GitOps Drift

🔒 Enterprise plan. GitOps (repositories, drift, sync and auto-sync) is part of the Enterprise plan. See Control Center features by plan.

GitOps keeps your fleet’s configuration in a Git repository (see Governance → GitOps). The drift view shows, node by node, whether each node runs the configuration that is in Git right now.

You’ll find it under Operations → GitOps.

Desired state and node state

Desired state. Every sync pulls the configured branch and records a hash of each file under the configured path, along with the commit message, author and time.
Node state. When you sync to nodes, the Control Panel sends each node the files at that commit. When a node confirms it applied them, those files become its applied state.

The drift view compares the two for each node:

Change	Meaning
`added`	In Git, but not applied on the node yet
`modified`	On the node, but with different content than in Git
`removed`	Applied on the node, but no longer in Git

Each node gets a status:

Status	Meaning
`in_sync`	The node has applied exactly what is in Git
`drifted`	At least one file differs (a node that never received a sync counts as drifted)
`pending`	A sync was sent and the node has not confirmed it yet

Syncing

Click Sync now to pull the repository and push it to every online node that isn’t on the latest commit yet. You can also sync a hand-picked list of nodes. Nodes already on the commit are skipped unless you force the sync. With the manual conflict strategy, nothing is pushed while a conflict is still open.

Turn on Auto-sync to have the Control Panel do the same thing on the repository’s sync interval. Auto-sync resumes on its own after a Control Panel restart.

On plans below Enterprise

On Community, Pro or Business, Operations → GitOps shows an upgrade card with an Enterprise badge and an Upgrade button that opens Billing. These calls return 402 with the standard upgrade_required body ("feature": "gitops", "required_plan": "enterprise"): connecting a repository, pulling (/{id}/sync), syncing to nodes (/sync), the drift view (/drift), resolving a conflict and turning auto-sync on.

If you downgrade from Enterprise:

Your repositories and conflicts are kept and stay readable (GET /api/governance/gitops, /{id}/conflicts). The GitOps tab lists them read-only.
Auto-sync pauses. The loop skips its runs while the plan lacks GitOps and picks up again on its own after you upgrade; you don’t need to switch it back on. You can still turn auto-sync off.
Nothing is pushed to nodes and the drift view is not computed. GET /api/governance/gitops/status still answers, with "gated": true, "required_plan": "enterprise" and "auto_sync_paused": true when auto-sync was on.

API

Endpoint	Method	Description
`/api/governance/gitops/status`	GET	Repository URL, branch, path, last commit (SHA, message, author, time), last sync time, auto-sync on/off and node counts per status
`/api/governance/gitops/drift`	GET	Per-node drift. Filter with `?status=drifted`.
`/api/governance/gitops/sync`	POST	Pull and push to nodes. Body (all optional): `{"config_id": "...", "instance_ids": ["..."], "force": false}`
`/api/governance/gitops/{id}/auto-sync`	PUT	`{"enabled": true}`

Below Enterprise, the status call adds gated, required_plan and auto_sync_paused, and the drift, sync and enable-auto-sync calls return 402 upgrade_required.

A drift row looks like this:


{
  "instance_id": "2b0d0402-…",
  "host": "edge-eu-03",
  "diff_summary": "1 added, 1 modified",
  "files": [
    { "path": "apps/grafana.yaml", "change": "modified" },
    { "path": "firewall.yaml", "change": "added" }
  ],
  "status": "drifted",
  "node_status": "online",
  "applied_commit": "4f1c2e9…",
  "desired_commit": "a83d7b0…"
}

Next Steps

Staged Rollouts — roll out an OS version in stages with health gates
Governance — connect a repository and choose a conflict strategy