GitOpsWhat reconciles itself, what does not, and where the boundary actually falls The app-of-apps What ArgoCD does not manage Secrets Traps worth publishing