75 of 98 questions · Page 1/2 · Gitops Principles · Answers revealed
Which THREE of the following are core requirements for adopting a GitOps-based workflow?
Essential for defining the desired state.
Why this answer
GitOps requires a declarative state in Git, an automated agent, and an immutable history.
Which TWO of the following are core principles of GitOps?
This is a core pillar of GitOps.
Why this answer
Declarative state and automated, continuous reconciliation are the foundational pillars of the GitOps methodology.
Which of the following is considered an 'Anti-pattern' in a GitOps workflow?
This creates 'configuration drift' and bypasses version control.
Why this answer
GitOps requires that the Git repository is the sole source of truth; any manual 'hotfixing' via kubectl overrides the versioned state and creates drift.
When configuring a GitOps tool, what is the purpose of a 'webhook' in relation to the Git repository?
This optimizes the poll interval and reduces latency.
Why this answer
Webhooks allow the Git server to notify the GitOps controller that a change has occurred, triggering an immediate sync check.
Which of the following best describes the 'Declarative' principle in GitOps?
Declarative systems define the 'what' rather than the 'how'.
Why this answer
Declarative means defining the end state of the system, rather than the sequence of commands to reach that state.
Which TWO are common strategies for GitOps repo structure?
Standard for managing multi-environment configs.
Why this answer
Common strategies include 'App-of-Apps' for managing nested dependencies and 'Directory-per-Environment' for separating configurations.
When implementing a GitOps workflow with Argo CD, what is the role of the 'AppProject' custom resource?
AppProject controls which repositories and namespaces are accessible by specific applications.
Why this answer
The AppProject resource acts as a logical grouping for Applications, allowing administrators to restrict where they can be deployed and which resources are permitted, providing multi-tenant security.
Why must the desired state be 'versioned' in Git in a GitOps architecture?
Versioning provides a history of states that can be redeployed at any time.
Why this answer
Version control allows for easy rollbacks, audit trails, and consistent releases across environments.
When using Argo CD, what does the 'Sync Status' 'OutOfSync' indicate?
The controller identifies drift between the cluster and the repository.
Why this answer
It means the live state of the resources in the cluster does not match the desired state defined in the linked Git repository.
A team is transitioning to GitOps. Which action best aligns with the principle of Declarative Desired State?
This represents the desired state declaratively in version control.
Why this answer
Declarative configuration defines the end state, allowing tools to converge the system rather than executing imperative scripts.
Which statement best defines 'immutable state' in the context of GitOps?
Immutability in Git implies that the state associated with a commit should be permanent.
Why this answer
Once a configuration is committed to Git, that specific version of the state should remain unchanged in the repository.
In a multi-cluster environment, how does the GitOps principle of 'Declarative Desired State' simplify cluster management?
Centralized declarations applied to multiple clusters ensure identical desired states.
Why this answer
It allows for a single source of truth that defines the state for multiple clusters, ensuring consistency across environments.
In a GitOps architecture, why is it critical that the entire state of the system is declarative?
Convergence requires comparing the desired declaration against the live state.
Why this answer
Declarative state allows the reconciliation loop to compare the current live state against the desired state defined in code, which is essential for automated drift correction.
A DevOps team is storing its Kubernetes manifests in a Git repository. To adhere strictly to the principle of versioned and immutable desired state in Git, how should the team manage changes to an existing deployment's container image tag?
Updating the manifest in Git creates a versioned, immutable record of the state change, allowing automated reconciliation.
Why this answer
GitOps principles require that the desired state stored in Git is versioned and immutable. Modifying the manifest in Git via a new commit or pull request creates a traceable, versioned audit trail. Directly mutating live cluster resources using kubectl violates the single source of truth principle.
When considering the GitOps principle of 'Declarative Desired State', which TWO of the following statements accurately reflect why manifests should be stored in Git?
The Git repo must be the authoritative reference for the system state.
Why this answer
Git serves as the single source of truth for the system's state, and using a repository allows for the application of standard software development practices like Pull Requests.
In an Argo CD deployment, a developer notices that manual changes made via kubectl are being reverted automatically. What feature is responsible for this behavior?
