Platform & DevOps·Pipelines, promotion and GitOps
the cluster reaches out to fetch what it should be running, so the pipeline never needs credentials into production.
Pull-based deployment
Also calledpull deploy, agent-based deploy
An agent inside the target environment polling or watching a source of truth and applying what it finds. Its security property is the important one: no inbound access and no production credentials outside the cluster, which removes the pipeline as a path into production. It costs immediacy and legibility — a deploy completes when the agent gets round to it, and 'did it work' is a question you ask the agent rather than the pipeline.