of security and compliance.
Ashish Kale ·
Infra
New Tool Brings Central Control to Linux Desktops
A new open-source tool called Bor lets IT and security teams centrally manage fleets of Linux desktops. It uses a modern architecture to enforce policies for browsers, package management, and system settings in real time.
Ashish Kale ·
Tech
Drones Now Fly Into Storms for Better Forecasts
A new system uses automated drones to collect atmospheric data, offering a more precise and reusable alternative to traditional weather balloons. This could significantly improve hyperlocal weather forecasting for sensitive industries.
Taranpreet Singh ·
Infra
Terraform Adds Native Policy Checks to Your Workflow
HashiCorp's Terraform now has a built-in policy framework called tfpolicy. This lets teams write and enforce infrastructure rules using the same HCL language they already use, simplifying compliance and security without needing extra tools.
Ashish Kale ·
AI
Google AI Teaches Robots to See and Collaborate
Google DeepMind has released Gemini Robotics ER 2, a new AI model that allows robots to understand video, reason about tasks, and collaborate with each other. This could significantly accelerate automation in complex, real-world environments.
Neeraj Dhiman ·
Infra
AWS Removes a Major Lambda Code Storage Limit
AWS Lambda no longer enforces its 75 GB per-region code storage quota for functions stored in your own S3 bucket. This change helps large organizations scale their serverless applications without hitting a previously restrictive account-wide limit.
Ashish Kale ·
AI
AI Agents Are Now Automating B2B Sales
New AI agents are automating B2B sales by identifying customer cues and acting on them instantly. This approach reduces delays and gives sales teams smarter insights, making the entire process faster and more effective for businesses.
Neeraj Dhiman ·
Infra
Dynatrace AIOps Moves from Guessing to Knowing
Dynatrace is upgrading its AIOps platform to move beyond predictions. The new system uses deterministic analysis to pinpoint root causes and automatically resolve infrastructure issues, aiming for truly autonomous IT operations for SRE teams.
Ashish Kale ·
Infra
Your Job Is No Longer Correcting AI Code
The role of software engineers is shifting from writing and fixing code to designing the systems and infrastructure that AI agents will operate within. This change elevates the engineer's role to that of a system architect.
Ashish Kale ·
Infra
New AWS Agent Finds and Fixes Cloud Overspending
AWS has launched a new managed service called FinOps Agent. It automatically investigates cost spikes, finds the cause, and sends alerts to the right teams through tools like Slack and Jira to help control cloud spending.
Ashish Kale ·
Infra
Argo CD Now Verifies Your Code’s Origin
The popular cloud deployment tool Argo CD is getting a major security boost. Its latest update adds features to verify that your code is authentic and to encrypt internal traffic, helping to secure your software supply chain.
Ashish Kale ·
Infra
Get a Clearer View of Your Kubernetes AI Jobs
A new plugin for the Headlamp Kubernetes UI now supports Volcano, a popular batch scheduler for AI and high-performance computing. This gives developers a simple web interface to inspect and manage complex batch jobs directly within Kubernetes.
Ashish Kale ·
Infra
Secure Remote Access Just Got a Replay Button
HashiCorp's Boundary 1.0 is now production-ready, adding a key feature: RDP session recording. This helps security and IT teams monitor remote desktop access and meet strict compliance and audit requirements.
Ashish Kale ·
Data
Keep Your Old PostgreSQL Database Secure for Longer
A new service from PGX offers security patches and bug fixes for old, unsupported versions of PostgreSQL. This helps companies that can't upgrade stay secure and maintain data integrity without a costly migration.
Taranpreet Singh ·
Infra
Cloudflare Replaces API Tokens with Secure Logins
Cloudflare now lets all developers use OAuth for third-party app integrations. This offers a more secure alternative to traditional API tokens, giving users granular control over what data and actions an application can access.
Ashish Kale ·
Infra
AI Is Turning Developers Into Code Validators
A new GitLab report finds AI code tools are turning developers into validators, not just writers. This shift creates new risks, as teams struggle to control the quality and security of code they didn't write.
Ashish Kale ·
Infra
Find and Fix Workflow Bugs Faster on Vercel
Vercel has launched a redesigned trace viewer for its Workflows tool. The update helps developers debug complex processes more quickly by making it easier to search, zoom, and inspect each step of a workflow run.
Ashish Kale ·
Infra
Why Azure Says Stop Blaming People for Outages
A post-mortem of Azure's 2023 global outage reveals a crucial lesson: "human error" is a myth. Engineering leaders should instead focus on fixing systemic flaws to build truly resilient systems and protect their teams from blame.
Ashish Kale ·
Frequently asked questions
What is the difference between GitOps and Infrastructure as Code (IaC)?
Infrastructure as Code (IaC) is the practice of defining infrastructure in code (e.g., Terraform, CloudFormation). GitOps is an operational model that builds upon IaC by using a Git repository as the definitive source of truth and employing automated agents to continuously reconcile the live infrastructure with the state declared in Git.
How does GitOps improve security compared to traditional CI/CD?
GitOps enhances security by providing an immutable, auditable log of all changes via Git history. It limits direct access to production environments, as all changes are made via pull requests, enabling policy-as-code enforcement and peer review before any modifications are applied automatically.
What are the core components of a GitOps workflow?
A typical GitOps workflow consists of a Git repository containing declarative definitions, a CI pipeline to build and push artifacts (like container images), and a GitOps operator (e.g., Argo CD, Flux) running in the target environment. The operator continuously compares the live state with the desired state in Git and automatically applies any necessary changes.
Can GitOps be used for managing systems other than Kubernetes?
Yes, while GitOps gained prominence with Kubernetes, its principles are system-agnostic. The model can be applied to manage any system that can be described declaratively, including virtual machines, cloud provider resources using tools like Terraform, and even network configurations, as long as an automated reconciliation process is in place.