DevOps / GitOps Interview Questions
How does GitOps differ from traditional CI/CD pipelines?
Traditional CI/CD pipelines are push-based: the CI system builds an artifact, and the CD stage runs kubectl apply or helm upgrade directly against the cluster. The pipeline holds a kubeconfig or service-account token with cluster-write access. There is no persistent desired-state record and no automatic drift correction — if someone manually deletes a deployment, the pipeline only redeploys on the next trigger.
GitOps is pull-based: the CI system builds the image and updates a config repository, but it never touches the cluster directly. A GitOps operator running inside the cluster watches the config repo and reconciles the live state to match what Git says, continuously. Rollback is a git revert rather than re-running a pipeline step.
| Dimension | Traditional CI/CD | GitOps |
|---|---|---|
| Deployment trigger | Pipeline push on build success | Operator pull on Git commit |
| Cluster credentials | Stored in CI system secrets | Kept inside the cluster only |
| Drift detection | None — only corrects on next pipeline run | Continuous — operator reconciles on every poll cycle |
| Rollback mechanism | Re-run old pipeline or manual kubectl | git revert creates a new auditable commit |
| Audit trail | Pipeline logs (often ephemeral) | Git commit history (permanent, cryptographically ordered) |
The separation also improves security posture: even if the CI system is compromised, an attacker cannot push arbitrary changes to the cluster without also compromising Git and passing branch-protection reviews.
More Related questions...
