CGOA Tooling — 25 Questions

Question 1

Your organization requires that all Kubernetes manifest changes be signed and encrypted before being pushed to Git. Which tool is primarily designed for this 'at-rest' encryption approach?

Accepted Answer

Mozilla SOPS. Mozilla SOPS (Secrets OPerationS) is purpose-built to encrypt specific values within YAML, JSON, ENV, and INI files while leaving keys and structure in plaintext, making it ideal for committing encrypted manifests to Git. It supports KMS, age, PGP, and cloud KMS backends, and integrates natively with Flux for decryption at apply time.

Answer

Kyverno

Answer

Sealed Secrets

Answer

HashiCorp Vault

Question 2

In an ArgoCD environment, you notice that a specific set of resources is being ignored during sync. What field in the 'argocd-cm' ConfigMap or the Application manifest is likely responsible?

Accepted Answer

ignoreDifferences. The ignoreDifferences field in an ArgoCD Application manifest (or in argocd-cm for global config) tells ArgoCD to ignore specific differences between the desired state in Git and the live state in the cluster, so those resources or fields are not flagged as OutOfSync and are not synced. This is the correct field when you want ArgoCD to skip reconciling certain fields or resources.

Answer

syncPolicy.automated.prune

Answer

resource.exclusions

Answer

selfHeal

Question 3

You are using ArgoCD to deploy an application. You notice that the Application status remains 'OutOfSync' even after manual refreshes. Which feature should you examine to determine if the controller is failing to reach the cluster API?

Accepted Answer

ArgoCD App Details event log. The ArgoCD App Details event log provides a chronological record of events and errors related to the Application resource, including issues with the controller reaching the cluster API. By examining this event log, you can identify if the controller is failing to communicate with the cluster, which would cause the Application to remain OutOfSync.

Answer

Project settings

Answer

ApplicationSet controller logs

Answer

Git repository webhooks

Question 4

You are using ArgoCD and need to inject a value into a manifest that is not present in Git, such as a temporary credential. Which feature would you use to do this dynamic injection?

Accepted Answer

Helm values override in Application manifest. ArgoCD supports Helm values overrides in the Application manifest, which lets you inject values not present in Git at sync time. This is the mechanism for dynamic injection of temporary credentials or environment-specific values. The other options are not ArgoCD features for injecting values into manifests.

Answer

Secret injection controller

Answer

Resource hooks

Answer

Git commit override

Question 5

What is the primary function of the Flux Image Reflector Controller?

Accepted Answer

Scanning container registries for updates. The Flux Image Reflector Controller (part of Flux's image automation toolkit) scans container registries to detect new image tags or digests that match a defined policy. It exposes this information as ImagePolicy and ImageRepository resources, which the Image Automation Controller then uses to update manifests in Git. Its job is discovery of image updates, not applying manifests or enforcing policy.

Answer

Enforcing policies

Answer

Applying Kubernetes manifests

Answer

Encrypting secrets

Question 6

What is a 'GitOps Operator'?

Accepted Answer

A controller that continuously reconciles Git with cluster state. A GitOps operator is a Kubernetes controller that continuously reconciles the desired state declared in Git with the actual state of the cluster. It watches Git repositories (and the cluster) and applies or reverts changes to keep them in sync, embodying the pull-based GitOps model. Argo CD and Flux are canonical examples.

Answer

A human user who manages Git

Answer

A CI/CD pipeline server

Answer

A Git server provider

Question 7

You are using Argo CD to manage a production application. A developer reports that the application is stuck in a "Progressing" state, and the UI shows a resource that is not becoming healthy. You need to inspect the live resource and compare it to the desired state in Git. Which kubectl command should you use?

Accepted Answer

kubectl describe

-n . When a resource is stuck in Progressing, the issue lies with the live Kubernetes object, not the Argo CD Application. Using kubectl describe on the specific resource provides events and status conditions that explain why it is not healthy, such as image pull failures or probe errors. This is the most direct diagnostic step.

