CGOA Gitops Patterns — 25 Questions

Question 1

You are managing environment promotion by overlaying Kustomize patches for 'prod', 'staging', and 'dev'. Which TWO of the following practices follow the GitOps principle of 'single source of truth' for environment configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using a 'base' directory for common resources and 'overlays' for environment differences. Separation of base and overlays ensures that the base configuration is shared, while environment-specific differences are isolated.

Answer

Hardcoding environment-specific image tags in the base templates

Answer

Storing all environment manifests in a single monolithic flat directory

Answer

Duplicating all YAML files for every environment

Question 2

You are implementing the App-of-Apps pattern using Argo CD. You have a root Application that points to a Helm chart containing multiple sub-Application manifests. When you update the source Git repository, some sub-applications remain in an 'OutOfSync' state while others update successfully. What is the most likely cause?

Accepted Answer

The child applications have 'automated.prune' set to false within their respective SyncPolicy objects.. The App-of-Apps pattern relies on the Argo CD controller to process the root application first. If the sub-applications are not being pruned or updated, it is often due to the 'self-heal' or 'prune' policy being disabled in the Application resource definition for the child applications.

Answer

The root application lacks the 'self-heal' parameter in its SyncPolicy.

Answer

The root application is using a recursive sync interval that is too high.

Answer

Argo CD requires a Project-level permission override for nested applications.

Question 3

When using the 'Git-generator' in ApplicationSet, you want to include only a subset of directories based on a specific file content. Which feature of ApplicationSet allows you to filter the directories discovered?

Accepted Answer

The 'selector' field within the generator.. The 'template.path' field combined with 'files' or 'directories' generators allows for granular control over which paths are included, and you can use the 'paths' field to specify glob patterns.

Answer

The 'syncPolicy' field.

Answer

The 'ignoreDifferences' field.

Answer

The 'AppProject' filter.

Question 4

You are implementing progressive delivery using Flagger. After a Canary resource is defined, which metric is most critical for Flagger to automatically rollback a deployment during a blue/green shift?

Accepted Answer

Request success rate and latency metrics. Flagger uses analysis templates to evaluate Prometheus metrics; if the error rate or latency thresholds are exceeded, it triggers a rollback.

Answer

Pod CPU usage

Answer

Number of running replicas

Answer

Git commit hash parity

Question 5

In a multi-cluster GitOps architecture using Argo CD, how do you manage credentials for a remote cluster that is not the cluster where Argo CD resides?

Accepted Answer

Use the argocd cluster add command to store credentials as a secret in the Argo CD namespace. You must add the remote cluster's API server and authentication credentials to Argo CD using the 'argocd cluster add' command, which stores the secret in the Argo CD namespace.

Answer

Modify the global ConfigMap in the Argo CD namespace

Answer

Add the cluster URL to the Git repository manifest

Answer

Manually create a Kubernetes secret in the remote cluster

Question 6

Your organization uses the App-of-Apps pattern in Argo CD to manage hundreds of microservices. You need to ensure that when a developer updates a repository structure, the root application automatically discovers and syncs new child applications without manual intervention. Which feature should be enabled in the Application resource?

Accepted Answer

Enable automated sync policy with self-healing and allow-empty. The self-healing and automated sync policies, combined with directory recursion, allow the App-of-Apps pattern to maintain state automatically.

Answer

Use the 'ignoreDifferences' field for the child application manifests

Answer

Set the sync policy to 'manual' and use a post-sync hook

Answer

Configure a manual webhook trigger on the root application

Question 7

In a blue-green progressive delivery deployment using Flagger, you notice that the 'primary' service is not receiving traffic even after the analysis successfully completes. What is the most likely cause?

Accepted Answer

The VirtualService or HTTPRoute is not pointing to the primary service. Flagger requires the primary service to be defined correctly for traffic shifting to occur.

Answer

The analysis template lacks the 'weight' parameter

Answer

The Flagger controller is in 'paused' mode

Answer

The canary resource is missing a 'host' definition

Question 8

You are deploying applications across multiple clusters using Argo CD. You want to implement a hub-and-spoke model where the central management cluster controls all edge clusters. Which THREE of the following are necessary to correctly configure this pattern?

Accepted Answer

Ensure the service account for Argo CD has cluster-admin permissions on target clusters. The hub-and-spoke pattern relies on cluster secrets, target cluster definitions, and proper project isolation.

Answer

Install Argo CD control plane components on every edge cluster

Answer

Configure the 'server.enable.proxy' flag in the hub cluster

Question 9

When promoting an application from staging to production using the 'GitOps directory' pattern, what is the most robust way to ensure environment-specific configurations are applied correctly?

Accepted Answer

Using Kustomize overlays for each environment. Using Kustomize overlays allows for a base configuration with environment-specific patches, ensuring no drift between environments.

Answer

Hardcoding environment names inside the main deployment file

Answer

Dynamic shell scripting in the CI pipeline

Answer

multiple_choice

Answer

Copy-pasting YAML files across folders

Question 10

You are managing a large-scale deployment using the App-of-Apps pattern in Argo CD. Which resource type do you primarily use as the parent application to reference child application manifests?

Accepted Answer

Application. The App-of-Apps pattern uses a root Application resource that points to a directory or Git repository containing multiple other Application resources.

