GITOPS · DESIRED-STATE VALIDATION
GitOps rollout: validate a desired manifest
Edit the manifest in Git, validate it or not, then watch sync, prune, health and self-heal decide what actually runs.
Event trace
Computed data
Final metrics
Teaching model inspired by GitOps controllers such as Argo CD; it is not Argo CD and reads no Kubernetes YAML. The manifest is a flat key: value list. Without validation, unknown fields are dropped as by a decoder without strict field validation, and a missing replicas count falls back to the Deployment default of 1. Pinned tags and resource limits are this fixture's policy, not Kubernetes requirements. Version 1.5.0 is defined to crash.
Green status, wrong replica count
The opening manifest misspells replicas as replcas. Validate schema and policy before sync is off, so the field is dropped as by a decoder without strict field validation, and replicas falls back to the Deployment default of 1. Sync applies checkout:1.4.2, Prune deletes ConfigMap legacy-flags because Git no longer declares it, and pods become ready. The verdict is GREEN BUT WRONG: Synced/Healthy with 1 live replica, while the author intended 3. Status only says the cluster matches Git, not that Git says what you meant.
Validate before sync
Turn on Validate schema and policy before sync. The commit is rejected for the unknown field, nothing is applied and the live Deployment keeps 1.4.1 with 3 replicas: REJECTED BEFORE SYNC. Load an example manifest and pick Mutable latest tag or Missing resource limits: with validation both are rejected, without it both sync green but wrong. Edit the Desired manifest in Git directly: set replicas to 25 and validation rejects it as outside 1 to 20. Fix the spelling and the run ends SYNCED AS INTENDED with 3 replicas.
What validation cannot see
Pick Version 1.5.0 that crashes. The manifest passes validation, sync applies it, and health goes Degraded: UNHEALTHY OR DRIFTED. Schema and policy checks catch malformed intent, not a broken release; GitOps also does not roll back by itself, so the fix is a revert commit. The Desired and live fields table makes every gap visible: on the misspelled manifest, replcas is listed as an unknown field marked ignored, and replicas as missing with the default 1.
Prune, drift and self-heal
With the valid manifest, clear Prune resources removed from Git: legacy-flags stays live as an orphan and the app reports OutOfSync. Turn on An operator scales the live Deployment by hand: the manual scale to 6 replicas is drift, and Self-heal live drift re-applies Git, back to 3 replicas and Synced. Clear Self-heal and the result is OutOfSync with 6 live replicas. Back on the misspelled manifest, self-heal faithfully restores 1 replica: it enforces Git, right or wrong. Clear Automated sync and an accepted manifest stays NOT SYNCED until someone syncs manually.
Transport and limits
Play or Pause the inspection, Next event, Restart, Speed and Inspection time step through commit, validation, sync, prune, health and drift; the verdict appears at 60 s and in the preview at once. This is a teaching model inspired by Argo CD, reading a flat key: value list, not Kubernetes YAML. Pinned tags and resource limits are this fixture's policy, not Kubernetes requirements.