GitOps for anything with an API: declare state in YAML, reconcile it through pluggable scripts.
Unified GitOps pulls desired state from git, compares it with what each live system has, and applies the difference, the way Argo CD does for Kubernetes. The systems are anything a script can talk to: an Isilon's NFS exports, Ascender job templates, vCenter virtual machines, InfiniBox volumes.
Changes no longer wait in a queue of CI runners: a commit is picked up at the next check, inside your network, and a change made by hand on a system shows up as drift.
- Pull, not push: projects are pulled from git before every check; no CI runner on the path
- Dumb connectors, smart core: a connector lists objects and applies one operation; the core diffs
- Compares only what git declares: the 40 default fields an API returns never look like drift
- Drift detection: every check lists the live system, so a hand edit shows up as out of sync
- A local copy of each system's settings: one YAML file per application and kind, git's format
- Plan before apply: refresh shows what a sync would do, field by field, and changes nothing
- Safe by default: no automatic sync, no deletes (prune) unless an application asks for them
- Self-describing connectors: a script says what it manages, each type's key and what goes first
- One application, one system: its address and credentials live in config, never in git
- Run history: which commit was applied, when, and the result of every operation
- Webhooks: drift, applied commits and failures to a webhook or an Ascender or AWX job
- Config as code: one item per file, any folders;
nameis the identity - Strict validation: a typo in desired state or config fails before any system is touched
- Web UI and LDAP sign-in: the same UI family and sign-in as unified-api, on its own address
- Secrets from Vault or env, metrics for Prometheus, live config reload, single binary
| Document | What it covers |
|---|---|
| How it works | The reconcile loop: pull, list, diff, apply, and what each status means |
| Connectors | The script contract, the Python SDK, and writing a connector |
| Configuration | Every YAML file field by field, and desired-state files |
| Webhooks | Drift, syncs and failures to a webhook or an Ascender or AWX job template |
| API | All routes with authentication and examples |
| Architecture | The layers, the dependency rule, and what is shared with unified-api |
| Configuration API | Pushing the config directory over HTTP and reloading it live |
| Deployment | Container image, Kubernetes and Compose |
| LDAP sign-in | Directory accounts, access rules and sessions |
| Observability | Logs, metrics and the alerts worth having |
| Projects | Git checkouts: when they are pulled, credentials, virtualenvs |
| Secrets | Credential backends, the resolution cache, native Vault |
| Testing | Running the suite and what it covers |
| Web UI | The UI the image serves and how signing in works |
Contributions are welcome: CONTRIBUTING.md covers the PR workflow, commit style, CI gates and architecture rules.
Security issues: see SECURITY.md for private reporting.