Self-heal continuously monitors drift and applies Git state.
Why this answer
Self-healing or automated reconciliation is the GitOps mechanism that restores the cluster to the state defined in Git.
In GitOps, what is a 'Merge Request' (or Pull Request) used for?
This creates a collaborative and secure workflow.
Why this answer
The PR/MR process acts as a gatekeeping mechanism for reviewing and approving changes before they are merged into the main branch and applied to the cluster.
Which of these is NOT a principle of GitOps?
Manual, imperative updates are the opposite of GitOps principles.
Why this answer
GitOps is inherently declarative; imperative commands violate the core principle of a defined desired state.
Why is 'pull-based' reconciliation considered more secure than 'push-based' CI/CD?
The cluster pulls from the repo, meaning no inbound ports need to be opened for the CI system.
Why this answer
Push-based systems require the CI/CD server to have cluster-admin credentials, whereas pull-based controllers use service accounts within the cluster.
Which THREE components are typically involved in a GitOps reconciliation loop?
The agent performing reconciliation.
Why this answer
The loop involves the Git source, the controller, and the cluster resources.
When syncing a Git repository to a cluster, what is the 'Sync Policy' in Argo CD?
This is the primary function of the sync policy.
Why this answer
The sync policy determines whether the cluster is updated automatically when drift is detected or if manual intervention is required.
A team is reviewing their deployment practices against OpenGitOps standards. Which THREE conditions are required to satisfy the 'Declarative Desired State' and 'Versioned and Immutable State' principles?
Declarative state specification ensures that system state is defined by static declaration rather than procedural steps.
Why this answer
OpenGitOps principles state that desired state must be expressed declaratively, stored in a system that enforces versioning and immutability (like Git), and serve as the single source of truth.
Your team is using a pull-based GitOps pattern. Which component is responsible for initiating the communication to the Git repository to check for updates?
The agent pulls the desired state, maintaining security and reducing firewall complexity.
Why this answer
In a pull-based model, the agent/controller running inside the cluster actively polls the Git repository.
Which TWO are common pitfalls in a GitOps implementation?
This breaks the GitOps source of truth.
Why this answer
Common pitfalls include failing to secure credentials and relying on imperative patterns, such as manual cluster edits.
In the context of GitOps, what is meant by 'Pull-based' architecture?
This removes the need for the CI system to have cluster-admin privileges.
Why this answer
The controller pulls the desired state from Git, which is more secure than pushing secrets out to the cluster.
Which THREE actions occur when a GitOps controller detects drift?
Alerting is essential for maintaining visibility.
Why this answer
When drift occurs, the controller flags the resource as 'OutOfSync', alerts the relevant teams, and optionally applies the correction to restore the desired state.
A platform team manages 50 Kubernetes clusters using GitOps. They need to ensure that an emergency rollback of an application across all clusters can be executed cleanly and audited effectively. What is the standard GitOps mechanism to achieve this rollback?
Reverting the commit in Git updates the target desired state declaratively, allowing automated agents across all clusters to roll back safely while preserving history.
Why this answer
In GitOps, all changes—including rollbacks—are executed by interacting with Git. Reverting the Git commit to a previous known-good state causes the GitOps controllers across all 50 clusters to reconcile to that restored desired state, maintaining a complete audit trail.
Which THREE of these are valid methods for handling configuration differences across environments (e.g., Dev vs Prod)?
This is a clean and common GitOps structure.
Why this answer
Effective GitOps uses tools like Helm, Kustomize, or directory separation to manage environmental differences without code duplication.
A platform engineer wants to configure an application state declaratively. They write an imperative script containing commands like 'kubectl scale deployment --replicas=5' and push this script into a Git repository for execution by a cron job. Why does this approach fail to satisfy the core GitOps principle of 'Declarative Desired State'?
Declarative state specifies the desired end-state (e.g., replicas: 5) rather than the operational actions required to get there.
Why this answer
Imperative scripts define 'how' to achieve a state through a sequence of steps, rather than expressing 'what' the target system should look like (declarative). Declarative state relies on static configuration documents (like YAML manifests) that express target end-states.
