All 28 GitOps Principles questions
More in GitOps Principles
What is idempotency and why does it matter in GitOps? What is configuration drift and how does GitOps handle it? What are the benefits of GitOps over traditional deployment approaches? How do you perform a rollback in a GitOps workflow? How are secrets managed securely in a GitOps workflow? How does GitOps improve security and compliance? How does GitOps enable auditability and compliance evidence? What is the difference between GitOps and Infrastructure as Code (IaC)? How do you handle non-Kubernetes resources in a GitOps model? How does GitOps improve developer experience?
Advertisement
ArgoCD › GitOps Principles

What belongs in Git and what should not in a GitOps setup?

Intermediate

Answer

Git holds declarative desired state: Kubernetes manifests, Helm charts/values, Kustomize overlays, and config. It should not hold plaintext secrets. Sensitive data is handled via sealed secrets, external secret operators, or SOPS-encrypted files so Git stays the source of truth without exposing credentials.
Real-world example Manifests and Helm values live in Git, while database passwords are pulled at runtime from a secrets manager via the External Secrets Operator.

Common follow-ups: How are secrets managed in GitOps? | Should generated artifacts be committed?

Applications RBAC GitOps Principles
All 28 GitOps Principles questions