argocd

The security argument for GitOps is more specific than 'Git is the source of truth'. Pull deployment can remove cluster credentials from CI, and that single fact is most of the case.

Self-heal did exactly what it was configured to do. The senior answer is not switching it off; it is designing the Git path and the sync order so nobody bypasses the system at 3am again.

One Application declaring others sounds like trivia until you need to rebuild a cluster in an afternoon or hand a team a bounded slice of the platform. Here is when the pattern earns its keep, and when ApplicationSet should replace it.

Rings, SLI gates and Git-expressed promotion: sync waves order resources inside a cluster, but fleet sequencing is an automation you design on top.