This repo is synced with the cluster using ArgoCD. Not everything is automatic, mainly things with a helm chart.
The cluster is described more here.
Managing secrets in git is done using SealedSecrets. It currently uses git-crypt to encrypt secrets. You can find a walkthrough here. Those secrets are then used to create sealed secrets using hack/encrypt-secrets.sh.