How do you implement GitOps with GitHub Actions and Kubernetes?

GitOps means the desired state of a system, particularly Kubernetes manifests, lives in a Git repository as the single source of truth, and something continuously reconciles the live cluster to match what's declared in Git. GitHub Actions itself is push-based, so a pure GitOps setup typically pairs it with a pull-based reconciler running inside the cluster, like Argo CD or Flux, rather than having Actions apply manifests directly.

1. Store Kubernetes manifests (or Helm charts) in a Git repository as the source of truth.
2. Install a GitOps controller (Argo CD or Flux) inside the target cluster, configured to watch that repository.
3. Use a GitHub Actions workflow only for what's push-appropriate: building and pushing a new container image, then updating the image tag in the manifests repository.
4. The in-cluster controller detects the manifest change and reconciles the cluster automatically, without Actions ever needing direct cluster credentials.

This division of labor matters for security: Actions builds artifacts and updates declarative config, but the actual deployment step is pulled by an agent already inside the cluster, so cluster-admin credentials never need to be handed to an external CI system.