CGOA Tooling — Timed 10 Questions

Question 1

Your organization requires that all Kubernetes manifest changes be signed and encrypted before being pushed to Git. Which tool is primarily designed for this 'at-rest' encryption approach?

Accepted Answer

Mozilla SOPS. Mozilla SOPS (Secrets OPerationS) is purpose-built to encrypt specific values within YAML, JSON, ENV, and INI files while leaving keys and structure in plaintext, making it ideal for committing encrypted manifests to Git. It supports KMS, age, PGP, and cloud KMS backends, and integrates natively with Flux for decryption at apply time.

Answer

Kyverno

Answer

Sealed Secrets

Answer

HashiCorp Vault

Question 2

In an ArgoCD environment, you notice that a specific set of resources is being ignored during sync. What field in the 'argocd-cm' ConfigMap or the Application manifest is likely responsible?

Accepted Answer

ignoreDifferences. The ignoreDifferences field in an ArgoCD Application manifest (or in argocd-cm for global config) tells ArgoCD to ignore specific differences between the desired state in Git and the live state in the cluster, so those resources or fields are not flagged as OutOfSync and are not synced. This is the correct field when you want ArgoCD to skip reconciling certain fields or resources.

Answer

syncPolicy.automated.prune

Answer

resource.exclusions

Answer

selfHeal

Question 3

You are using ArgoCD to deploy an application. You notice that the Application status remains 'OutOfSync' even after manual refreshes. Which feature should you examine to determine if the controller is failing to reach the cluster API?

Accepted Answer

ArgoCD App Details event log. The ArgoCD App Details event log provides a chronological record of events and errors related to the Application resource, including issues with the controller reaching the cluster API. By examining this event log, you can identify if the controller is failing to communicate with the cluster, which would cause the Application to remain OutOfSync.

Answer

Project settings

Answer

ApplicationSet controller logs

Answer

Git repository webhooks

Question 4

You are using ArgoCD and need to inject a value into a manifest that is not present in Git, such as a temporary credential. Which feature would you use to do this dynamic injection?

Accepted Answer

Helm values override in Application manifest. ArgoCD supports Helm values overrides in the Application manifest, which lets you inject values not present in Git at sync time. This is the mechanism for dynamic injection of temporary credentials or environment-specific values. The other options are not ArgoCD features for injecting values into manifests.

Answer

Secret injection controller

Answer

Resource hooks

Answer

Git commit override

Question 5

What is the primary function of the Flux Image Reflector Controller?

Accepted Answer

Scanning container registries for updates. The Flux Image Reflector Controller (part of Flux's image automation toolkit) scans container registries to detect new image tags or digests that match a defined policy. It exposes this information as ImagePolicy and ImageRepository resources, which the Image Automation Controller then uses to update manifests in Git. Its job is discovery of image updates, not applying manifests or enforcing policy.

Answer

Enforcing policies

Answer

Applying Kubernetes manifests

Answer

Encrypting secrets

Question 6

What is a 'GitOps Operator'?

Accepted Answer

A controller that continuously reconciles Git with cluster state. A GitOps operator is a Kubernetes controller that continuously reconciles the desired state declared in Git with the actual state of the cluster. It watches Git repositories (and the cluster) and applies or reverts changes to keep them in sync, embodying the pull-based GitOps model. Argo CD and Flux are canonical examples.

Answer

A human user who manages Git

Answer

A CI/CD pipeline server

Answer

A Git server provider

Question 7

You are using Argo CD to manage a production application. A developer reports that the application is stuck in a "Progressing" state, and the UI shows a resource that is not becoming healthy. You need to inspect the live resource and compare it to the desired state in Git. Which kubectl command should you use?

Accepted Answer

kubectl describe

-n . When a resource is stuck in Progressing, the issue lies with the live Kubernetes object, not the Argo CD Application. Using kubectl describe on the specific resource provides events and status conditions that explain why it is not healthy, such as image pull failures or probe errors. This is the most direct diagnostic step.

Answer

kubectl get application <app-name> -n argocd -o yaml

Answer

argocd app diff <app-name>

Answer

kubectl logs -n argocd deployment/argocd-application-controller

Question 8

You are configuring Flux to manage a multi-tenant cluster. You need to ensure that specific namespaces only allow images from an internal registry. Which tool should you use to enforce this at admission time?

Accepted Answer

Kyverno. Kyverno is a Kubernetes-native policy engine that enforces rules at admission time via a validating (and mutating) admission webhook, making it the correct tool to restrict image registries per namespace. A Kyverno ClusterPolicy or Policy with a validate rule can match pods in specific namespaces and reject any image not sourced from the internal registry.

Answer

ArgoCD Notifications

Answer

Sealed Secrets

Answer

Flux Image Automation Controller

Question 9

You are using ArgoCD and need to ensure that secret values stored in Git via Sealed Secrets are decrypted only within the target cluster. What component performs the actual decryption of a SealedSecret resource?

Accepted Answer

Sealed Secrets controller. The Sealed Secrets controller is the in-cluster component (deployed as a Kubernetes controller/operator) that holds the private key used to decrypt SealedSecret resources. When a SealedSecret CRD is applied, the controller watches for it, decrypts the encrypted payload using the cluster's private key, and creates a standard Kubernetes Secret that workloads can consume. This design ensures the asymmetric private key never leaves the target cluster, so Git only ever stores ciphertext.

Answer

GitOps CLI (kubeseal)

Answer

Kubernetes API Server

Answer

ArgoCD Application controller

Question 10

You are using OPA Gatekeeper with GitOps. You want to prevent any deployment that does not have an 'owner' label. Where should this policy be applied to ensure it is enforced for all GitOps-driven changes?

Accepted Answer

Validating Admission Webhook. OPA Gatekeeper enforces policies through a Validating Admission Webhook registered with the Kubernetes API server, so every create/update request — including those from Flux or ArgoCD — is evaluated before persistence. This guarantees the 'owner' label requirement is enforced regardless of how the manifest reaches the cluster.

Answer

Git pre-receive hook

Answer

Flux Source Controller

Answer

ArgoCD AppProject