Your organization requires an audit trail of all changes to infrastructure. Why is GitOps superior to imperative 'kubectl' commands for this?
Git's log and commit history satisfy strict compliance and auditing requirements.
Why this answer
Git provides a cryptographically signed, timestamped, and versioned history of all changes, which is ideal for auditing.
Which THREE activities are part of the 'Automated Pull-Based Reconciliation' process?
Executing the reconciliation.
Why this answer
The process involves detecting changes, fetching manifests, and applying them.
Which TWO scenarios represent 'drift' in a GitOps environment?
This is a direct, manual change that drifts from Git.
Why this answer
Drift occurs when the cluster state deviates from the version-controlled Git state.
Which TWO of the following are primary benefits of storing the entire desired state of a system in a versioned Git repository?
Git commit history serves as an immutable audit log.
Why this answer
Version control provides a clear audit trail of who changed what, and enables easy restoration to a previous known-good state.
What is the primary function of a 'GitOps Pipeline' versus a 'GitOps Controller'?
This division of labor is a hallmark of robust GitOps.
Why this answer
The pipeline handles the CI (build/test/publish) process, while the controller handles the CD (pull/reconcile) process.
Which TWO items are typically included in a GitOps repository?
These are standard for managing configuration variations.
Why this answer
A GitOps repository contains the declarative definitions of the infrastructure (Kubernetes manifests) and the configuration required to manage them.
In a GitOps workflow, where does the 'source of truth' reside?
Git serves as the immutable source of truth for the desired configuration.
Why this answer
The Git repository holds the declarative state that the cluster must match.
During an audit, an organization discovers that a secret was accidentally committed to a Git repository managed by Flux. An engineer deletes the commit containing the secret using 'git push --force' with a rewritten history. Why is this action problematic in a production GitOps environment?
GitOps relies on Git as an append-only, immutable audit log. Rewriting history disrupts reconciler tracking and undermines auditability.
Why this answer
Rewriting Git history invalidates the audit log and can cause synchronization issues or unexpected behaviors across distributed reconcilers that rely on immutable commit SHAs. In GitOps, secrets should be removed properly (e.g., using secret management tools like Sealed Secrets or SOPS) and rotated immediately rather than altering historical commits.
Which TWO of the following are considered advantages of the GitOps approach?
Every change is documented and linked to a commit/user.
Why this answer
GitOps improves auditability through Git logs and reduces the risk of manual configuration errors.
Which THREE factors should be considered when choosing a GitOps controller?
Crucial for scaling infrastructure.
Why this answer
Key considerations include support for multi-cluster environments, secret management capabilities, and how well it integrates with existing CI tools.
Your team is using Flux CD to manage Kubernetes resources. You notice that the application status is 'Suspended'. What is the most likely reason for this state in the context of GitOps principles?
Setting 'suspend: true' is a deliberate configuration to pause reconciliation.
Why this answer
Suspending a Kustomization or HelmRelease in Flux stops the reconciliation process, meaning the controller will no longer apply changes from Git to the cluster.
Why should you avoid using 'latest' as a container image tag in GitOps?
Deterministic state is a GitOps requirement.
Why this answer
Using 'latest' makes the deployment non-deterministic because the image associated with the tag can change, making it impossible to know exactly what is running in the cluster.
Which THREE items should be excluded from a GitOps repository?
Store these in a registry.
Why this answer
GitOps repositories should focus on declarative config, not binary build artifacts, secrets, or transient runtime information.
Which TWO aspects of GitOps help ensure 'Continuous Drift Detection'?
This comparison defines the drift detection process.
Why this answer
Drift detection relies on comparing the live state against the repository state and alerting on discrepancies.
What is the purpose of 'Image Tagging' in a GitOps workflow?
Immutability requires referencing exact versions.
Why this answer
Using specific image tags (e.g., SHA-based, not 'latest') ensures that the deployment remains deterministic and immutable.
Which of these is a typical 'Desired State' artifact in GitOps?
YAML manifests define the expected state of the cluster.
Why this answer
Kubernetes manifest files, Helm charts, or Kustomize templates are the standard ways to define declarative state.
