In GitOps, CI builds a new image. How does that new version actually get deployed?
What they are really testing: Whether you understand the CI/CD separation: CI builds and pushes the image, then something updates the tag in git (image automation or a CI commit) so the GitOps controller reconciles it.
A real interview question
In GitOps, CI builds a new image. How does that new version actually get deployed?
What most people say
drag me
“CI builds the image and deploys it to the cluster.”
That is the push model and breaks GitOps: CI should not deploy directly. The new image gets deployed by updating its tag in git (via image automation or a CI commit) so the controller reconciles it.
The follow-ups they ask next
Why should CI not deploy directly to the cluster in GitOps?
That is the push model, it puts cluster credentials in CI and bypasses git as the source of truth, losing the audit trail and drift correction. CI builds/pushes; the new version reaches the cluster via a git change reconciled by the controller.
What does an image automation tool actually do?
Watches the registry for new image tags matching a policy and commits the updated tag/digest back to the config repo, so the GitOps controller then reconciles it. The bump stays an auditable git commit.
What the interviewer is listening for
- CI builds/pushes, GitOps deploys (separation)
- Knows the tag must change in git
- Names image automation or CI-commits-tag
What sinks the answer
- "CI deploys to the cluster"
- No git update step
- Puts cluster creds in CI
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“CI [builds, tests, and pushes the image, but does not deploy]. The new version reaches the cluster by [updating its tag/digest in the config repo], done either by [image automation (Argo Image Updater / Flux) committing the new tag] or [CI committing the tag]. Then [the controller reconciles git and deploys]. Git stays [the source of truth, the bump is an auditable commit].”
Keep going with gitops
Foundation
What is GitOps, and what problem does it solve?
Foundation
What is the difference between push-based and pull-based deployment, and why does GitOps prefer pull?
Foundation
What are the core principles of GitOps?
Junior
What are Argo CD and Flux, and how do they differ?
Junior
How does drift detection and self-healing work in GitOps?
Junior
How do you structure repositories for GitOps? Should app code and deployment config live together?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free