DevOps, SRE & Cloud Interview · CI/CD & Automation · Lesson 3 of 3
GitOps & pipeline security
GitOps makes a Git repository the single source of truth for the desired state of your infrastructure and deployments. A controller in the cluster (Argo CD, Flux) continuously reconciles the running system toward what the repo declares — so a deploy is just a merged pull request.
- Declarative: the repo describes the desired state (manifests), not a sequence of imperative steps.
- Pull-based: an in-cluster agent pulls and applies changes, rather than a CI job pushing credentials into the cluster — smaller attack surface.
- Auditable + revertible: every change is a commit; rollback is git revert; drift is detected and corrected automatically.
Secrets do not belong in GitGitOps stores desired state in Git — but never commit plaintext secrets. Use sealed/encrypted secrets (SealedSecrets, SOPS) or an external store (Vault, cloud secret manager) referenced from the manifests.
Pipeline security matters because CI has broad credentials. Use short-lived OIDC tokens instead of long-lived cloud keys, scan dependencies and images, sign artifacts (provenance/SLSA), and require reviews on the pipeline definition itself.
◆ Lock it in
- GitOps = Git as source of truth + a controller that continuously reconciles the cluster to match it.
- Prefer pull-based reconciliation; deploy = merge PR, rollback = git revert.
- Secure the pipeline: OIDC short-lived creds, scan + sign artifacts, never commit plaintext secrets.
Feynman drill — say it out loudExplain how GitOps turns a deployment into a pull request, and how rollback works in that model.
Step 1 rate your confidence · Step 2 pick your answer
In GitOps, how is a rollback typically performed?
Step 1 — how sure are you?