argocd

The security argument for GitOps is more specific than 'Git is the source of truth'. Pull deployment can remove cluster credentials from CI, and that single fact is most of the case.

Self-heal did exactly what it was configured to do. The response needs an authorized emergency path, a controlled reconciliation pause when required, and evidence that automation can resume safely.

One Application declaring others sounds like trivia until you need to rebuild a cluster in an afternoon or hand a team a bounded slice of the platform. Here is when the pattern earns its keep, and when ApplicationSet should replace it.

Rings, SLI gates and Git-expressed promotion: sync waves order resources inside a cluster, but fleet sequencing is an automation you design on top.