Answer

kubectl get application <app-name> -n argocd -o yaml

Answer

argocd app diff <app-name>

Answer

kubectl logs -n argocd deployment/argocd-application-controller

Question 8

You are configuring Flux to manage a multi-tenant cluster. You need to ensure that specific namespaces only allow images from an internal registry. Which tool should you use to enforce this at admission time?

Accepted Answer

Kyverno. Kyverno is a Kubernetes-native policy engine that enforces rules at admission time via a validating (and mutating) admission webhook, making it the correct tool to restrict image registries per namespace. A Kyverno ClusterPolicy or Policy with a validate rule can match pods in specific namespaces and reject any image not sourced from the internal registry.

Answer

ArgoCD Notifications

Answer

Sealed Secrets

Answer

Flux Image Automation Controller

Question 9

You are using ArgoCD and need to ensure that secret values stored in Git via Sealed Secrets are decrypted only within the target cluster. What component performs the actual decryption of a SealedSecret resource?

Accepted Answer

Sealed Secrets controller. The Sealed Secrets controller is the in-cluster component (deployed as a Kubernetes controller/operator) that holds the private key used to decrypt SealedSecret resources. When a SealedSecret CRD is applied, the controller watches for it, decrypts the encrypted payload using the cluster's private key, and creates a standard Kubernetes Secret that workloads can consume. This design ensures the asymmetric private key never leaves the target cluster, so Git only ever stores ciphertext.

Answer

GitOps CLI (kubeseal)

Answer

Kubernetes API Server

Answer

ArgoCD Application controller

Question 10

You are using OPA Gatekeeper with GitOps. You want to prevent any deployment that does not have an 'owner' label. Where should this policy be applied to ensure it is enforced for all GitOps-driven changes?

Accepted Answer

Validating Admission Webhook. OPA Gatekeeper enforces policies through a Validating Admission Webhook registered with the Kubernetes API server, so every create/update request — including those from Flux or ArgoCD — is evaluated before persistence. This guarantees the 'owner' label requirement is enforced regardless of how the manifest reaches the cluster.

Answer

Git pre-receive hook

Answer

Flux Source Controller

Answer

ArgoCD AppProject

Question 11

When migrating from ArgoCD to Flux, you want to replicate the 'Sync Waves' behavior. Which Flux feature provides equivalent control over the order of resource reconciliation?

Accepted Answer

dependsOn. Flux's dependsOn field in a Kustomization or HelmRelease resource declares dependencies, ensuring that one resource is reconciled only after its dependencies are ready. This replicates ArgoCD's Sync Waves behavior, where resources are applied in ordered waves. dependsOn provides the same ordering guarantee by gating reconciliation on dependency health.

Answer

Post-sync hooks

Answer

Sync waves

Answer

Reconciliation intervals

Question 12

Which GitOps tool relies primarily on a pull-based model utilizing the 'Source Controller' and 'Kustomization' custom resources?

Accepted Answer

Flux. Flux is a GitOps tool that uses a pull-based model where the Source Controller and Kustomization custom resources are core components. The Source Controller fetches manifests from Git repositories, and Kustomization resources define how to apply those manifests to the cluster. This architecture enables continuous reconciliation of the desired state from Git.

Answer

ArgoCD

Answer

Terraform

Answer

Helm

Question 13

Which of the following is a key advantage of using a 'pull' based GitOps model (like Flux or ArgoCD) over a 'push' based CI/CD pipeline?

Accepted Answer

Elimination of external cluster credentials in CI. In a pull-based GitOps model, the in-cluster agent (Flux or ArgoCD) runs inside the Kubernetes cluster and pulls the desired state from Git. Because the agent already has in-cluster credentials via its ServiceAccount, the CI system never needs kubeconfig or cluster-admin credentials to deploy — it only commits to Git. This dramatically shrinks the attack surface and removes the need to store long-lived cluster credentials in CI secrets.

Answer

Faster build times

Answer

Automatic unit testing

Answer

No need for Git

Question 14

You are using Flux with Kustomize. You want to apply different configurations for production and staging, but both use the same base manifests. Which Kustomize feature allows this?

