What Is Push-Based Deployment?

Push-based deployment is the traditional model where the CI/CD pipeline reaches into the target environment and applies changes directly, for example by running kubectl, an SSH script, or a cloud CLI from a job. The pipeline holds the credentials and drives the rollout. It is simple and explicit but concentrates access in CI.

Why it matters

Push-based deploys are straightforward and give the pipeline full control over sequencing, but they require CI to hold production credentials, widening the blast radius if CI is compromised. Pairing them with OIDC federation and least privilege mitigates that risk.

Related concepts

• Contrasted with pull-based deployment
• CI holds environment credentials directly
• OIDC federation reduces the credential risk

Related guides