← Back to Concept Contrast

Concept Contrast Fable

Infrastructure as code and GitOps: one writes machines into files, the other lets files drive machines automatically

Conclusion first:Both concepts revolve around "managing infrastructure with code," so teams easily treat them as different names for the same thing. Infrastructure as Code solves "how resources are described in a declarative language"; GitOps solves "who triggers changes, what is the source of truth, and how to automatically verify." Writing Terraform does not mean you are running GitOps; the latter requires Git as the single source of truth plus automatic synchronization.

Both concepts revolve around "managing infrastructure with code," so teams easily treat them as different names for the same thing. Infrastructure as Code solves "how resources are described in a declarative language"; GitOps solves "who triggers changes, what is the source of truth, and how to automatically verify." Writing Terraform does not mean you are running GitOps; the latter requires Git as the single source of truth plus automatic synchronization.

Fable

Both hands can write menus, but there is only one head chef in the kitchen

The kitchen management of an old established restaurant went through two stages. The first stage was writing all the master chef's recipes into standard operating cards: the grams of each ingredient, the cooking time, the plating method—all on paper. A new chef could reproduce the dishes from the cards, no longer relying on the master's word of mouth. This is turning intangible experience into tangible documents.

Then came the second-stage problem: operation cards were scattered in each chef's pocket. Someone changed the salt amount without telling others, someone had an old version of the card, someone made an improvement but other stations didn't know. The same sweet-and-sour fish tasted three different ways from three stoves. The operation cards were written, but the versions were a mess.

The head chef did one thing: he stored all the operation cards in a shared tin cabinet, and only he had the key. Anyone who wanted to change a recipe had to go through him—hand in the old card, explain the reason, and get a new card. The cards in the tin cabinet were the only trusted version; the kitchen cooked according to the cards in the cabinet and checked them once before starting work each day.

Half a year later, the head chef discovered that the central cabinet alone was not enough. Some people cooked according to the new cards, but the actual heat and timing of the finished dish did not exactly match the card—what the kitchen executed and what was written in the cabinet differed by an inspection step. He added a step: every day at noon, spot-check two dishes, compare the finished product against the operation card, and if a deviation is found, immediately trace whether the card was wrong or the person did not follow it.

This tin cabinet plus daily reconciliation is the second pitfall the kitchen hit after "writing it into files." Operation cards alone are infrastructure as code — turning configuration into readable, reproducible files. The tin cabinet plus a single key, version control and automated reconciliation is GitOps — using one central repository as the single source of truth, continuously verifying whether the actual state has drifted.

The restaurant's kitchen equipment procurement later followed the same path. Previously the procurement list was kept in the buyer's notebook, and switching to a shared document did make it clearer. But only when they set the shared document so that "only the kitchen supervisor can modify it, while the buyer can only read and place orders," and automatically reconciled it once a day, did the procurement deviation rate truly drop to zero.

At the kitchen debriefing, the head chef drew a line on the blackboard: on the left he wrote "written into a document so it can be passed on," on the right he wrote "lock the document into a single repository and verify it daily." He said each stage is worth a sum of money, but only the second stage is worth big money.

Infrastructure as Code

Describe and manage infrastructure resources such as compute, network and storage with declarative or scripting languages, replacing manual operations.

GitOps

Use the Git repository as the single source of truth for infrastructure and application configuration, continuously synchronizing declared state with actual running state through automation tools.

Story Mapping

  • Writing recipes as standard operating cards: IaC, turning infrastructure configuration into readable, reproducible code files
  • The tin cabinet as the only trusted version: the core of GitOps—the Git repository as a single source of truth
  • Daily spot checks comparing finished products with operation cards: GitOps continuous verification mechanism, automatically detecting configuration drift
  • Procurement list from shared documents to read-only + automatic reconciliation: IaC plus GitOps is what closed the execution-level deviations

Applying it to Andy Ren Xu's project

Writing Terraform or Pulumi only completes the IaC step. When deploying Agent infrastructure, add another layer: all configuration changes must be merged through Git PRs, and after merging, an automated pipeline syncs and verifies the actual state. Git is the only entry point, and any manual modification should trigger an alert. Having only IaC without GitOps is like writing the files but having no guarantee that what runs online is what the files say.

京ICP备2026014272号