ArgoCD

ArgoCD watches your Git repo and automatically syncs what's deployed in Kubernetes to match what's committed, making Git the single source of truth for your infrastructure. Push a change to Git, ArgoCD deploys it. Someone manually edits the cluster, ArgoCD reverts it. That's GitOps.

Apache 2.0, CNCF graduated project. The UI shows you a live dependency graph of every resource in your app, color-coded by sync status. You can see at a glance what's deployed, what's out of sync, and what's degraded.

Fully free. No paid tier from the Argo project. Akuity (founded by Argo creators) offers a managed version starting at $0 for small clusters, scaling with usage. ArgoCD handles multi-cluster deployments, Helm charts, Kustomize overlays, plain YAML, and Jsonnet. RBAC is built in. SSO works via OIDC/SAML.

The catch: ArgoCD itself needs to run somewhere, and it's not lightweight. The controller, server, repo server, and Redis consume real resources. Initial setup for a production-grade deployment (HA mode, SSO, RBAC policies) takes days, not hours. And the application-of-applications pattern for managing many apps has a learning curve.