Comparison
GitOpsvsPull-based deployment
GitOps
nobody has credentials to deploy; an agent in the cluster watches a repository and makes reality match it.
Operating a system by keeping its desired state in version control and having an in-cluster agent continuously reconcile the running system to it. It gives you review, history, rollback by revert and drift correction for free, because they are properties of git and of reconciliation rather than features anyone built. It also relocates the hard problems: secrets cannot go in the repository, and a broken commit is now deployed continuously rather than once.
Full entry →Pull-based deployment
the cluster reaches out to fetch what it should be running, so the pipeline never needs credentials into production.
An agent inside the target environment polling or watching a source of truth and applying what it finds. Its security property is the important one: no inbound access and no production credentials outside the cluster, which removes the pipeline as a path into production. It costs immediacy and legibility — a deploy completes when the agent gets round to it, and 'did it work' is a question you ask the agent rather than the pipeline.
Full entry →