42 questions · Tooling · All types, answers revealed
When troubleshooting a Kyverno policy, which command should you use to check if a specific resource complies with the policy?
This CLI tool tests policies against resources.
Why this answer
The 'kyverno apply' command allows testing a policy against a local manifest to verify compliance before deployment.
In ArgoCD, what does the 'Revision' field in an Application manifest represent?
Revision points to the exact state in Git.
Why this answer
The 'Revision' field specifies the Git commit hash, tag, or branch that the application is currently synced to.
An ArgoCD application is configured with 'SelfHeal' set to true. If a developer manually modifies a Deployment's replica count via kubectl, what happens?
Self-heal ensures live state matches Git state.
Why this answer
With self-heal enabled, ArgoCD detects the discrepancy between the live state and Git state and automatically overwrites the live state with the Git version.
You are using Flux with Kustomize. You want to apply different configurations for production and staging, but both use the same base manifests. Which Kustomize feature allows this?
Overlays are the standard Kustomize method for environment-specific configs.
Why this answer
Kustomize overlays allow patching the base manifests with environment-specific configurations.
Which THREE of the following items are commonly found in a Flux 'GitRepository' manifest?
Defines the version to track.
Why this answer
A GitRepository object defines the URL, the interval for polling, and the specific reference (branch or tag).
Which GitOps tool relies primarily on a pull-based model utilizing the 'Source Controller' and 'Kustomization' custom resources?
Flux is defined by these core controllers.
Why this answer
Flux v2 is architected around specialized controllers, including the Source Controller and Kustomization Controller.
You have a large ArgoCD installation and want to limit the blast radius. Which feature allows you to restrict which namespaces an application can deploy to?
AppProjects define destination clusters and namespaces.
Why this answer
AppProject resources are used to group applications and define strict cluster and namespace-level destination restrictions.
Which TWO of the following are valid ways to trigger a sync in ArgoCD?
Manual triggered sync.
Why this answer
ArgoCD can be triggered via a manual UI action or through an automated webhook notification from a git provider.
Which THREE of the following are common methods for managing secrets in a GitOps workflow?
Syncs secrets from external stores like Vault.
Why this answer
Sealed Secrets, SOPS, and External Secrets Operator (or Vault) are the industry standards for secrets in GitOps.
You are using Flux and want to pause reconciliation for a specific application without deleting the resource. Which field should you modify?
This field stops the controller from reconciling the resource.
Why this answer
The 'suspend: true' field in the Kustomization or HelmRelease resource pauses reconciliation for that specific object.
You are using ArgoCD and need to ensure that secret values stored in Git via Sealed Secrets are decrypted only within the target cluster. What component performs the actual decryption of a SealedSecret resource?
The controller uses the private key stored in the cluster to decrypt secrets.
Why this answer
The Sealed Secrets controller running in the target cluster holds the private key required to decrypt the SealedSecret into a standard Kubernetes Secret.
Which TWO of the following tools allow for GitOps policy enforcement?
Standard policy engine for K8s.
Why this answer
OPA (Gatekeeper) and Kyverno are the two industry-standard policy engines for Kubernetes.
Your organization requires that all Kubernetes manifest changes be signed and encrypted before being pushed to Git. Which tool is primarily designed for this 'at-rest' encryption approach?
SOPS supports file-level encryption for various formats including YAML.
Why this answer
Mozilla SOPS is the standard tool for encrypting sensitive values within manifest files (like YAML) before they are committed to Git.
You are using ArgoCD and need to inject a value into a manifest that is not present in Git, such as a temporary credential. Which feature would you use to do this dynamic injection?
Values can be injected via the 'helm.parameters' field in the Application spec.
Why this answer
ArgoCD supports 'Helm parameters' or 'Kustomize vars', but specifically for dynamic external values, the 'argocd-vault-plugin' or similar sidecar approaches are common, but using 'Application parameters' is the core supported way to override Helm values.
You are debugging a flux-system reconciliation loop. You notice the Kustomization is stuck in 'Retrying'. What command shows the current status and reason for the failure?
This command displays status and reconciliation failure info.
Why this answer
The 'flux get kustomizations' command provides a summary including the status and any error messages.
You have a Git repository that contains multiple Kustomizations. You want Flux to update all of them based on a single trigger. How should you structure the repository?
This is the best-practice pattern for multi-environment management.
Why this answer
Using a base directory with common configurations and multiple overlay directories allows you to trigger updates across the entire hierarchy.
You are using OPA Gatekeeper with GitOps. You want to prevent any deployment that does not have an 'owner' label. Where should this policy be applied to ensure it is enforced for all GitOps-driven changes?
This ensures every request is checked against policies.
Why this answer
Validating admission webhooks (which Gatekeeper uses) enforce policies regardless of the source of the change, whether manual or GitOps.
You are using ArgoCD and need to ensure that a Helm chart is rendered correctly with a specific set of values. Where do you specify these values in the ArgoCD Application resource?
This field manages value overrides for Helm charts.
Why this answer
The 'spec.source.helm.values' field allows for either direct YAML values or a reference to a values file within the repository.
Which THREE of the following are valid components of the ArgoCD architecture?
Handles the UI and CLI requests.
Why this answer
ArgoCD core consists of the API server, the Repo Server, and the Application Controller.
What is the primary function of the Flux Image Reflector Controller?
It tracks metadata for images.
Why this answer
The Image Reflector Controller scans container registries and reflects image metadata into the cluster as ImageRepository objects.
Which of these is a primary reason for using Helm charts in a GitOps workflow?
Helm simplifies managing complex sets of manifests.
