Red Hat Scales OpenShift GitOps via Pull Architecture to 3M Resources

Red Hat published extensive performance and scale testing results validating the new argocd-agent pull-based architecture for OpenShift GitOps. The benchmark demonstrated that decentralizing reconciliation to lightweight spoke agents allowed a single control plane to synchronize over 3.1 million Kubernetes resources across 480 clusters in roughly 13 minutes, while reducing cross-cluster network traffic by up to 80%. Traditional GitOps implementations rely predominantly on a centralized push model, where a primary hub cluster stores high-privilege administrative credentials for every downstream spoke and continuously monitors remote resources. This hub-and-spoke approach introduces two severe liabilities: a massive security blast radius if the hub is compromised, and severe resource saturation on the central controller. Under the pull-based model tested, spoke clusters initiate outbound connections to the hub and perform continuous reconciliation locally, insulating spoke credentials and distributing compute across the fleet. This development reflects the broader maturation of enterprise cloud-native delivery frameworks. As organizations scale beyond single-cluster environments toward distributed hybrid and edge footprints, centralized GitOps controllers frequently encounter Kubernetes API throughput limits and etcd bottlenecks. By decoupling desired-state distribution from local state reconciliation, the GitOps pattern is aligning with the zero-trust and decentralized operational topologies required by modern platform engineering teams. In practice, platform operators scaling Argo CD to hundreds of clusters should evaluate moving from push-based delivery to local agent execution to alleviate central hub memory pressure and eliminate inbound port requirements on remote networks. However, teams must still account for Git polling latencies and enforce rate limits on hub Kubernetes API queries-per-second (QPS) during massive fleet-wide list operations to maintain control-plane stability during peak synchronization events.