Question

Your team currently uses a Jenkins pipeline that runs 'kubectl apply' with cluster credentials stored in the CI system to deploy to production. A security review flags that CI tooling holds long-lived cluster credentials. You are asked to adopt a GitOps approach with Flux to address this. Which characteristic of the GitOps pull-based model directly resolves this concern?

Accepted Answer

An in-cluster agent pulls the desired state from the Git repository and applies it, so external CI systems no longer need cluster credentials

Answer

The CI pipeline pushes manifests to the cluster faster because Flux caches images locally on each node

Answer

Flux encrypts the kubeconfig stored in Jenkins so the credentials can no longer be read by attackers

Answer

GitOps removes the need for a Git repository by storing all desired state directly in etcd