GitOps Readiness Checklist
A readiness check for GitOps that confirms Git as the single source of truth, automated reconciliation, drift self-healing, Git-revert rollback, and least-privilege controller access. Drift and rollback are tested deliberately, not assumed.
When to Use This Checklist
Use this checklist when adopting GitOps for the first time or hardening an existing setup built on a reconciliation tool. GitOps treats Git as the single source of truth for declarative infrastructure and application state, with an automated controller that continuously reconciles the live system toward what Git describes. This checklist confirms the model is implemented faithfully rather than as scripts that merely happen to live in a repo.
How to Use This Checklist
Start by confirming the declarative source of truth, then verify that a controller, not a human running commands, applies it. The two most important properties to test are drift detection and rollback. Make a deliberate out-of-band change to a cluster and confirm the controller reverts it. Then revert a commit and confirm the cluster follows. These two tests prove the loop is closed.
Secrets deserve special attention. Plaintext secrets in Git break the model and create a serious exposure, so verify a sealed-secrets or external-secrets mechanism is in place.
What Good Looks Like
Every environment's desired state is declared in Git, separated cleanly by directory, branch, or repository. The only way to change production is a reviewed pull request. A reconciliation controller with least-privilege access applies state and self-heals drift. Rolling back is a Git revert, which makes recovery auditable and boring in the best sense. Sync and health status are visible on dashboards, and every change traces to a commit and an author, giving a clean compliance trail.
Mature setups layer progressive delivery on top, so a merged change rolls out as a canary before full promotion, and can rebuild an entire cluster from Git during disaster recovery.
Common Pitfalls
The biggest pitfall is partial GitOps: manifests live in Git, but engineers still apply changes by hand, so the cluster and the repo silently diverge. Without drift detection and self-healing, Git stops being the source of truth. Storing secrets in plaintext is another frequent and dangerous mistake. Teams also forget that the Git repositories themselves are now critical infrastructure that needs backup and recovery planning, since a lost repo means a lost source of truth.
Related Resources
Anchor the work in GitOps principles, configuration-as-code, and immutable infrastructure. Combine with canary or blue-green delivery to make reconciled rollouts safe and reversible.