CGOA Questions and Answers

Areconcilerensures that the actual system matches the desired state declared in Git. External reconcilers run outside the core cluster orchestration process.Fluxis a widely used GitOps external reconciler that continuously syncs cluster state with the repository.

“Flux is an example of a GitOps reconciler that continuously monitors Git repositories and applies changes to the cluster. As an external reconciler, it handles synchronization and reconciliation loops outside the direct application code.”

Thus,A: Fluxis correct.

Most GitOps tools (e.g., Flux) are pull-based only. However,ArgoCDsupports both pull-based reconciliation (via continuous monitoring) and an optionalpush-based model, where changes can be triggered via webhooks or CI pipelines.

“ArgoCD supports both pull-based reconciliation, where the controller watches the repository, and an optional push-based reconciliation mode triggered by webhooks.”

Thus, the correct answer isA: ArgoCD.

GitOps emphasizes immutability and auditability. If an error occurs in the configuration stored in Git, the system should be rolled back to the last known good state while the error is fixed. This preserves system reliability and aligns with the GitOps principle of rollback through version control.

“With Git as the source of truth, if an error is introduced, the system can be rolled back by reverting to a previous commit. This ensures stability while the faulty configuration is corrected.”

Thus, the recommended action isC: Roll back to the previous working version.

A GitOps-managed Kubernetes cluster uses reconciliation loops to continuously compare the actual state of the system with the desired state declared in Git. When drift (divergence between declared configuration and live cluster state) is detected, the GitOps operator automatically reconciles the difference to bring the system back into alignment.

“In GitOps, a reconciliation loop ensures that the desired state as declared in Git is continuously compared with the observed state of the system. If drift is detected, the system automatically takes corrective action to reconcile the difference and restore the declared configuration.”

This ensures consistency, reliability, and self-healing. Manual intervention is not required for drift correction, as the automated reconciliation is a core principle of GitOps.

Infrastructure as Code (IaC)is a foundational practice in GitOps. It involves managing and provisioning infrastructure throughdeclarative, machine-readable filesrather than manual processes or GUIs. IaC ensures consistency, automation, and repeatability across environments.

“Infrastructure as Code defines and manages infrastructure through code files stored in version control. This enables automation, reproducibility, and immutability in infrastructure provisioning.”

Thus,Dis correct.

In GitOps,DevSecOpsintegrates security into the GitOps workflow by treating security policies as code and storing them in Git. This enables automatic detection ofsecurity policy driftand ensures that any misconfiguration or violation is reconciled, just like application and infrastructure code.

“GitOps applies DevSecOps by managing security policies as code. This enables detection of drift in security configurations, ensuring environments remain compliant and secure.”

Thus, the correct answer isA.

One of the four fundamental GitOps principles isVersioned and Immutable. This means that the entire system’s desired state must be stored in a Git repository with version control. Each change must be represented as a commit, and Git’s immutability guarantees a reliable, auditable history of how the system evolved.

“The desired state is stored in a version control system. The record of truth is stored in an immutable history, and changes can be audited and reverted if necessary. This guarantees that the system’s configuration is versioned, immutable, and traceable.”

Thus,configuration and infrastructure must be version-controlled and immutable, never changed directly in production.

Kustomize is a GitOps tool for managing Kubernetes configurations declaratively. It uses afolder structure with configuration filesand akustomization.yamlfile that references resources and overlays. This enables customization without modifying the base manifests.

“Kustomize allows customization of Kubernetes manifests by organizing resources in directories and referencing them through file paths in a kustomization file. This directory-based approach supports overlays, reusability, and modular configuration.”

Thus, the correct answer isD.

In GitOps, deployments are driven bycommitting declarative configurationinto a Git repository (the State Store). From there, agents reconcile the actual environment to match the desired state, making deployments reproducible and auditable.

“To deploy in GitOps, commit the declarative configuration into version control. The reconciler ensures the runtime environment converges to the declared state.”

Thus, the correct answer isD.

GitOps requires apull-based approachas the default model, where agents in the cluster automatically pull desired state from Git. However,push-based triggers(e.g., webhooks) can optionally be used to complement pull-based reconciliation.

“Pull-based reconciliation is required in GitOps to ensure automation and security. Push-based triggers may optionally complement this, but the pull model is fundamental.”

Thus, the correct answer isD.

Kustomizeis a Kubernetes-native configuration management tool that allows manifest customization without modifying the original YAML files. It uses overlays and patches to adapt configurations for different environments.

“Kustomize provides a declarative way to customize Kubernetes manifests by applying patches and overlays. This allows managing multiple environments without duplicating manifest files.”

Thus, the correct answer isD.

In GitOps,everything that defines the system, including dashboards, must be stored declaratively in Git(the Desired State store). This ensures dashboards are versioned, reproducible, and consistent across environments.

“GitOps requires that all system components, including monitoring and observability configurations such as dashboards, are declared in Git. This ensures they are versioned, immutable, and reproducible.”

Thus,Dis correct.

In GitOps, thepull-based modelcontinuously reconciles the actual state with the desired state. This makes it resilient to drift, since reconciliation runs regularly. In contrast,event-driven systemsonly reconcile when an event occurs (e.g., a webhook), which makes them more prone to drift if changes happen outside those events.

“A pull-based reconciliation loop ensures continuous alignment with the desired state. Event-driven reconciliation, triggered only on events, risks system drift if changes occur outside those triggers.”

Thus, the correct answer isD.