The correct answer is Applying configuration changes straight to the cluster from a developer workstation.

This practice weakens the GitOps principle because it bypasses the repository that should act as the single source of truth. Making changes directly on the cluster means those changes are not recorded in the Git history and they can diverge from the declared state in the repository. GitOps reconciliation controllers expect the repository to contain the canonical desired state and they will either overwrite manual changes or fail to detect intentional drift when the repo is not updated.

Maintaining several Git repositories that each hold parts of the same cluster configuration is not necessarily wrong. Many organizations use a multi-repo approach and preserve a single logical source of truth by clearly scoping repositories and using automation to assemble or link the canonical configuration. Proper conventions and tooling can keep the source of truth intact even when manifests are split across repos.

Enforcing Git commit signatures to improve repository security does not weaken the source of truth. Signed commits actually strengthen trust in the repository by verifying authorship and integrity. This practice supports GitOps goals rather than undermining them.

Using a dedicated branch for each environment to separate staging and production manifests is also not inherently weakening. Branch-per-environment is a common pattern and it still keeps the declared state under version control. The pattern can lead to complexity if branches drift, but when branches are kept up to date and reconciled they preserve a clear source of truth.

Full AWS Practitioner Certification Question