Quick Takeaways
What you'll learn in this article
- 1
GitOps for Kubernetes in 2026 has matured from practice to platform
- 2
This guide covers Argo CD v3
- 3
7, progressive delivery with Argo Rollouts and Flagger, multi-cluster fleet management, Kyverno and supply chain security, Crossplane for infrastructure, AI-assisted operations, secrets management, and production deployments at the DoD and Deutsche Telekom
Keep reading for detailed implementation, code examples, and real-world results
Updated (February 2026): Complete rewrite replacing generic overview with current GitOps landscape including Argo CD v3.3 and Flux v2.7, progressive delivery with Argo Rollouts and Flagger, multi-cluster fleet management, Kyverno and supply chain security with Sigstore/SLSA, Crossplane CNCF graduation, AI-assisted Kubernetes operations, secrets management patterns, and production deployments at the DoD, Intuit, and Deutsche Telekom.
GitOps Won
The debate about whether GitOps works is over. Over 90 percent of Kubernetes deployments are now managed using GitOps principles. GitOps adoption reached 64 percent across surveyed organizations, with 81 percent of adopters reporting higher infrastructure reliability and faster rollback. Argo CD holds approximately 50 percent of the GitOps tooling market, Flux approximately 11 percent, with the remainder split across Jenkins X, Codefresh, and platform-specific implementations.
The GitOps automation platforms market is projected to surpass $1.8 billion by 2033. The CNCF cloud-native ecosystem has grown to 15.6 million developers. And the documented results are difficult to argue with: organizations adopting GitOps have achieved 700x increases in deployment frequency, 168x faster lead times, and 16x improvements in mean time to recovery.
What has changed in 2025-2026 is not whether teams use GitOps, but what the GitOps stack looks like. Argo CD shipped its first major release in four years. Flux survived the shutdown of its founding company. Crossplane graduated from CNCF. Supply chain security became table stakes. And AI started showing up in the reconciliation loop.
GitOps Adoption
90%+
Percentage of Kubernetes deployments managed with GitOps principles in 2025, with 64% formal adoption across surveyed organizations
Argo CD v3: The Architecture Refresh
Argo CD — created and open-sourced by Intuit in January 2018, graduated from CNCF in December 2022 — shipped Argo CD v3.0 in May 2025, its first major release since 2021. The release brought refined RBAC controls, improved resource exclusions, updated secrets management, and leaner memory consumption. Three subsequent minor releases followed the new quarterly cadence.
v3.1 through v3.3
v3.1 (August 2025) introduced OCI registry support in beta, allowing Kubernetes manifests packaged as OCI artifacts to be pulled directly from container registries — eliminating Git as the only source format. CLI plugins and an enhanced Source Hydrator with commit association capabilities followed.
v3.2 (November 2025) added Pull Request Generator title matching for ApplicationSets and progressive sync enhancements — enabling phased rollouts across application groups.
v3.3 (GA February 2, 2026) completed the lifecycle hook set with PreDelete hooks alongside PreSync, Sync, and PostSync. The Source Hydrator matured with inline parameter support and git notes (avoiding unnecessary repo-server calls). Shallow clone for Git performance and KEDA support for pause/resume from the UI rounded out the release.
Source Hydrator
The signature v3.x feature. Source Hydrator separates manifest rendering into a distinct "hydration" step, linking dry commits with upstream code commits by capturing the repository URL, SHA, author info, and messages. In v3.3, Hydrator uses git notes rather than creating hydrated commits on every dry commit — reducing repository noise while maintaining full traceability. This solves a long-standing pain point where rendered manifests obscured the relationship between code changes and deployment artifacts.
ApplicationSets at Scale
ApplicationSets enable declarative management of hundreds of applications across clusters. Generators include Git (directory and file), List, Cluster, Pull Request (with title matching in v3.2), and Matrix generators for combining multiple generators. The app-of-apps pattern — hierarchical application management — pairs with ApplicationSets to give platform teams a single control plane for fleet-wide deployments.
Community
The numbers reflect Argo's dominance: 19,600 GitHub stars for Argo CD alone. Across the entire Argo project: 53,791 GitHub stars (up 14 percent YoY), 70,130 total contributors (up 16 percent), and 14,065 contributing organizations (up 12 percent). Platform engineers represent 37 percent of users, and 60 percent have relied on Argo CD for more than two years. Production adopters include Intuit, Electronic Arts, Major League Baseball, Tesla, and Ticketmaster.
