Infrastructure as code

Manage devices as code

See every change, undo any error, repeat every success. Define your fleet in version-controlled YAML. Review changes in pull requests. Let Fleet enforce the desired state.

Get a demo Free in-person workshop
An example of an AI-assisted Gitops workflow

There is another way

Most device management happens through a GUI: click, configure, repeat. That works at small scale. As your organization grows, manual processes create problems that compound.

No record of intent

Audit logs show who changed a setting and when, not why, what the old value was, or whether it was tested.

Configuration drift

One engineer tweaks a setting. Another makes a conflicting change. Six months later, what’s "standard" is unclear.

Knowledge leaves with people

Configuration knowledge lives in the minds of admins. When someone leaves, undocumented context is lost.

Compliance audits take too long

Proving compliance means gathering screenshots, exporting reports, and reconstructing timelines from scattered logs.

Teams stay reactive

Repetitive GUI tasks consume time that could go toward higher-priority work.

<%# Quote section %>
Fastly logo

"The shift to GitOps has modernized our operations, giving us the agility and change control we needed, giving leadership real-time confidence in device health and compliance."

Dan Jackson

Dan Jackson

Sr Manager Systems Engineering, Fastly

Less manual work, faster recovery,
simpler compliance.

When your device configurations live in Git, every change is reviewable, reversible, and documented by default.

Scale without adding headcount

Manage thousands of devices with the same team. Automation handles the repetitive work, so your team can focus on higher-value projects.

Recover in minutes, not hours

Configuration for your entire fleet lives in Git. If a change causes an issue, revert the last commit. Recovery takes minutes.

Pass audits with version history

Every change is tracked with a Git commit. Auditors get a commit history, not screenshots. Compliance stays continuous.

Onboard engineers faster

New team members read the repository to understand device configurations. No Slack threads to dig through, no senior admin to shadow.

<%# Feature with images sections %>

Core methodology

Define the state. Let Fleet enforce it.

Infrastructure as code replaces ClickOps with version-controlled configuration files. You describe what "correct" looks like. Fleet brings devices into alignment.

An example of Fleet's YAML configuration
Declarative, not imperative

Define the desired state in YAML. Fleet compares and applies only the changes needed. No coding required. YAML files are structured, readable, and reusable across your organization.

Single source of truth
Single source of truth

Your Git repository defines the correct state of every device. All changes flow through it. If someone changes a setting locally, Fleet restores the approved state. The repository stays as the single source of truth.

Idempotent by design
Idempotent by design

Push the same YAML to Fleet ten times. The result is identical every time. No side effects, no accidental changes, no surprises during a fleet-wide update. Failed runs can be retried without risk.

Keep knowledge in code
Keep knowledge in code

Every configuration is version-controlled. See who changed it, when, and why. Knowledge stays when people leave.

Policy as code
Policy as code

Define security policies in code. Fleet checks every device and blocks rollout if a policy fails, so you can catch issues before they reach devices.

The workflow

Deploy with built-in checkpoints

Every change passes through a structured pipeline before it reaches devices. Peer review, validation, and testing are built into the process.

Pull requests as quality gates

Every change is peer-reviewed before reaching devices. No unreviewed changes reach production.

Continuous reconciliation

Fleet compares actual device state against Git. If a device drifts, Fleet restores the approved configuration automatically.

Pull-based security

Devices pull configurations from Fleet. Your Git repository never holds device credentials. Smaller blast radius.

An image showing the process of the Fleet infrastructure as code workflow. An IT admin pushes a device management profile to GitHub, and an IT admin approves the new profile. When the updated profile is merged, the CI/CD runner sends the profile to a Fleet server. The Fleet server then sends the updated profile to a managed device and verifies the result.

From clicks to commits

See how infrastructure as code compares to the way most organizations manage devices today.

  ClickOps Fleet GitOps (IaC)
Primary interface GUI or web console
checkmark

Git repository and YAML
Source of truth Spreadsheets or vendor database
checkmark

Version-controlled files
Change control Verbal approval or action logs
checkmark

Pull requests with peer review
Drift management Manual or periodic reporting
checkmark

Continuous self-healing
Rollback Manual redo or backups/restore
checkmark

Revert a Git commit
Audit trail Fragmented or click history
checkmark

Immutable commit history
Primary interface
ClickOps
GUI or web console
Fleet GitOps (IaC)
checkmark

Git repository and YAML

Source of truth
ClickOps
Spreadsheets or vendor database
Fleet GitOps (IaC)
checkmark

Version-controlled files

Change control
ClickOps
Verbal approval or action logs
Fleet GitOps (IaC)
checkmark

Pull requests with peer review

Drift management
ClickOps
Manual or periodic reporting
Fleet GitOps (IaC)
checkmark

Continuous self-healing

Rollback
ClickOps
Manual redo or backups/restore
Fleet GitOps (IaC)
checkmark

Revert a Git commit

Audit trail
ClickOps
Fragmented or click history
Fleet GitOps (IaC)
checkmark

Immutable commit history

What makes Fleet different

GitOps that ships with the product

Most device management tools have an API. Some have community Terraform providers. Fleet is the only MDM where GitOps is a first-party, supported workflow that covers the entire management surface.

Terraform not required

Fleet ships fleetctl, a CLI that reads YAML and applies it to your Fleet server. Connect it to your CI/CD runner for a complete GitOps pipeline.

Full console coverage

Fleet's GitOps controls profiles, policies, software, queries, labels, and settings. Manage your entire admin console in code, not a subset.

Works with any Git provider

GitHub, GitLab, Bitbucket, or any Git-compatible repository. Your choice of toolchain, not ours. No vendor-specific cloud subscription required.

Every operating system

The same GitOps workflow manages macOS, Windows, Linux, iOS, iPadOS, and Android. One repository. One workflow. Every platform.

Organizations managing devices as code

Stripe logo

Stripe moved 10,000 Macs to Fleet, saving hundreds of thousands annually.

Read their story
Foursquare logo

Foursquare cut costs and gained 114% ROI with Fleet.

Read their story
Fastly logo

Fastly gains visibility into all endpoints and critical infrastructure around the world.

Read their story
Fastly logo

The shift to GitOps has modernized our operations, giving us the agility and change control we needed, giving leadership real-time confidence in device health and compliance.

Dan Jackson

Dan Jackson

Sr Manager Systems Engineering, Fastly

Faire logo

Fleet has opened a lot of opportunities for us. My team is loving managing devices via GitOps, and the built-in support for CIS benchmarks has made it easy to enforce these on our devices.

Jeremy Baker

Jeremy Baker

Engineering Manager, Faire

Thumbtack logo

I really like how robust Fleet's API is. (using GitOps)

Adam Anklewicz

Adam Anklewicz

Manager, IT Endpoint Engineering, Thumbtack

Get started

Infrastructure as code for device management

Get a demo Free in-person workshop
<%/* Cloud city banner */%>
<%- /* Expose server-rendered data as window.SAILS_LOCALS :: */ exposeLocalsToBrowser() %>