Drift is the enemy GitOps was built to name

How environments rot

No one decides to make production unique. It happens one emergency at a time: a hotfix applied by hand at 2am, a config tweak during an incident, a resource limit raised to stop a page. Each change is reasonable; their accumulation is an environment nobody can rebuild.

The cost surfaces later, always at the worst time — a disaster-recovery exercise that fails, a staging environment that stops predicting production, an upgrade that behaves differently on the one cluster that matters.

Reconciliation, not deployment

Argo CD is usually introduced as a deployment tool, but its durable value is the discipline OpenGitOps states as principles: desired state expressed declaratively, versioned and immutable, pulled automatically, continuously reconciled. In Argo CD's own vocabulary, the target state lives in Git, the controller continuously compares it against the live state, and an application whose live state deviates is marked OutOfSync — drift becomes a visible, alertable condition instead of a latent surprise. With automated sync policy, self-heal, and pruning enabled, the controller does not just report the divergence; it reverses it.

That reframes the 2am hotfix. The fix still happens — but it lands as a commit, or it shows up as drift the next morning with a name attached. Either way the environment's history stays true.

Policy belongs in the same loop

Once desired state is declared, policy as code gates what may be declared: admission controllers — OPA Gatekeeper or Kyverno — enforce security baselines and resource standards at the cluster door, while SBOM and provenance checks in the sigstore and SLSA mold run at merge, where changes are cheap to fix, not at release, where they are expensive to argue about. Fast because safe, not despite it.