What is the difference between push-based and pull-based deployment, and why does GitOps prefer pull?
What they are really testing: Whether you understand that pull keeps cluster credentials out of CI and enables continuous reconciliation. The security and drift implications are the real answer.
A real interview question
What is the difference between push-based and pull-based deployment, and why does GitOps prefer pull?
What most people say
drag me
“Push is when CI deploys to the cluster and pull is when the cluster pulls changes; they both work.”
"They both work" misses why GitOps chose pull: keeping cluster credentials out of CI (security) and continuous reconciliation with drift correction (correctness). Those are the whole reason for the preference.
The follow-ups they ask next
What is the security advantage of pull-based deployment?
Cluster credentials never leave the cluster, no CI system or external pipeline holds them. A compromised CI token cannot deploy to or attack the cluster, which is a big reduction in attack surface.
Why does pull enable drift correction but push does not?
The pull agent runs continuously and re-reconciles, so it notices and reverts out-of-band changes. A push pipeline only acts at deploy time and never re-checks, so drift goes unnoticed.
What the interviewer is listening for
- Push = CI holds creds, pull = in-cluster agent
- Knows pull keeps creds out of CI
- Knows pull enables continuous drift correction
What sinks the answer
- "Both work" with no trade-off
- Misses the credential/security point
- Unaware pull gives drift correction
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Push: [CI outside the cluster holds credentials and runs kubectl/helm in]. Pull: [an in-cluster agent watches git and applies changes itself]. GitOps prefers pull because [no external system holds cluster credentials (a leaked CI token cannot deploy), and the agent reconciles continuously so it corrects drift], which a one-shot push never sees.”
Keep going with gitops
Foundation
What is GitOps, and what problem does it solve?
Foundation
What are the core principles of GitOps?
Junior
What are Argo CD and Flux, and how do they differ?
Junior
How does drift detection and self-healing work in GitOps?
Junior
How do you structure repositories for GitOps? Should app code and deployment config live together?
Mid
How do you promote a change from dev to staging to prod in a GitOps workflow?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free