Comparison
Pull-based deploymentvsPush-based deployment
Pull-based deployment
the cluster reaches out to fetch what it should be running, so the pipeline never needs credentials into production.
An agent inside the target environment polling or watching a source of truth and applying what it finds. Its security property is the important one: no inbound access and no production credentials outside the cluster, which removes the pipeline as a path into production. It costs immediacy and legibility — a deploy completes when the agent gets round to it, and 'did it work' is a question you ask the agent rather than the pipeline.
Full entry →Push-based deployment
the pipeline holds a production credential and applies the change itself, and the job's log tells you exactly what happened.
The pipeline connecting to the target environment and applying the change directly. It is simple, immediate and observable — one job, one log, one exit code — and it is why it remains the default nearly everywhere. Its cost is that the delivery system must hold standing credentials into every environment, which makes it the highest-value target in the organisation.
Full entry →