What is the security model of GitOps, and how do you secure the pipeline?
What they are really testing: Whether you connect pull-based delivery to a reduced attack surface, and treat git as the control plane that must be protected (signed commits, branch protection, least-privilege agent).
A real interview question
What is the security model of GitOps, and how do you secure the pipeline?
What most people say
drag me
“GitOps is secure because everything is in git and you can see the history.”
Visibility is one part, but it misses the core security win (pull-based keeps creds out of CI) and the new responsibility (git is now the control plane and must be locked down with branch protection, reviews, and signed commits).
The follow-ups they ask next
Why does pull-based delivery improve security over push?
Cluster credentials never leave the cluster, no CI/external system holds them, so a compromised pipeline cannot deploy to or attack the cluster. The credential attack surface shrinks substantially.
If git changes production, how do you protect it?
Treat git as the control plane: branch protection, required reviews, signed/verified commits, restricted merge rights on prod paths, and an audit trail. Compromising the repo is now equivalent to compromising prod.
What the interviewer is listening for
- Pull-based = no cluster creds in CI
- Treats git as the control plane (branch protection/reviews/signed commits)
- Least-privilege agent + audit trail
What sinks the answer
- Only "you can see history"
- Misses the pull-based credential benefit
- Does not lock down git or scope the agent
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“The win: [pull-based means no external system holds cluster credentials, so a compromised CI cannot deploy/attack the cluster]. The responsibility: [git is now the control plane, a merge changes prod, so protect it with branch protection, required reviews, signed/verified commits]. Plus [an attributed audit trail] and [least-privilege RBAC for the agent so a compromise is contained].”
Keep going with gitops
Foundation
What is GitOps, and what problem does it solve?
Foundation
What is the difference between push-based and pull-based deployment, and why does GitOps prefer pull?
Foundation
What are the core principles of GitOps?
Junior
What are Argo CD and Flux, and how do they differ?
Junior
How does drift detection and self-healing work in GitOps?
Junior
How do you structure repositories for GitOps? Should app code and deployment config live together?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free