Flux v2.7: Resilience After Weaveworks
Flux CD faced an existential crisis when Weaveworks — its founding company and primary sponsor — shut down in February 2024. Most core maintainers had worked at Weaveworks. The project survived because Microsoft Azure, AWS, Cisco, ControlPlane, and Edgecell pledged backing, with ControlPlane specifically employing Flux maintainers. The project transitioned from single-company concentration to genuine multi-company stewardship.
Current State
Flux v2.6 (May 2025) reached GA for OCI Artifacts, with Flux controllers fully decoupled from Git and able to rely solely on container registries as source of truth. Flux v2.7 (September 2025) reached GA for image update automation and introduced ExternalArtifact and ArtifactGenerator APIs for advanced source composition. Kubernetes Workload Identity support at the object level was completed for all Flux APIs across AWS ECR, Azure Container Registry, and Google Artifact Registry.
Flux's modular architecture — separate Source, Kustomize, Helm, Notification, and Image Automation controllers — means organizations can adopt only the components they need. Everything is defined as Kubernetes CRDs and reconciled continuously.
Flux vs Argo CD
The practical differences: Argo CD provides a rich web UI, is application-centric, and has a larger community (~19.6k stars vs Flux's ~6.5k). Flux is CLI-first (UI via weave-gitops), toolkit-based, and follows a more Kubernetes-native CRD approach. Argo CD is more opinionated; Flux is more extensible. Both are CNCF Graduated projects.
The choice often comes down to ecosystem alignment: Argo CD pairs with Argo Rollouts for progressive delivery; Flux pairs with Flagger. Azure Arc chose Flux as its native GitOps extension. Most organizations choose one and build their platform around it.
GitOps Controllers
Argo CD v3.3
Flux v2.7
Progressive Delivery
GitOps defines the desired state. Progressive delivery controls how that state reaches production.
Argo Rollouts
Current version: v1.8.3 (June 2025). Argo Rollouts provides a Rollout CRD as a drop-in replacement for Kubernetes Deployments, adding canary deployments with configurable traffic-shifting steps, blue-green deployments with preview environments, analysis runs that query Prometheus, Datadog, New Relic, or CloudWatch to verify KPIs before promotion, and A/B testing with sticky sessions.
The Gateway API plugin is the standout evolution. Any Gateway API-compliant controller — Istio, Envoy Gateway, Traefik, Kong, kgateway — works through a single configuration. Previously, adding a new traffic provider required ad-hoc code. With Gateway API, the integration is automatic. Argo Rollouts also integrates with Istio VirtualService/DestinationRule, Linkerd (via Gateway API GAMMA initiative in Linkerd 2.14+), NGINX Ingress, and ALB Ingress.
Flagger
Current version: v1.40.0. Part of the Flux ecosystem (CNCF Graduated). Flagger uses a Canary CRD that wraps existing Deployments rather than replacing them. It supports canary, A/B testing, blue-green, and traffic mirroring strategies across Istio, Linkerd, Contour, Gloo, NGINX, Traefik, APISIX, and Gateway API v1. Recent additions include session affinity and TCP routing for Istio canary releases.
OpenFeature
OpenFeature (CNCF Incubating, accepted December 2023) provides a vendor-agnostic standard for feature flagging. The OpenFeature Operator for Kubernetes injects a flagd sidecar into pods for gRPC and HTTP flag evaluation. Backed by Dynatrace, LaunchDarkly, CloudBees, Flagsmith, Harness, Split, and Unleash, it integrates with OpenTelemetry and pairs naturally with progressive delivery for percentage-based rollouts tied to feature flags.
Multi-Cluster Fleet Management
Single-cluster GitOps is solved. Multi-cluster is where organizations spend their engineering effort.
Argo CD multi-cluster manages multiple clusters from a single control plane. The argoproj-labs/argocd-agent project introduces an agent-based architecture for more scalable multi-cluster management. ApplicationSets with Cluster generators enable templating applications across all registered clusters.
Rancher Fleet is purpose-built for fleet-scale GitOps across hundreds or thousands of clusters, using a central manager with agents on downstream clusters.
Azure Arc + Flux uses Flux as a native cluster extension for AKS and Azure Arc-enabled Kubernetes, providing built-in multi-tenancy and deployment dependency management.
Google Config Sync (part of GKE Enterprise) automates configuration synchronization across any number of clusters with PostSync custom actions, OCI repository support, and signature verification.
Multi-tenant patterns include namespace-based tenancy with RBAC, Argo CD Projects for team isolation, Flux multi-tenancy with source/kustomization per tenant, and hierarchical namespaces.
