DevOps / GitOps Interview Questions
What are the two GitOps deployment models: push-based vs pull-based?
Push-based deployment: a CI/CD pipeline (GitHub Actions, Jenkins, etc.) runs kubectl apply or helm upgrade directly against the target cluster after a build succeeds. The pipeline authenticates to the cluster using a kubeconfig or service-account token stored in the CI system's secret vault. Changes only reach the cluster when a pipeline is triggered; drift is not detected between runs.
Pull-based deployment: a GitOps operator running inside the cluster watches one or more Git repositories on a polling interval or via webhook. When it detects a difference between what Git declares and what the cluster is running, it applies the delta automatically. Cluster credentials never leave the cluster boundary.
| Property | Push-based | Pull-based (true GitOps) |
|---|---|---|
| Who applies changes | CI/CD pipeline | In-cluster operator |
| Credential exposure | kubeconfig in CI secrets | Credentials stay in cluster |
| Drift correction | No automatic correction | Continuous reconciliation |
| Examples | GitHub Actions + kubectl, Jenkins pipeline | Argo CD, Flux CD |
A pull-based Argo CD Application looks like this — the operator handles all cluster writes:
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: my-app
namespace: argocd
spec:
project: default
source:
repoURL: https://github.com/org/gitops-config.git
targetRevision: main
path: apps/my-app/overlays/prod
destination:
server: https://kubernetes.default.svc
namespace: production
syncPolicy:
automated:
prune: true
selfHeal: trueMore Related questions...