Answer

SyncPolicy

Answer

ArgoCD Project

Answer

AppProject

Question 11

You want to promote a microservice from staging to production using the 'Git Branch' strategy. Which configuration allows you to ensure the exact same container image SHA is used across both environments?

Accepted Answer

Use a common Helm chart with environment-specific values files.. Using image tags like 'latest' is non-deterministic. Referencing the specific SHA in the Git manifest for the production branch ensures consistency.

Answer

Manually update the container image using kubectl edit.

Answer

Use a different container registry for production.

Answer

Change the image tag to 'production' in the deployment manifest.

Question 12

You are implementing progressive delivery with Flagger. You notice that the canary analysis is failing despite the new version being stable. What is the most common reason for this?

Accepted Answer

The Prometheus query for success rate is returning no data.. Flagger requires specific metrics (like HTTP request success rate) to be present to validate a canary. If the metrics provider (e.g., Prometheus) is not configured, the analysis cannot proceed.

Answer

The deployment strategy is set to 'Immediate' instead of 'Canary'.

Answer

The Git repository is in read-only mode.

Answer

The service mesh sidecar is missing the 'canary' annotation.

Question 13

In a multi-cluster GitOps setup using Argo CD, you need to ensure that specific secrets are only synced to a production cluster. Which approach is the most secure?

Accepted Answer

Use Argo CD 'Project' resource to limit which namespaces secrets can be synced to.. Using External Secrets Operator with cluster-specific namespaces or Argo CD Project-level restrictions allows you to segregate secret access effectively.

Answer

Store secrets in Git as plain text and use a private repository.

Answer

Use Helm post-render hooks to inject secrets at runtime.

Answer

Enable 'AllowClusterResources' in the global configuration.

Question 14

You are using the App-of-Apps pattern in Argo CD to manage hundreds of microservices. You notice that the parent application is stuck in a 'Syncing' state indefinitely. What is the most likely cause?

Accepted Answer

The child application's manifests include the parent application as a dependency.. In an App-of-Apps pattern, if the parent application has 'self-heal' or 'prune' enabled, it may conflict with child applications if the sync policy is misconfigured, often caused by circular dependencies or the parent attempting to manage its own child resources.

Answer

The parent application is not using a Helm chart source.

Answer

The Argo CD API server has exceeded its connection limit.

Answer

The parent application is missing the sync-policy configuration.

Question 15

What is the primary benefit of using a 'Git Branch' promotion pattern over a 'Directory-based' promotion pattern?

Accepted Answer

It allows teams to use PRs to review configuration changes for specific environments.. Branch-based promotion allows for better isolation of changes, enabling PR reviews for individual environments and preventing accidental merges to production.

Answer

It eliminates the need for CI pipelines.

Answer

It requires less storage space in the Git repository.

Answer

It automatically synchronizes all branches to the cluster simultaneously.

Question 16

When configuring an App-of-Apps pattern, which field in the 'Application' manifest controls the order in which child applications are deployed?

Accepted Answer

argocd.argoproj.io/sync-wave. The 'syncPolicy.syncOptions' field, specifically 'ApplyOutOfSyncOnly=true' or using 'wave' annotations, manages deployment ordering. However, standard Argo CD 'syncWaves' are the primary mechanism for ordering resources within an app.

Answer

spec.project

Answer

spec.syncPolicy.automated.prune

Answer

spec.source.targetRevision

Question 17

You are troubleshooting a multi-cluster Argo CD deployment where the 'staging' cluster is healthy but 'production' cluster is 'OutOfSync' despite having the same manifest source. Why might this happen?

Accepted Answer

A manual 'kubectl apply' was performed on the production cluster.. Argo CD evaluates the state of the cluster against the Git definition. If a manual change or a different controller (like a Helm release) has altered the cluster state, the sync status will reflect a mismatch.

Answer

The production cluster has a newer version of the Kubernetes API.

Answer

The 'staging' cluster is using a different Argo CD instance.

Answer

The Git repo is only cloned to the staging cluster.

Question 18

Which mechanism is used in a GitOps workflow to ensure that a 'Canary' deployment successfully rolls back if error rates spike?

Accepted Answer

Flagger AnalysisTemplates.. Flagger monitors metrics via a provider (e.g., Prometheus) during the canary phase. If thresholds are exceeded, it automatically triggers a rollback to the previous version.

Answer

Kubernetes Liveness Probes.

Answer

Argo Rollouts 'pause' condition.

Answer

Git revert commands via CI/CD.

Question 19

Which of the following is a core principle of GitOps?

Accepted Answer

The system state is defined in a version-controlled repository.. GitOps defines the desired state in a version-controlled repository, which acts as the 'single source of truth'.

Answer

Manual intervention is required to scale deployments.

Answer

Developers should have direct 'cluster-admin' access.

Answer

The system state is defined by the latest CI pipeline execution.

Question 20

In a multi-cluster environment, you are managing resources across 50 clusters. Which pattern prevents the 'Control Plane' bottleneck?

Accepted Answer

ApplicationSets with Cluster Generators.. The 'Hub-and-Spoke' pattern with local agents (like Argo CD ApplicationSets or Flux controllers on each cluster) prevents a single central controller from having to manage thousands of API connections.

Answer

Storing all YAML in a single massive monorepo.

Answer

Manual kubectl context switching.

Answer

Centralized Cluster Management.