Policy and Supply Chain Security
Kyverno
Kyverno (CNCF Incubating, working toward graduation) reached v1.16 in November 2025. The release introduced CEL-based policies in beta — aligning with Kubernetes' native ValidatingAdmissionPolicy and MutatingAdmissionPolicy. Five new policy types (ValidatingPolicy, MutatingPolicy, GeneratingPolicy, DeletingPolicy) extend what Kyverno can enforce. Kyverno uses YAML for policy definitions, matching the format engineers already use for Kubernetes manifests.
Momentum is shifting toward Kyverno for Kubernetes-focused organizations due to the lower learning curve compared to OPA/Gatekeeper's Rego language. OPA/Gatekeeper (OPA is CNCF Graduated) remains preferred for organizations needing a single policy layer across diverse environments including Terraform and API gateways. The emerging consensus: Kyverno for straightforward validation/mutation, OPA for complex compliance logic and external data integration.
Supply Chain Security
Supply chain security is now table stakes for shipping software to federal, finance, health-tech, and mid-market SaaS. The standards have stabilized:
Sigstore (backed by Google, Red Hat, Linux Foundation) provides keyless signing and verification. Kubernetes standardized on Sigstore starting with v1.24. Cosign signs and verifies container images.
SLSA (Supply-chain Levels for Software Artifacts) 1.0 has stabilized. Achieving Level 2 is now practical in weeks using cosign, Syft, Kyverno, GUAC, and GitHub OIDC. Tekton Chains integrates with Sigstore for automated provenance generation, keyless signing, and transparent audit logs.
Enforcement happens at the admission controller layer — Kyverno or OPA/Gatekeeper policies ensure only signed images with valid provenance are deployed.
GitOps Tooling Market Share (%, 2025)
| tool | adoption |
|---|---|
| Argo CD | 50 |
| Flux CD | 11 |
| Jenkins X | 8 |
| Codefresh | 6 |
| Rancher Fleet | 5 |
| Other | 20 |
Infrastructure as Code Meets GitOps
Crossplane
Crossplane graduated from CNCF on October 28, 2025 — validating the Kubernetes-native approach to infrastructure as code. Crossplane v2.0 introduced a refined architecture for full application control planes. Unlike Terraform's one-shot execution model, Crossplane runs continuously inside the cluster with native Kubernetes reconciliation, detecting and correcting drift in near-real time. No external state file — the Kubernetes API server is the source of truth.
Composite Resource Definitions (XRDs) let platform teams define secure, compliant infrastructure templates that development teams consume as simple Kubernetes resources. The provider ecosystem spans AWS, Azure, GCP, databases, SaaS platforms, and on-premises systems. Community: 3,000+ contributors from 450+ organizations.
Terraform Post-IBM
IBM completed the $6.4 billion HashiCorp acquisition on February 27, 2025. The HCP Terraform Operator for Kubernetes allows developers to manage Terraform through the Kubernetes API, and is certified for OpenShift. The integration roadmap includes External Secrets Operator support for syncing from Vault to OpenShift clusters and a Vault Config Operator for Kubernetes-native, GitOps-style Vault administration. One deadline to watch: HCP Terraform's legacy Free tier reaches end-of-life on March 31, 2026.
Pulumi
Pulumi Kubernetes Operator 2.0 reached GA in 2025, with v2.3.0 adding preview mode (dry-run validation before deployment) and structured configuration for complex data types. Pulumi lets teams write infrastructure in TypeScript, Python, Go, C#, or Java — offering the full power of general-purpose programming languages rather than DSLs.
The practical distinction: Crossplane is best for platform engineering teams building internal developer platforms. Terraform has the broadest provider ecosystem and existing organizational adoption. Pulumi appeals to teams that want general-purpose programming languages for infrastructure.
AI-Assisted GitOps
AI is entering the GitOps workflow at multiple points.
K8sGPT (CNCF Sandbox) scans Kubernetes clusters and triages issues in plain English, codifying SRE experience into analyzers. It integrates with multiple LLMs including OpenAI, Azure, Cohere, and Meta LLaMA.
KubeGuard (research, September 2025) uses LLMs combined with runtime logs to automatically harden Kubernetes manifests across Roles, NetworkPolicies, and Deployments — using modular prompt-chaining workflows with Llama 3.1 8B as the local model.
AI-driven drift detection compares declared versus running state and raises PRs to reconcile drift — generating Terraform state corrections or infrastructure rollbacks with detailed explanations. Crossplane v2.0 explicitly enhances support for AI-driven operations.
The emerging patterns for 2026: predictive drift detection analyzing patterns of manual changes, LLM-powered incident reports from observability data, and self-healing clusters combining AI anomaly detection with GitOps reconciliation. The human remains in the loop — AI generates the PR, an engineer approves it.