Accepted Answer

Overlays. Kustomize overlays let you layer environment-specific customisations (replicas, image tags, patches, config) on top of a shared base without duplicating manifests. Flux's Kustomization resource points at the overlay path for each environment, so production and staging share the same base while diverging only where needed.

Answer

Post-build variables

Answer

Flux Kustomization resource

Answer

Helm charts

Question 15

You are managing secrets using SOPS with Age. You notice that Flux cannot decrypt the files. What is the most likely cause?

Accepted Answer

Missing private key secret in the flux-system namespace. Flux's kustomize-controller and helm-controller perform SOPS decryption in-cluster using the Age private key, which must be present as a Kubernetes Secret named 'sops-age' in the flux-system namespace (referenced via the decryption.secretRef field). If that Secret is missing or the key doesn't match the Age recipient used to encrypt the files, Flux logs 'failed to decrypt' errors and reconciliation fails. SOPS version, network latency, and git branch have no bearing on the in-cluster decryption step.

Answer

SOPS version mismatch

Answer

Network latency

Answer

Incorrect git branch

Question 16

You have a large ArgoCD installation and want to limit the blast radius. Which feature allows you to restrict which namespaces an application can deploy to?

Accepted Answer

AppProject. AppProject is the ArgoCD custom resource that defines a logical grouping of applications with explicit boundaries: permitted source repositories, permitted destination clusters, and permitted destination namespaces. By setting spec.destinations with a namespace allow-list (or wildcard restrictions), the AppProject enforces that any Application assigned to it can only deploy into those namespaces, directly limiting blast radius. This is the documented mechanism for multi-tenant isolation in ArgoCD.

Answer

ClusterRoleBinding

Answer

Sync policies

Answer

ApplicationSet

Question 17

An ArgoCD application is configured with 'SelfHeal' set to true. If a developer manually modifies a Deployment's replica count via kubectl, what happens?

Accepted Answer

ArgoCD reverts the change to match the Git state. When ArgoCD's SelfHeal is enabled, it automatically reconciles the live cluster state with the desired state in Git. If a developer manually changes a Deployment's replica count via kubectl, ArgoCD detects the drift and reverts the change to match Git. This ensures the Git repository remains the single source of truth.

Answer

The change is permanently accepted

Answer

ArgoCD flags the app as 'OutOfSync' but waits for manual intervention

Answer

The manual change is merged into Git

Question 18

When troubleshooting a Kyverno policy, which command should you use to check if a specific resource complies with the policy?

Accepted Answer

kyverno apply. The 'kyverno apply' command is used to apply Kyverno policies to a given resource or set of resources and check compliance. It simulates policy enforcement and reports whether the resource complies with the specified policies. This is the correct command for troubleshooting whether a specific resource adheres to a policy.

Answer

kubectl get policies

Answer

kyverno test

Answer

kubectl describe policy

Question 19

What is the purpose of the 'SealedSecrets' custom resource?

Accepted Answer

Encrypting sensitive data for Git storage. SealedSecrets is a Kubernetes controller that encrypts Secret manifests with a cluster-specific public key so the ciphertext can be safely committed to Git. Only the controller in the target cluster, holding the private key, can decrypt the SealedSecret back into a regular Secret. This enables GitOps workflows where secrets live in version control without exposing plaintext.

Answer

Backing up Kubernetes secrets

Answer

Managing cluster-wide RBAC

Answer

Encrypting traffic between pods

Question 20

You are debugging an ArgoCD sync failure. You find the 'Sync Status' is 'Failed'. Where is the most detailed error information located?

Accepted Answer

Sync Result in Application UI. The Sync Result in the Application UI provides the most detailed error information for a failed sync. It shows the exact error message from the sync operation, including which resource failed, the reason (e.g., validation error, conflict, or apply failure), and often the full output from kubectl apply. This is the primary place to diagnose sync failures because it aggregates the results of the sync attempt.

Answer

ApplicationSet status

Answer

Git log

Answer

ArgoCD repo server logs