A fleet of about ten VMs that deploy themselves via ansible-pull every 30 minutes. Every so often, one of them stops converging, stuck on a gpg a task importing a GPG key that nothing used anymore, somewhere in a shared role run by every VM.
Deploying a fleet of VMs with no central server pushing configuration, no secrets vault permanently exposed, and a simple question asked on every cycle: "was what I'm about to execute signed by someone authorized?" This post describes the pull-based GitOps architecture I built around that question, and why it mechanically shrinks the attack surface compared to a classic push model.