Secrets Management
Secrets in Git repositories remain a solved problem with multiple approaches.
External Secrets Operator (ESO) (CNCF Sandbox) is the emerging standard. Store ExternalSecret CRDs in Git; ESO handles the actual secret injection from AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, or CyberArk. After an August 2025 operational pause, new maintainer commitments and commercial backing revived the project.
Sealed Secrets (Bitnami) encrypts secrets for safe Git storage but does not scale well for multi-cluster — each cluster requires its own controller and private keys.
SOPS (Mozilla) encrypts YAML, JSON, and other formats using AWS KMS, GCP KMS, Azure Key Vault, age, or PGP. Works beyond Kubernetes for any infrastructure.
HashiCorp Vault provides dynamic secret generation, rotation, and fine-grained access control. Post-IBM acquisition, new integrations target Kubernetes-native GitOps-style Vault administration.
The 2025-2026 consensus: externalize secrets to dedicated key management systems. ESO for bridging external stores to Kubernetes. SOPS for simpler setups. Vault for organizations needing dynamic secrets and rotation.
Kubernetes Secrets Management Approaches (Estimated Usage, 2025)
| Name | Value |
|---|---|
| External Secrets Operator | 35 |
| HashiCorp Vault (direct) | 25 |
| Sealed Secrets | 18 |
| SOPS | 12 |
| Other | 10 |
Production Deployments
US Department of Defense — Platform One
The DoD uses Flux and Helm as core GitOps tooling across Platform One, its DevSecOps managed services platform. Open-sourced as "Big Bang," it provides declarative continuous delivery of DoD-hardened packages into Kubernetes. Thousands of clusters are managed via GitOps without drift. 100,000 government staff and contractors rely on the platform. The DoD also uses Argo and Terraform alongside Flux.
Intuit
The origin of Argo CD. Intuit deploys thousands of applications across hundreds of Kubernetes nodes and dozens of environments. They remain the number one contributor to Argo CD and partnered with Red Hat on advancing Argo for multi-cluster cloud-native applications.
Deutsche Telekom
Manages approximately 200 Kubernetes clusters with just 10 full-time engineers using Flux, with plans to scale to thousands of clusters. A striking example of GitOps enabling a small team to operate at enterprise scale.
Deployment at Scale
The numbers from elite performers using GitOps: Netflix runs approximately 25,000 canaries per day. Meta performs approximately 100,000 daily deployments. Shopify exceeds 200,000 deploys per month. Nubank achieves commit-to-flag in under 9 minutes. Cloudflare runs global edge canary in under 4 minutes. Canva reported zero customer incidents in 2024-2025.
Progressive Delivery Controllers
Argo Rollouts v1.8.3
Flagger v1.40.0
GitOps Defined
Weaveworks coins "GitOps" (2017). Intuit creates and open-sources Argo CD (January 2018). Flux v1 matures. The practice establishes Git as the source of truth for declarative infrastructure with continuous reconciliation.
CNCF Maturation
Flux v2 reimplements the toolkit with Kubernetes-native controllers. Argo and Flux both graduate from CNCF. ApplicationSets scale Argo CD to multi-cluster. Supply chain security (Sigstore, SLSA) gains momentum. GitOps moves from early adopter to mainstream.
Ecosystem Shifts
Weaveworks shuts down (Feb 2024). Flux community rallies with multi-company backing. Crossplane matures for IaC-as-GitOps. Kyverno gains momentum over OPA for Kubernetes policy. Progressive delivery with Gateway API simplifies traffic management.
Platform Engineering Era
Argo CD v3.0 through v3.3 refresh the architecture (Source Hydrator, OCI, PreDelete hooks). Flux v2.7 reaches OCI and image automation GA. Crossplane graduates CNCF. IBM acquires HashiCorp for $6.4B. AI enters the GitOps loop with K8sGPT and drift detection. Over 90% of K8s deployments use GitOps.
GitOps in 2026 is no longer just "Git as the source of truth for Kubernetes manifests." It is a full platform engineering stack: declarative application delivery (Argo CD or Flux), progressive deployment (Argo Rollouts or Flagger), infrastructure provisioning (Crossplane), policy enforcement (Kyverno), supply chain verification (Sigstore/SLSA), secrets management (ESO), and increasingly AI-assisted operations. The principles have not changed — Git as source of truth, declarative desired state, continuous reconciliation, and automated drift correction. What has changed is the maturity and breadth of the tooling implementing those principles.
