Select Two (Multi-Select) Questions

It enables hierarchical synchronization of applications.

The parent can coordinate the rollout of children.

It allows for grouping applications by project or business unit.

This allows for organized multi-tenant management.

It simplifies the management of large numbers of applications.

This is a primary benefit.

Merging a pull request from a staging branch to a production branch.

This is a standard promotion practice.

Updating the environment-specific values file in the production directory.

This is a standard 'directory-based' promotion.

The health checks defined for the application are failing.

If the resource fails health checks, it is 'Degraded'.

The application pods are in a 'CrashLoopBackOff' state.

This is a classic 'Degraded' condition.

Providing a transparent, versioned history of infrastructure changes.

This makes communication much easier.

Enabling peer review of all changes via Merge Requests.

This is the standard for quality control.

Applying updates to the cluster API.

Executing the reconciliation.

Downloading updated manifest files.

Fetching the new desired state.

Polling the Git repository for changes.

The pull mechanism depends on checking for new commits.

Implementing unique namespaces for each application.

Namespace isolation is critical for preventing cross-application interference.

Restricting cluster destinations in the AppProject object.

AppProject is the mechanism for cluster isolation.

Automatic rollbacks when the Git repo is empty.

If not configured properly, empty repos can trigger unintended removals.

Performance degradation of the central GitOps controller.

Managing too many clusters will overload a single controller instance.

The complexity of secret management across multiple environments.

Secrets need to be rotated and scoped appropriately.

They provide a single, declarative source of truth.

This is a key benefit.

They automate the drift detection and correction loop.

This is the primary function of the operator.

AnalysisTemplates

AnalysisTemplates define the metrics to evaluate for a successful rollout.

Argo Rollouts

Argo Rollouts is a progressive delivery controller for Kubernetes.

Blue-Green Deployment

Blue-Green is a common progressive delivery pattern enabled by Argo Rollouts.

Using canary deployment phases per cluster group.

This limits the impact of potential failures.

Grouping clusters by geography or environment for staggered rollouts.

This ensures controlled release propagation.

It improves security by removing the need for cluster credentials in CI.

This is a key security advantage.

It allows the cluster to self-reconcile state changes.

The cluster agent ensures state consistency.

Using a GitOps operator to trigger 'helm install'.

Modern GitOps tools integrate this natively.

Storing the final rendered YAML in Git.

Useful for static analysis and auditability.

Storing Helm values files in Git.

Standard practice for environment config.

Improved auditability through version-controlled commits.

Every change is documented and linked to a commit/user.

Simplified rollback of infrastructure configurations.

Rolling back is as simple as reverting a Git commit.

Gradual traffic shifting between application versions.

This minimizes risk by exposing only a subset of users.

Automated rollback based on custom metrics.

This is a core component of progressive delivery.

Secure communication channel (e.g., mTLS/VPN) between management and targets.

This is required for the controller to talk to the API server.

A centralized management cluster (Hub).

This is essential for controlling the spoke clusters.

Environment-specific configuration separation (e.g., Kustomize overlays).

This prevents configuration drift across clusters.

Defining environment-specific overrides in values files.

This is required for environment promotion.

Storing the Helm chart and values in a Git repository.

This ensures the versioned state is tracked.

Using External Secrets Operator to sync secrets to specific namespaces.

This limits the blast radius of secrets.

Using a dedicated Secret Management system (e.g., HashiCorp Vault).

Centralized secret management is a best practice.

Applying RBAC policies to ensure only specific apps can access secrets.

This is critical for multi-tenant security.

Using labels to filter resources for different tenants.

This is a common way to manage multitenancy.

Separate Git repository per business unit/tenant.

This provides strong isolation.

Folder-per-environment structure within one repository.

This is a standard organization pattern.

Unexpected changes to resource labels or annotations

Often caused by automated cluster tools that are not GitOps-aware.

Manual editing of a ConfigMap via kubectl

This creates a difference between the live state and Git.

Unauthorized scaling of a deployment

If the replica count in Git is 3 but the cluster has 5, this is drift.

Strict RBAC for both the Git repository and the Kubernetes cluster.

This is foundational for secure operations.

Using OPA Gatekeeper to enforce security policies on manifests.

This ensures compliance before deployment.

Encrypting secrets before storing them in Git (e.g., SOPS).

This is a standard requirement for secret protection.