Optimization That Sticks: GitOps Integration and the Turbonomic Admission Controller
As GitOps becomes the default way platform teams manage Kubernetes infrastructure, the tools in your stack need to keep pace. More and more engineering organizations are standardizing on Git as their single source of truth, and the expectation is that every tool in the stack respects that model. This post covers how to ensure your resource optimization workflow fits neatly into a GitOps environment, and what capabilities are available to make that work.
GitOps Adoption Is Accelerating, and Your Tooling Needs to Keep Up
GitOps has moved from a best practice to an operational expectation. More and more engineering teams are standardizing on Git as the single source of truth for their infrastructure, using tools like Argo CD to automatically sync the live cluster to whatever is in the repository. It brings consistency, auditability, and a clear change history that ops and platform teams have long needed. But that shift creates a new challenge for optimization tools. Any tool that patches the cluster directly, without touching Git, will have its changes treated as configuration drift and reverted on the next reconciliation cycle. The optimization never holds.
The numbers reflect how fast this is moving. GitOps is no longer an edge practice. It is how mature Kubernetes teams operate. IBM Turbonomic's GitOps integration capabilities are built to work within that model, not around it. Turbonomic supports two complementary capabilities that ensure resource optimizations are both committed to Git and protected from configuration drift across deployment cycles: the GitOps Integration and the Turbonomic Admission Controller (TAC).
Turbonomic GitOps Integration
Feature Overview
In a standard setup, Turbonomic applies resize actions directly to the live deployment. In a GitOps environment, that creates a problem: Argo CD reconciles the cluster against the YAML in Git, so a direct patch is treated as configuration drift and reverted on the next sync. The GitOps Integration solves this by routing resize actions through your source of truth instead of around it. Turbonomic discovers which workloads Argo CD manages, then commits the updated resource configuration to the upstream GitHub or GitLab repository. Argo CD syncs the change to the cluster, and every optimization becomes an auditable Git commit with an author, a timestamp, and a full diff.
Commit Modes
When Turbonomic writes an optimization back to Git, you control how that change lands. There are two modes depending on your change control posture:
The integration works with Argo CD Application and ApplicationSet custom resources backed by straight YAML definitions on GitHub or GitLab. Helm-packaged applications, Operator-managed workloads, and Argo Rollouts are not currently supported through the GitOps Integration path.
Turbonomic Admission Controller (TAC)
The Problem: Optimization Drift
Even with the GitOps Integration in place, there is a related and very common problem: configuration drift. When a CI/CD release cycle runs and restores the original unoptimized values from the repository, the cluster drifts back away from the right-sized state Turbonomic worked to achieve. The optimization effectively disappears with every deployment.
The cycle looks like this:
1. Turbonomic right-sizes a workload's CPU and memory requests based on observed utilization.
2. A developer triggers a release, which restores the original values from the Git repository.
3. Turbonomic detects the misconfiguration and re-applies its recommendation.
4. The cycle repeats with every release, optimizations never hold, and both systems waste cycles fighting each other.
This is especially pronounced in multi-tenant clusters where teams use different CI/CD tools, and where a single Helm chart definition is shared across multiple environments with very different usage patterns.
What Is Turbonomic Admission Controller (TAC)?
TAC acts as a specialized gatekeeper at the Kubernetes API layer. It uses Kubernetes' native mutating webhook framework to intercept incoming update requests before they are persisted in the cluster. (Available as of 8.19.6)
When Turbonomic right-sizes a workload, that workload is annotated. Any subsequent attempt by an external tool, such as Argo CD, a CI/CD pipeline, or a Helm upgrade, to overwrite the CPU and memory values is intercepted, and those values are held. This prevents configuration drift from undoing Turbonomic's work. All other fields in the manifest (image tags, environment variables, labels, replica counts) pass through and update normally.
TAC only guards CPU and memory resource allocations. Teams retain full control over every other aspect of their release process.
To release a workload from TAC control: Set the turbo.ibm.com/override annotation to false. This disables the webhook mutation behavior for that specific workload without any changes to the TAC installation.
Four reasons to use the Turbonomic Admission Controller
Choosing the Right Approach
The GitOps Integration and TAC solve related but distinct problems. They can run together or independently depending on your cluster's toolchain and deployment model.
Both can run together. On clusters where some workloads are straight-YAML Argo CD apps and others are Helm-based or operator-controlled, you can run the GitOps Integration for the former and TAC for the latter. There is no conflict between them; each handles the workloads it is best suited to.
Get Started Today 🚀
📚 1. Review the GitOps Integration Documentation
Learn about Argo CD requirements, supported workload types, commit mode configuration, and cluster local update options. 🔗 GitOps Integration Documentation
🛡️ 2. Review the Turbonomic Admission Controller Documentation
Understand namespace scoping, enablement through the Turbonomic UI, and configuration requirements for Argo CD compatibility. 🔗 Turbonomic Admission Controller Documentation
🎯 3. Start a Free 30 Day Turbonomic Trial
Experience GitOps Integration and the Turbonomic Admission Controller firsthand in your own environment. 🔗 Free Trial
💡 4. Share Your Feedback
Have an idea or feature request? We'd love to hear from you. 🔗 IBM Ideas Portal