GitOps

Overview Last week I walked through the Argo CD and Kargo objects a golden-path layer generates, and closed on the thing that wasn’t there: not a single secret anywhere in those manifests. That wasn’t tidy example hygiene. It’s a design position, and this post defends it. The tension is familiar. The GitOps pitch is everything in Git — desired state, reviewable, revertible, reconciled. The security pitch is never commit a secret. The most common resolution is to split the difference: encrypt the secret and commit the ciphertext, with Sealed Secrets or SOPS. It works, lots of good teams do it, and I think it’s the wrong default. ...

Overview For three weeks I’ve ended every post with the same claim and never once shown my work. The claim: the CNCF ecosystem already solved continuous delivery, and what the mid-market team is missing isn’t technology, it’s the assembly — a golden path stitched from primitives that already exist. Argo CD reconciles. Kargo promotes. The last post argued you should adopt that road as a product rather than build it as a project. ...

Overview Two posts in, and both have been about a trap. Build an internal platform you can’t staff, or rent a hosted one you eventually outgrow. The most common reply I got was the fair one: If the constraint is headcount, and I’m not getting headcount, what exactly am I supposed to do on Monday? That question contains the mistake, and I made it too for years. It treats “platform” and “platform team” as the same noun. They aren’t. DORA’s 2025 research found adoption close to universal — “90% of organizations reporting the use of an internal developer platform and 76% establishing dedicated platform teams”. The interesting part isn’t the gap between those two numbers. It’s that neither one predicts whether the platform is any good. ...

Overview There is a size of engineering organization that platform tooling has quietly failed. If you are Google, you build your platform. You have twenty engineers who work on nothing but the platform, and the leverage is obvious: one paved road, used by a thousand developers, pays for itself many times over. If you are four people with a Rails app and a deadline, you rent a platform. You push to a branch, a preview URL appears, and you have never once thought about an ingress controller. That is the correct trade. ...