02 · GitOps configuration
Keep platform intent reviewable, promotable and reproducible.
NopsAI synchronizes operational definitions from a global configuration repository and delegated team repositories while preserving validation, drift visibility and runtime snapshots.
How it works
GitOps configuration, end to end.
The flow stays explicit enough for operators to inspect, secure, automate and improve.
Define repository ownership
Bind a global configuration repository and delegated team repositories to the team paths they govern.
Review a normal change
Teams edit declarative files, run validation and merge through their existing pull-request workflow.
Synchronize and validate
NopsAI parses supported resources, resolves references, reports drift and applies accepted definitions.
Snapshot runtime intent
Runs preserve the resolved pipeline, access, scope, knowledge and profile context used at execution time.
Platform capabilities
What teams can standardize.
These are current NopsAI platform primitives, not a future-state feature list.
Broad configuration coverage
Synchronize pipelines, reusable steps, schedules, triggers, webhook sources, scopes, access, knowledge, LLM, MCP, auth, mail and runtime settings.
Proposal-first assistant
The assistant prepares commit-ready file plans without silently applying Git-managed changes.
Drift visibility
Inspect repository sync state and compare stored platform configuration with its declared source.
Immutable release planning
Render digest-pinned Kubernetes deployments and write a release lock after a compatible deployment succeeds.
Configuration
Declared once, reviewed like code.
The example is declarative and Git-reviewable. Runtime behavior still passes through live AAA, credential, compatibility, execution and monitoring boundaries.
mcp_servers:
github:
display_name: GitHub MCP
enabled: true
provider: github
transport: streamable_http
url: https://api.githubcopilot.com/mcp/x/all/readonly
auth_type: bearer_token
credential_ref: credential://system/mcp/github-readonly
timeout: 30s
allowed_scopes: ["dev", "prod"]
mcp_profiles:
github-readonly:
description: Read-only GitHub tools for goal-based tasks
enabled: true
servers:
- server: github
tools:
- "*"
allowed_scopes: ["prod"]Enterprise controls
Configuration stays inside the governance model.
AAA remains authoritative
Git ownership does not bypass runtime authorization; callers still need permission to use referenced resources.
Secrets stay protected
Git stores encrypted payloads or credential references, while clear values remain in protected runtime storage.
Compatibility is checked
CLI, API, runner protocol and platform bundle ranges are validated before mutating release operations.
Changes stay auditable
Repository history, sync status, source metadata and platform audit records provide complementary evidence.
Related capabilities
Continue through the operating model.
03 · Governance and AAA
Apply default-deny access decisions before configuration reads, tool use, secret resolution, approvals and dispatch.
04 · AI and MCP
Select controlled agent, LLM and MCP profiles per pipeline or step while preserving permission-bound tool discovery.
05 · Runtime and execution
Dispatch per-run agents to Docker or Kubernetes runners using scope, capacity, affinity, routing and runtime pools.
Bring a real gitops configuration workflow.
We can map the configuration, authorization, runtime and evidence boundaries against your current platform model.