An eye examination works because it refuses to accept self-reporting. Nobody grades their own vision on the strength of a feeling; each claim gets tested against the chart, one line at a time, and the result is recorded whether or not it flatters. That is exactly the spirit a proper GitOps audit deserves. The practice itself — configuration declared in a versioned repository, changes arriving only as reviewed merges, and an automated reconciler continuously pulling that description and correcting the live environment — makes strong promises. This audit checks whether a team’s actual setup can support them, ten verifiable lines at a time, and then scores the whole picture on a five-stage maturity scale borrowed from practitioners who measure these things for a living.
A note on scope before the chart. This is an audit of the delivery pipeline, not of the software itself — the questions concern how changes reach your systems, who authorises them, and what proves they took effect. A team can pass every line here with ordinary tools and fail the spirit of the exercise with extraordinary ones; the reverse also holds, which is the encouraging part.
The GitOps Audit Chart: Ten Checks, No Self-Grades
Answer each with evidence, not intention — a document, a screenshot, a demo. “We would notice” is not a finding.
- One road in. Show that production changes occur only through reviewed merges. Pull the last ten changes and trace each to one.
- The loop is closed. Make a small out-of-band edit in a safe environment and time how long the reconciler takes to correct it. If the answer is “it doesn’t”, the audit ends here.
- Alerting covers drift. Show where a divergence that is tolerated rather than corrected gets reported, and name the human who reads it.
- Deletion is guarded. Demonstrate that protected resources — namespaces, data volumes, custom definitions — survive a cleanup pass, and that the storage policy keeps removed volumes retrievable.
- Reconciler privileges are scoped. Produce the configuration showing the agent cannot, for instance, rewrite cluster-wide roles. Default admin rights fail this line outright.
- Secrets are not in the repository. Search the history. Encrypted-at-rest, sealed, or externally fetched are the passing patterns; a plaintext password fails regardless of how old it is.
- Triggers are protected. If a webhook accelerates the loop, show the shared secret on its endpoint. The endpoint itself performs no rate limiting, so anything unprotected is listening to strangers.
- The emergency brake exists and has been used. Show the documented pause procedure, who may pull it, and the log from its last rehearsal. A procedure never rehearsed is a hypothesis.
- Recovery does not depend on the repository. Prove a restore from backup of something real. Configuration enforcement is not data protection, and conflating the two is the most expensive confusion on this chart.
- Someone measures the pipeline. Produce one number — merge-to-healthy time, sync failure rate, drift count — that somebody reviews on a schedule. Unmeasured pipelines drift in habits as surely as servers drift in configuration.
Scoring: Five Stages of GitOps Sight
A word on running the session, because audits fail on format more often than on findings. Put the ten lines in a shared document, invite the person who owns each area to bring their own evidence, and — this is the part teams skip — have someone who was not involved in building the setup operate the clock and the checkboxes. The examiner should not be the patient’s optician. Budget ninety minutes, forbid the phrase “we’re planning to”, and write the outcome down the same day while the denials are still fresh.
Tally the evidence. The community describes a five-rung ladder, and honest teams can locate themselves on it in an afternoon:
- Stage 0 — Scripted. Deploys run from scripts or pipelines, but nothing watches the result. Vision without correction: workable at close range, dangerous on a motorway.
- Stage 1 — Declared. The intended state is written down and versioned, but nothing enforces the match. The chart exists; nobody reads it against the patient.
- Stage 2 — Reconciled. An agent pulls and corrects continuously. This is where most working implementations live, and where checks 1, 2 and 3 pass.
- Stage 3 — Governed. Permissions, deletion guards, secrets handling and the emergency brake are all deliberate — checks 4 through 9. The practice can survive an audit and a bad night.
- Stage 4 — Assured. The measurements of check 10 exist, are reviewed, and drive changes. Sight is not just corrected but tracked over time, the way any serious follow-up regime works.
Most teams that describe themselves as “doing GitOps” land honestly at Stage 2 with two or three Governance lines still failing. That is a respectable diagnosis — the pathology lies in mistaking it for Stage 3 without running the chart. There is also a curious pattern worth naming: the lines teams fear most (the backup restore, the reconciliation timing) are usually passed comfortably, while quiet failures cluster around the paperwork lines — the rehearsal log that does not exist, the measurement nobody owns. Weakness hides in the boring corners, which is why the chart insists on evidence for every line rather than sampling the interesting ones.
Reading the Results Without Flinching
Three findings account for most failed audits, and none is exotic. The first is check 8: automation with no rehearsed pause, which turns incidents into arguments between the engineer and the machine. The second is check 9: teams trusting a repository to hold what it was never designed to hold, then learning the difference during their first deletion accident. The third is check 10: no measurement at all, which means nobody knows the sync failure rate — could be one in fifty, could be one in five. For calibration, a measured reference week on a small pull-based estate recorded an apply failure rate of one in five and a drift profile dominated by two un-ticketed changes; teams that do not measure are usually not better than that, merely blinder to it. Low scores on this chart are not indictments. They are refractions — a description of where the light currently lands, useful precisely because nobody had to guess.
The Prescribing Part: What to Do With a Low Score
Audit findings convert cleanly into a treatment sequence, and the order is not negotiable. Close the loop first (checks 1 and 2) — every other safeguard assumes the reconciler is actually running. Guard deletion second (check 4), because it is the line where mistakes become unrecoverable. Then scope privileges and protect secrets (checks 5 and 6). The brake, the trigger and the measurement follow. Resist the urge to fix the flattering gaps first; the chart exists to keep the order honest. Teams that run this sequence typically move one full stage per quarter without heroics — which, told plainly, is the entire trick. And as with any prescription, the follow-up matters more than the first fitting: rerun the audit on a fixed schedule, because maturity regresses quietly whenever a team gets busy.
Why an Eye Hospital Is the Right Place for This Analogy
Because ophthalmology has industrialised exactly this discipline: standardised charts, staged diagnoses, prescribed corrections, and follow-up that measures whether the prescription worked. Readers who want the clinical version of check 10 will find it in the way hospitals deliver telehealth for eye care safely — measured findings, documented decisions, follow-up built in. The staged logic of our maturity ladder mirrors the reasoning in how patients set about choosing an eye hospital with safety in mind: credentials verified, safeguards inspected, results tracked. And check 8’s insistence on a rehearsed emergency path is the operational cousin of how hospitals organise emergency eye surgery for urgent vision problems — the capability is planned, staffed and drilled before the night it is needed, never improvised after.
The formal sources for the ladder, the checks and the reference numbers above are collected in the Ops Atlas guide to GitOps, which is where this audit’s scoring was drawn from. Take the chart, run it against your own estate this quarter, and grade the vision honestly — the correction only helps if the measurement does.