Topic
Operational practice using Git repositories as the source of truth for declarative infrastructure, synced to clusters by tools like Argo CD and Flux.
Argo CD 3.5 puts mutual TLS in front of its repo-server by default, closing the unauthenticated path a July 2026 Kustomize flaw used to run commands. Clusters without their own certificates get it on upgrade, so older GitOps installs should take 3.5 as a security patch.
Reality
Devops.com argues that when an agent opens 40 pull requests before lunch, plan review still blocks merges and writes audit events but stops checking anything. Its remedy automates policy checks and caps the damage, so people review intent.
Reality
Justin O'Leary's ConfigConfusion technique turns on the fact that Google's Config Connector makes every cloud call with its own service account, so a tenant who can create one IAMPolicyMember inherits whatever that account is allowed to grant.
Reality
NVIDIA has open-sourced the host configuration controller it ran internally as Skyhook. Its interruption budget and non-interrupt pod labels are the two fields that set how long a fleet-wide kernel change takes.
Reality
ArgoCD now hands diff calculation to the API server and accepts OCI registries as first-class sources. The same write-up still calls Git the sole source of truth, so teams pulling charts from Harbor have to decide which system records intent.
Reality
Apache Storm ships no maintained Helm chart and no migration guide, so one team wrote its own templates for EKS. The first thing that broke was a StorageClass name, and the only symptom was an init container log line.
Reality
The GitOps tooling worked, and seven services still went back to Docker Compose in a day, because the operator consumes every one of those images and cuts release tags for none of them.
Reality
A k3s workload moved to Amazon EKS without an application code change, and the three things that had to be fixed were the control plane endpoint policy, the instance type AWS would allow, and the credential doing the work.
Reality
The guidance runs three failure scenarios on a laptop, each one breaking a join between declared state and stored data, and its verification step is a number from Velero's data mover rather than a Completed status.
Reality
Putting every manifest in git makes a dead datastore survivable, but only if reconciliation arrives in order, and the order is set by the fact that Envoy Gateway's CRDs ship inside the controller's own Helm chart.
Reality
Flux Mirror ships as a v2.9 CLI plugin that copies images, charts and desired-state artifacts from a config file. The Bitnami catalogue freeze is the argument for using it.
Reality