--- title: Managing Infrastructure: Everything Is a Pull Request description: A practical walkthrough of GitOps-based day-two operations on a self-service platform. Every infrastructure or application change flows through a pull request:... canonical: https://daily.dev/posts/managing-infrastructure-everything-is-a-pull-request-uxcw0owxg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Managing Infrastructure: Everything Is a Pull Request | daily.dev og:description: A practical walkthrough of GitOps-based day-two operations on a self-service platform. Every infrastructure or application change flows through a pull request:... og:url: https://daily.dev/posts/managing-infrastructure-everything-is-a-pull-request-uxcw0owxg og:image: https://api.daily.dev/og/posts/uxCW0OWXg.png og:image:alt: Managing Infrastructure: Everything Is a Pull Request og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Managing Infrastructure: Everything Is a Pull Request **[Medium](https://daily.dev/sources/medium_js)** · 8 min read · 0 upvotes · 0 comments ## Summary A practical walkthrough of GitOps-based day-two operations on a self-service platform. Every infrastructure or application change flows through a pull request: Terraform handles cloud resources with plan-then-test-apply pipelines, ArgoCD syncs Kubernetes manifests automatically, and configurations and secrets are versioned in git via ConfigMaps/Consul or Vault/encrypted secrets. Developers can provision databases, deploy new services, and debug issues independently using SSO-enabled Grafana and Kibana — without needing cluster credentials or platform team intervention. The result is a fully auditable, reversible environment where the entire state lives in git. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can developers deploy their own applications to Kubernetes without needing cluster credentials or kubectl access? Developers create Kubernetes manifests and submit a pull request to the product layer repository; once merged, ArgoCD detects the diff and deploys automatically. No kubectl access or cluster credentials are required, since the entire deployment path runs through git and the ArgoCD reconciliation loop, keeping the cluster state in sync with the repository. _daily.dev surfaces GitOps patterns like this for teams designing self-service deployment pipelines._ ### What are the tradeoffs between using HashiCorp Vault and encrypted Kubernetes secrets for managing secrets in a GitOps pipeline? Vault can generate dynamic, short-lived credentials that rotate automatically so nobody needs to know the current secret value, while encrypted Kubernetes secrets are stored in git in encrypted form and decrypted at deploy time, with rotation handled by committing a new encrypted value through a normal pull request. Both keep a full git history of changes without exposing plaintext values. _engineers weighing secret-rotation strategies can track approaches like these on daily.dev before committing to one._ ### How should a Terraform CI/CD pipeline validate changes before they reach production? A safe pattern runs terraform plan on pull request open so reviewers see the exact diff, then applies the change to a throwaway test workspace to prove the plan works, destroys that workspace, generates a changeset against production, and only applies to production after PR approval. This sequence catches plans that look fine but fail on apply before they ever touch a live environment. _teams hardening their terraform pipelines can find similar infrastructure workflows on daily.dev._ ## Similar posts on daily.dev - [GitOps in 2026: Why Pull Requests Are Taking Over Cloud Operations](https://daily.dev/posts/gitops-in-2026-why-pull-requests-are-taking-over-cloud-operations-lnhyrihek) · DevOps.com · 1 upvotes · 0 comments - [What Is GitOps? Principles, Benefits, and How It Works](https://daily.dev/posts/what-is-gitops-principles-benefits-and-how-it-works-zgo98fmyl) · Coralogix · 0 upvotes · 0 comments - [DevOps isn’t enough: GitOps strategies for regulated multicloud deployments](https://daily.dev/posts/devops-isn-t-enough-gitops-strategies-for-regulated-multicloud-deployments-qabg3ggfw) · All Things Open · 3 upvotes · 0 comments - [GitOps in Practice: How to Design a Scalable CI/CD Pipeline with GitLab and GKE](https://daily.dev/posts/gitops-in-practice-how-to-design-a-scalable-ci-cd-pipeline-with-gitlab-and-gke-iwngmnmlk) · Cloud Native Now · 9 upvotes · 0 comments - [Argo CD GitOps: Automated Kubernetes Deployments 2026](https://daily.dev/posts/argo-cd-gitops-automated-kubernetes-deployments-2026-phznycqfy) · Medium · 4 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#terraform](https://daily.dev/tags/terraform), [#iac](https://daily.dev/tags/iac), [#gitops](https://daily.dev/tags/gitops), [#argocd](https://daily.dev/tags/argocd) [View this post on daily.dev](https://daily.dev/posts/managing-infrastructure-everything-is-a-pull-request-uxcw0owxg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Managing Infrastructure: Everything Is a Pull Request","url":"https://daily.dev/posts/managing-infrastructure-everything-is-a-pull-request-uxcw0owxg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/managing-infrastructure-everything-is-a-pull-request-uxcw0owxg"},"datePublished":"2026-07-24T19:34:19.882Z","dateModified":"2026-09-14T07:50:34.994Z","description":"A practical walkthrough of GitOps-based day-two operations on a self-service platform. Every infrastructure or application change flows through a pull request:...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bc5c3a4f69e11ac1f29d7192196ec08c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bc5c3a4f69e11ac1f29d7192196ec08c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/managing-infrastructure-everything-is-a-pull-request-uxcw0owxg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,terraform,iac,gitops,argocd","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Managing Infrastructure: Everything Is a Pull Request"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/managing-infrastructure-everything-is-a-pull-request-uxcw0owxg#faq","mainEntity":[{"@type":"Question","name":"How can developers deploy their own applications to Kubernetes without needing cluster credentials or kubectl access?","acceptedAnswer":{"@type":"Answer","text":"Developers create Kubernetes manifests and submit a pull request to the product layer repository; once merged, ArgoCD detects the diff and deploys automatically. No kubectl access or cluster credentials are required, since the entire deployment path runs through git and the ArgoCD reconciliation loop, keeping the cluster state in sync with the repository. daily.dev surfaces GitOps patterns like this for teams designing self-service deployment pipelines."}},{"@type":"Question","name":"What are the tradeoffs between using HashiCorp Vault and encrypted Kubernetes secrets for managing secrets in a GitOps pipeline?","acceptedAnswer":{"@type":"Answer","text":"Vault can generate dynamic, short-lived credentials that rotate automatically so nobody needs to know the current secret value, while encrypted Kubernetes secrets are stored in git in encrypted form and decrypted at deploy time, with rotation handled by committing a new encrypted value through a normal pull request. Both keep a full git history of changes without exposing plaintext values. engineers weighing secret-rotation strategies can track approaches like these on daily.dev before committing to one."}},{"@type":"Question","name":"How should a Terraform CI/CD pipeline validate changes before they reach production?","acceptedAnswer":{"@type":"Answer","text":"A safe pattern runs terraform plan on pull request open so reviewers see the exact diff, then applies the change to a throwaway test workspace to prove the plan works, destroys that workspace, generates a changeset against production, and only applies to production after PR approval. This sequence catches plans that look fine but fail on apply before they ever touch a live environment. teams hardening their terraform pipelines can find similar infrastructure workflows on daily.dev."}}]} ```