What is the primary risk of a 'Push-based' deployment model compared to 'Pull-based'?
This creates a 'God-mode' credential issue.
Why this answer
Push-based models require the CI system to have cluster-admin credentials, creating a significant security vulnerability if the CI system is compromised.
What is the primary function of the 'reconciliation loop' in GitOps?
This is the core definition of the GitOps reconciliation loop.
Why this answer
The reconciliation loop ensures that the current cluster state matches the desired state defined in Git.
If a GitOps controller detects that an image tag has been changed in the cluster but not in Git, what does the controller do?
Continuous drift correction ensures the live state returns to the desired state.
Why this answer
The controller identifies this as drift and uses the Git source of truth to revert the image tag back to the version declared in Git.
How does GitOps help with disaster recovery?
This is the essence of 'reproducible infrastructure'.
Why this answer
Because the entire cluster state is defined in Git, you can simply point a new cluster to the repository to recreate the environment.
Which THREE of the following are essential components of an effective GitOps 'Continuous Drift Detection and Correction' strategy?
Reconciliation is the engine of drift detection.
Why this answer
Drift detection requires a continuous comparison (reconciliation) between Git and the live cluster, alerting on differences, and optionally auto-remediating them.
Which of these is a valid 'GitOps' approach for multi-environment management?
This is the standard, clean pattern for multi-environment GitOps.
Why this answer
Using different folders or branches for environment-specific configurations allows for clear separation and controlled deployments.
An organization uses Argo CD to manage Kubernetes clusters. A developer manually modifies a Deployment's replica count via kubectl. Which mechanism in Argo CD ensures this manual change is identified as non-compliant with the GitOps repository?
The Argo CD controller continuously polls the cluster and Git to detect drift.
Why this answer
Argo CD continuously compares the live state of the cluster with the desired state defined in Git. When a discrepancy is detected, it reports the status as 'OutOfSync', performing drift detection.
You are using Argo CD. A developer manually scales a Deployment replica count using 'kubectl scale'. What happens next in a standard GitOps implementation?
This is the core behavior of automated drift correction.
Why this answer
The GitOps controller detects a mismatch between the live state and the Git-defined desired state and automatically reverts it.
A developer pushes a change to Git, but the cluster does not update. Which log source is most effective for debugging the pull-based mechanism?
The controller is responsible for pulling the state and applying it.
Why this answer
The controller logs contain information about the reconciliation process, including authentication or parsing errors.
What is the primary role of an 'Immutable' state in a GitOps repository?
Immutability is key to reproducible environments and quick recovery.
Why this answer
Immutability ensures that once a state is recorded, it cannot be tampered with, and historical states are reproducible.
Why does GitOps encourage the use of small, frequent commits?
This is a standard DevOps and GitOps practice for risk reduction.
Why this answer
Small commits make it easier to identify the cause of failures, simplify rollbacks, and reduce the risk of large-scale outages.
An organization is migrating to GitOps using Argo CD. During an audit, you notice that manual changes made directly to the Kubernetes cluster via kubectl are being reverted within minutes. Which component of the GitOps pipeline is performing this action?
The Application Controller is responsible for the continuous reconciliation loop that detects and corrects drift.
Why this answer
The Application Controller in Argo CD continuously monitors the live state and compares it against the declared state in Git, initiating a sync to fix drift.
When should you use Kustomize in a GitOps workflow?
Kustomize allows for 'base' and 'overlay' patterns perfectly suited for GitOps.
Why this answer
Kustomize is excellent for managing environment-specific configurations without duplicating base manifests.
Which of the following is a primary benefit of using a GitOps pull-based model over a push-based CI/CD model?
The cluster controller pulls from Git, so credentials stay within the cluster boundary.
Why this answer
Pull-based models increase security by eliminating the need to expose cluster credentials to external CI/CD pipelines.
You are implementing a GitOps workflow where the desired state is stored in a private repository. The Argo CD controller requires access to this repository. What is the most secure GitOps-compliant way to provide this access?
This method follows the principle of least privilege and keeps credentials out of source control.