Why this answer
Helm charts allow packaging complex applications into a single templateable format, which is easier to version and manage than hundreds of individual YAML files.
Which THREE of the following actions occur during an ArgoCD sync operation?
Diff generation phase.
Why this answer
The controller fetches the latest from Git, compares the live state to Git (diff), and applies updates to the cluster.
What is the purpose of the 'SealedSecrets' custom resource?
It wraps secrets into an encrypted CRD.
Why this answer
It provides a way to commit encrypted secrets into Git that can only be decrypted by a controller running in the target cluster.
You are configuring Flux to manage a multi-tenant cluster. You need to ensure that specific namespaces only allow images from an internal registry. Which tool should you use to enforce this at admission time?
Kyverno policies can validate image registry sources during admission.
Why this answer
Kyverno is a Kubernetes-native policy engine that can restrict image registries via admission controllers.
Which TWO of the following are key features of the Flux Kustomization controller?
Core function of the controller.
Why this answer
The Kustomization controller reconciles manifests and supports post-build variable substitution.
What is a 'GitOps Operator'?
Continuous reconciliation is the core function of a GitOps operator.
Why this answer
An operator is a Kubernetes controller that continuously reconciles the cluster state with a source of truth in a Git repository.
When using Kyverno, which THREE of the following can be used to validate Kubernetes resources?
Allows complex validation rules.
Why this answer
Kyverno uses patterns, variable expressions, and conditional logic to define validation rules.
When using SOPS with Age, which THREE of the following are true regarding key management?
Allows team-based access control.
Why this answer
Age keys are file-based, can be stored as Kubernetes secrets, and allow for multiple public keys for team access.
You are using ArgoCD to deploy an application. You notice that the Application status remains 'OutOfSync' even after manual refreshes. Which feature should you examine to determine if the controller is failing to reach the cluster API?
The events log captures controller-side errors related to sync status.
Why this answer
The 'App Details' view under the 'Sync' tab or the 'Events' log in the ArgoCD UI provides specific error messages regarding API connectivity and reconciliation failures.
When using OPA Gatekeeper for policy enforcement, what resource is used to define the actual logic of the policy?
This defines the Rego code for the policy.
Why this answer
A 'ConstraintTemplate' defines the Rego logic, while a 'Constraint' applies that logic to specific Kubernetes objects.
Which GitOps tool provides a dedicated CLI called 'argocd'?
The 'argocd' CLI is the standard interaction tool.
Why this answer
ArgoCD provides a powerful CLI tool for interacting with the ArgoCD API, managing applications, and checking sync states.
When evaluating ArgoCD vs Flux, which TWO of the following are distinct advantages of using Flux?
Flux is composed of specialized controllers.
Why this answer
Flux is known for its modular controller-based architecture and its ability to handle multi-repo environments effectively without a centralized UI overhead.
When configuring Kyverno policies to secure a cluster, which TWO of the following actions can a policy perform?
Policies can perform validation/mutation.
Why this answer
Kyverno policies can block unauthorized changes (enforce) or simply log them for reporting purposes (audit).
Which THREE of the following are essential tasks when implementing SOPS with GitOps?
Required for encryption/decryption.
Why this answer
You must create the encryption key, integrate with the GitOps tool (Flux/Argo), and ensure the key is available to the controller as a Secret.
Which TWO of the following are true about ArgoCD ApplicationSets?
Can deploy to multiple clusters based on rules.
Why this answer
ApplicationSets automate the generation of applications and support multi-cluster deployment via generators.
In an ArgoCD environment, you notice that a specific set of resources is being ignored during sync. What field in the 'argocd-cm' ConfigMap or the Application manifest is likely responsible?
This field explicitly tells ArgoCD to ignore specified fields.
Why this answer
The 'ignoreDifferences' field allows users to exclude specific fields or resource paths from the sync reconciliation process.
You are debugging an ArgoCD sync failure. You find the 'Sync Status' is 'Failed'. Where is the most detailed error information located?
This shows the specific error returned by the API server during the sync operation.
Why this answer
The 'Sync' tab in the ArgoCD UI provides the 'Sync Result' and 'Resource Details', which show specific error outputs from the Kubernetes API server.
You are managing secrets using SOPS with Age. You notice that Flux cannot decrypt the files. What is the most likely cause?
Flux must be able to read the private key from a Secret to decrypt files.
Why this answer
Flux needs access to the private key (stored as a Kubernetes Secret) to decrypt SOPS-encrypted files during reconciliation.
When migrating from ArgoCD to Flux, you want to replicate the 'Sync Waves' behavior. Which Flux feature provides equivalent control over the order of resource reconciliation?
The dependsOn field allows defining the order of reconciliation for Kustomizations.
Why this answer
Flux uses the 'dependsOn' field in the Kustomization resource to define ordered dependencies between objects.
In a GitOps workflow, what is the best way to handle a configuration that must be different for production versus development clusters?
Overlays are the standard solution for environment-specific differences.
Why this answer
Using Kustomize overlays allows you to maintain a common base and modify specific values for each environment.
Which TWO of the following are common GitOps challenges?
Manual changes often cause drift.
Why this answer
Managing secrets securely and handling drift are the most frequent challenges in GitOps environments.
Which of the following is a key advantage of using a 'pull' based GitOps model (like Flux or ArgoCD) over a 'push' based CI/CD pipeline?
The cluster pulls from Git, so the CI doesn't need write access.
Why this answer
Pull models don't require the GitOps tool to have cluster admin credentials stored in the CI system, enhancing security.
Ready to test yourself?
Try a timed practice session using only Tooling questions.