What is configuration drift in GitOps and how do tools handle it?

This tests whether you understand the core GitOps loop where Git is the single source of truth and the reconciler closes gaps. A strong answer defines drift as out-of-band mutations, explains why they destroy auditability and repeatability, and maps strategies from soft to hard: read-only drift alerts, automated self-healing sync, and admission gates that block writes. A red flag is treating symptoms with manual kubectl patches or disabling the reconciler instead of restoring Git as the sole source of truth.