{"id":4059,"date":"2026-10-19T21:55:00","date_gmt":"2026-10-19T21:55:00","guid":{"rendered":"https:\/\/www.besteyehospitals.com\/blog\/?p=4059"},"modified":"2026-10-19T21:55:00","modified_gmt":"2026-10-19T21:55:00","slug":"gitops-maturity-audit-vision-chart","status":"publish","type":"post","link":"https:\/\/www.besteyehospitals.com\/blog\/gitops-maturity-audit-vision-chart\/","title":{"rendered":"A GitOps Maturity Audit, Scored Like a Vision Test"},"content":{"rendered":"

An eye examination works because it refuses to accept self-reporting. Nobody grades their own vision on the strength of a feeling; each claim gets tested against the chart, one line at a time, and the result is recorded whether or not it flatters. That is exactly the spirit a proper GitOps audit deserves. The practice itself \u2014 configuration declared in a versioned repository, changes arriving only as reviewed merges, and an automated reconciler continuously pulling that description and correcting the live environment \u2014 makes strong promises. This audit checks whether a team’s actual setup can support them, ten verifiable lines at a time, and then scores the whole picture on a five-stage maturity scale borrowed from practitioners who measure these things for a living.<\/p>\n

A note on scope before the chart. This is an audit of the delivery pipeline, not of the software itself \u2014 the questions concern how changes reach your systems, who authorises them, and what proves they took effect. A team can pass every line here with ordinary tools and fail the spirit of the exercise with extraordinary ones; the reverse also holds, which is the encouraging part.<\/p>\n

The GitOps Audit Chart: Ten Checks, No Self-Grades<\/h2>\n

Answer each with evidence, not intention \u2014 a document, a screenshot, a demo. “We would notice” is not a finding.<\/p>\n

    \n
  1. One road in.<\/strong> Show that production changes occur only through reviewed merges. Pull the last ten changes and trace each to one.<\/li>\n
  2. The loop is closed.<\/strong> Make a small out-of-band edit in a safe environment and time how long the reconciler takes to correct it. If the answer is “it doesn’t”, the audit ends here.<\/li>\n
  3. Alerting covers drift.<\/strong> Show where a divergence that is tolerated rather than corrected gets reported, and name the human who reads it.<\/li>\n
  4. Deletion is guarded.<\/strong> Demonstrate that protected resources \u2014 namespaces, data volumes, custom definitions \u2014 survive a cleanup pass, and that the storage policy keeps removed volumes retrievable.<\/li>\n
  5. Reconciler privileges are scoped.<\/strong> Produce the configuration showing the agent cannot, for instance, rewrite cluster-wide roles. Default admin rights fail this line outright.<\/li>\n
  6. Secrets are not in the repository.<\/strong> Search the history. Encrypted-at-rest, sealed, or externally fetched are the passing patterns; a plaintext password fails regardless of how old it is.<\/li>\n
  7. Triggers are protected.<\/strong> If a webhook accelerates the loop, show the shared secret on its endpoint. The endpoint itself performs no rate limiting, so anything unprotected is listening to strangers.<\/li>\n
  8. The emergency brake exists and has been used.<\/strong> Show the documented pause procedure, who may pull it, and the log from its last rehearsal. A procedure never rehearsed is a hypothesis.<\/li>\n
  9. Recovery does not depend on the repository.<\/strong> Prove a restore from backup of something real. Configuration enforcement is not data protection, and conflating the two is the most expensive confusion on this chart.<\/li>\n
  10. Someone measures the pipeline.<\/strong> Produce one number \u2014 merge-to-healthy time, sync failure rate, drift count \u2014 that somebody reviews on a schedule. Unmeasured pipelines drift in habits as surely as servers drift in configuration.<\/li>\n<\/ol>\n

    Scoring: Five Stages of GitOps Sight<\/h2>\n

    A word on running the session, because audits fail on format more often than on findings. Put the ten lines in a shared document, invite the person who owns each area to bring their own evidence, and \u2014 this is the part teams skip \u2014 have someone who was not involved in building the setup operate the clock and the checkboxes. The examiner should not be the patient’s optician. Budget ninety minutes, forbid the phrase “we’re planning to”, and write the outcome down the same day while the denials are still fresh.<\/p>\n

    Tally the evidence. The community describes a five-rung ladder, and honest teams can locate themselves on it in an afternoon:<\/p>\n