Pull-based GitOps for Kubernetes — Git is the source of truth; an in-cluster controller reconciles. Use **ArgoCD** (CNCF graduated, App-of-Apps, ApplicationSets, image-updater, web UI) or **Flux v2** (CNCF graduated, finer-grained controllers, no UI, minimal). Both implement the OpenGitOps v1.0 principles: declarative, versioned, pulled, observed.
