GitOps vs Infrastructure as Code: Understanding the Differences

# Popular IaC tools

tools = {
    "terraform": {
        "type": "Declarative",
        "provider": "Multi-cloud",
        "state": "State file",
        "use_when": "Multi-cloud, complex infrastructure"
    },
    
    "cloudformation": {
        "type": "Declarative",
        "provider": "AWS only",
        "state": "Managed by AWS",
        "use_when": "AWS-only environments"
    },
    
    "pulumi": {
        "type": "Declarative (code)",
        "provider": "Multi-cloud",
        "state": "State file",
        "use_when": "Want real programming language"
    },
    
    "ansible": {
        "type": "Procedural",
        "provider": "Configuration management",
        "state": "Stateless",
        "use_when": "Server configuration, provisioning"
    }
}

# Complete Terraform setup

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

# VPC
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = {
    Name = "main-vpc"
  }
}

# Subnets
resource "aws_subnet" "public" {
  vpc_id                  = aws_vpc.main.id
  cidr_block             = "10.0.1.0/24"
  map_public_ip_on_launch = true
  
  tags = {
    Name = "public-subnet"
  }
}

# Security Group
resource "aws_security_group" "web" {
  name        = "web-sg"
  description = "Security group for web servers"
  vpc_id      = aws_vpc.main.id
  
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# EC2 Instance
resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.micro"
  subnet_id     = aws_subnet.public.id
  
  vpc_security_group_ids = [aws_security_group.web.id]
  
  tags = {
    Name = "web-server"
    Environment = "production"
  }
}

# GitOps tools

tools = {
    "argocd": {
        "description": "GitOps for Kubernetes",
        "type": "Pull-based",
        "features": ["Multi-tenancy", "UI", "Rollbacks"]
    },
    
    "flux": {
        "description": "GitOps for Kubernetes",
        "type": "Pull-based",
        "features": ["Lightweight", "Extensible"]
    },
    
    "jenkins_x": {
        "description": "Cloud-native CI/CD with GitOps",
        "type": "Integrated",
        "features": ["Preview envs", "GitOps native"]
    },
    
    "argoproj_rollouts": {
        "description": "Progressive delivery for GitOps",
        "features": ["Blue-green", "Canary", "Analysis"]
    }
}

# ArgoCD Application

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
  namespace: argocd
spec:
  project: default
  
  source:
    repoURL: https://github.com/myorg/myapp
    targetRevision: main
    path: deploy/k8s
    
  destination:
    server: https://kubernetes.default.svc
    namespace: production
    
  syncPolicy:
    automated:
      prune: true        # Remove old resources
      selfHeal: true    # Fix drift
      allowEmpty: false
    
    syncOptions:
    - CreateNamespace=true
    
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

---

# Application with multiple sources

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
spec:
  sources:
  - repoURL: https://github.com/myorg/myapp
    targetRevision: main
    path: k8s/overlays/production
  
  - repoURL: https://github.com/myorg/infrastructure
    targetRevision: main
    path: helm-charts/mychart
    helm:
      valueFiles:
      - values-prod.yaml

# When to use IaC

iac_use_cases = [
    "Create VPCs and networking",
    "Provision databases (RDS, DynamoDB)",
    "Set up load balancers",
    "Configure IAM roles and policies",
    "Initial cluster setup",
    "One-time infrastructure"
]

# When to use GitOps

gitops_use_cases = [
    "Deploy applications to Kubernetes",
    "Manage Kubernetes manifests",
    "Manage Helm charts",
    "Manage configMaps and secrets",
    "Continuous deployment",
    "Day-2 operations"
]

# 1. Terraform creates the cluster

# terraform/eks.tf
resource "aws_eks_cluster" "main" {
  name     = "my-cluster"
  role_arn = aws_iam_role.eks_cluster.arn
  version  = "1.28"
  
  vpc_config {
    subnet_ids = aws_subnet.private[*].id
  }
}

# 2. ArgoCD operator watches for deployments

# apps/myapp.yaml (committed to Git)
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
spec:
  project: default
  source:
    repoURL: https://github.com/myorg/myapp
    targetRevision: main
    path: k8s
  destination:
    server: https://kubernetes.default.svc
    namespace: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

# GitOps best practices

gitops_practices = [
    "Use separate repos for infra and apps",
    "Enable branch protection",
    "Require PR reviews for changes",
    "Use meaningful commit messages",
    "Enable auto-sync with drift detection",
    "Set up notifications for sync failures",
    "Use Helm or Kustomize for templating"
]

# Directory structure
structure = """
├── infrastructure/          # Terraform
│   ├── modules/
│   ├── environments/
│   │   ├── dev/
│   │   └── prod/
│   └── main.tf
│
├── apps/                   # Kubernetes
│   ├── myapp/
│   │   ├── base/
│   │   ├── overlays/
│   │   │   ├── dev/
│   │   │   └── prod/
│   │   └── kustomization.yaml
│   └── otherapp/
"""

# IaC best practices

iac_practices = [
    "Use modules for reusability",
    "Never commit secrets to Git",
    "Use workspaces for environments",
    "Enable state locking",
    "Use remote state (S3/GCS)",
    "Enable drift detection",
    "Version your modules"
]

# Secret handling
secret_handling = """
# Use:
# - HashiCorp Vault
# - AWS Secrets Manager
# - Azure Key Vault
# - SOPS with age/yaml

# terraform/secrets.tf
data "aws_secrets_manager_secret_version" "db_creds" {
  name = "myapp/database"
}

# DON'T:
# - Commit secrets to Git
# - Store in tfstate
# - Hardcode in code
"""

# Moving to GitOps

migration_steps = [
    {
        "step": "1. Start with IaC",
        "tasks": [
            "Define infrastructure in Terraform",
            "Set up remote state",
            "Enable state locking"
        ]
    },
    
    {
        "step": "2. Containerize apps",
        "tasks": [
            "Dockerize applications",
            "Set up image registry",
            "Add image scanning to CI"
        ]
    },
    
    {
        "step": "3. Add Kubernetes",
        "tasks": [
            "Provision cluster with Terraform",
            "Create K8s manifests",
            "Set up Helm charts"
        ]
    },
    
    {
        "step": "4. Implement GitOps",
        "tasks": [
            "Install ArgoCD/Flux",
            "Create Application CRDs",
            "Enable auto-sync",
            "Set up PR workflows"
        ]
    },
    
    {
        "step": "5. Automate everything",
        "tasks": [
            "Add drift detection",
            "Set up notifications",
            "Enable progressive delivery"
        ]
    }
]