Drift is the enemy GitOps was built to name
By SynapseTel Cloud Engineering · Published August 6, 2026 · 4 min read
Environments diverge from their declared state one hotfix at a time. Argo CD's real job is making that divergence visible before it becomes an outage.
How environments rot
No one decides to make production unique. It happens one emergency at a time: a hotfix applied by hand at 2am, a config tweak during an incident, a resource limit raised to stop a page. Each change is reasonable; their accumulation is an environment nobody can rebuild.
The cost surfaces later, always at the worst time — a disaster-recovery exercise that fails, a staging environment that stops predicting production, an upgrade that behaves differently on the one cluster that matters.
Reconciliation, not deployment
Argo CD compares declared configuration with live resources and reports differences as OutOfSync. Automated sync, self-healing and pruning are distinct settings; self-healing and pruning are not enabled by default. Sync failures still require investigation, and synchronization does not guarantee application health.
That reframes the 2am hotfix. The fix still happens — but it lands as a commit, or it shows up as drift the next morning with a name attached. Either way the environment's history stays true.
Policy belongs in the same loop
Generate build provenance and an SBOM in the build pipeline. Verify artifact identity, provenance and policy before deployment; merge-time checks alone cannot validate the final release artifact. Configure admission controls for the rules you intend to enforce.