Why this answer
Using a Kubernetes Secret to store repository credentials allows for secure, native integration with the Argo CD controller.
What is the primary role of the 'Git' repository in the GitOps cycle?
Every change must be in Git to be reflected in the cluster.
Why this answer
It serves as the single source of truth for the entire cluster configuration.
Which THREE features of Kubernetes are commonly used to support GitOps?
The mechanism for applying state.
Why this answer
GitOps relies on the Kubernetes API, Namespaces for isolation, and RBAC to secure the controller's access.
Which of these is the most suitable tool to use as the 'Git' component of GitOps?
Git's branching, merging, and history are fundamental to GitOps.
Why this answer
Any standard Git-compatible server like GitHub, GitLab, or Bitbucket provides the necessary features for GitOps.
You are configuring an automated GitOps pipeline. How do you prevent 'drift' from occurring due to out-of-band changes?
Self-healing forces the cluster to align with the Git-defined desired state.
Why this answer
Enabling automated self-healing (or auto-sync) in the GitOps controller ensures that any unauthorized cluster changes are automatically reverted.
An application is failing because a developer accidentally edited a ConfigMap in the cluster directly. Which GitOps feature prevents this from recurring?
The controller continually reconciles the cluster with Git, reverting manual changes.
Why this answer
Automated self-healing/reconciliation ensures that any direct modifications are overwritten by the Git state.
You need to ensure that no one can modify cluster resources manually. How can you implement this in a GitOps-mature organization?
This enforces the GitOps principle that all changes must flow through Git.
Why this answer
Removing manual 'write' access is the final stage of GitOps maturity, relying on the automated controller to apply changes.
You are implementing GitOps for a legacy application. Why might this be challenging?
The effort to convert imperative installs into declarative manifests is often the biggest hurdle.
Why this answer
Legacy applications often lack declarative definitions and might require manual setup steps that are difficult to automate.
Which TWO practices are recommended when managing Git repositories for GitOps?
Organizes state for different environments.
Why this answer
Best practices include using small, focused repositories and clear directory structures for environment separation.
An organization is implementing GitOps across its infrastructure using Kubernetes and Flux. Which TWO statements accurately describe core characteristics of the 'Automated Pull-Based Reconciliation' principle?
Continuous drift detection and self-healing correction are fundamental aspects of the pull-based reconciliation loop.
Why this answer
In automated pull-based reconciliation, an in-cluster agent monitors the target state in Git and compares it to live state, pulling updates without exposing external cluster inbound management ports.
Which TWO tools are commonly associated with the 'GitOps' ecosystem?
Leading GitOps controller.
Why this answer
Argo CD and Flux are the two most prominent Kubernetes-native GitOps controllers.
In a large enterprise, why is GitOps preferred for multi-cluster environments?
This minimizes configuration drift and ensures standardized environments.
Why this answer
GitOps allows a single repository to define the state for multiple clusters, ensuring consistency across environments.
A developer updates a Helm release values file in Git to change a ConfigMap key. How does the GitOps pull-based agent determine that reconciliation is necessary?
Continuous comparison of the desired state in Git (tracked via commit SHAs) against the observed live state drives the reconciliation loop.
Why this answer
The pull-based GitOps agent periodically polls or receives webhooks from the Git repository, comparing the target Git revision (SHA or tag) and contents against the current state stored/deployed in the cluster.
Which THREE of the following are common GitOps tools used in the CNCF ecosystem?
Enables GitOps for infrastructure management.
Why this answer
Argo CD, Flux, and Crossplane are recognized GitOps-focused tools.
What is the recommended way to handle secrets in GitOps?
SealedSecrets keeps the secret encrypted in Git, decryptable only in the cluster.
Why this answer
Secrets should never be stored in plaintext. Tools like SealedSecrets or HashiCorp Vault integration are standard.
In GitOps, what does 'Self-Healing' mean?
This is the definition of GitOps self-healing.
Why this answer
Self-healing refers to the ability of the GitOps controller to automatically detect drift and revert the cluster to the state defined in Git.
Ready to test yourself?
Try a timed practice session using only Gitops Principles questions.