Gitops
38 bites tagged Gitops — interview questions with model answers, and 60-second explainers.
Design automated microservice provisioning workflow
Template scaffolding plus a pipeline that creates repo, CI/CD, and infra as code, with idempotent steps and rollback. Golden-path platform design.
Declarative vs imperative ML platform design
Declarative GitOps gives auditable, reproducible, reviewable desired-state config with strong governance but a steeper learning curve; imperative SDKs are flexible and fast for scientists but harder to… platform architecture tradeoffs.
How do Sealed Secrets enable GitOps for secrets?
Kubeseal encrypts a Secret with the controller's public key into a SealedSecret CR safe for Git; only the in-cluster controller's private key can decrypt it into a real Secret. asymmetric-crypto GitOps pattern.
Guardrails for GitOps sync outages
Pre-merge schema validation, dry-run, policy gates and review; post-merge progressive sync, health checks with automated rollback, and pruning controls. layered safeguards around GitOps.
Helm migration hooks under GitOps
Use a pre-upgrade hook Job with weights and delete policy; the challenge is GitOps tools render statically and reconcile, conflicting with Helm's imperative hook lifecycle. Helm hooks plus GitOps tension. ignoring idempotency.
GitOps repo layout for environment promotion
Shared base plus per-env overlays via Kustomize or value files, promotion by PR moving a pinned version forward, separating app source from config repos. multi-env GitOps design. branch-per-environment with merge drift.
Argo CD App of Apps pattern
A parent Application whose manifests are themselves Application resources, so syncing one app declaratively manages many. scaling GitOps management. confusing it with ApplicationSet or with multi-source apps.
Managing secrets in a GitOps workflow
Never commit plaintext; encrypt with Sealed Secrets or SOPS, or reference an external store via External Secrets Operator. secrets in declarative pipelines. base64-encoding a Secret and calling it secure.
How GitOps controllers detect drift and sync
The controller renders desired manifests from Git, diffs them against live cluster objects, marks OutOfSync, then a sync applies the diff to converge. reconciliation mechanics. thinking it only acts on Git commits.
What is the basic principle of GitOps?
Git holds desired state; a controller continuously reconciles the cluster to match it; benefits are auditability, rollback, and drift correction. declarative continuous delivery. describing push-based scripts as GitOps.
Explain GitOps and how an agent knows when to apply changes
Tests declarative infrastructure and pull-based reconciliation. A strong answer says Git is the source of truth and the agent polls or watches for drift, then applies diffs. Red flag: calling a push-based CI pipeline GitOps.
How would you architect deployment capabilities for multiple disparate environments?
This tests platform design for secure multi-environment orchestration. A strong answer proposes a declarative control plane, environment-local agents with short-lived credentials, and templating for consistency.
How do you architect self-service GitOps with central policy enforcement?
What it tests: balancing self-service GitOps with hard guardrails. A strong answer covers namespace-scoped controllers, OPA/Kyverno deny policies, and a centralized policy repo. Red flag: proposing manual ticket reviews instead of automated admission gates.
How would you use GitOps to manage Kubernetes cluster lifecycles?
This tests cluster lifecycle GitOps, not just app delivery. A strong answer uses Flux plus Cluster API on a hub cluster, stores cluster definitions in Git, and rolls upgrades via MachineDeployments.
Describe a robust strategy for GitOps database schema migrations
Tests imperative-to-declarative schema reconciliation. Strong answers version idempotent pre-sync jobs and colocate schema state in Git. They use dedicated operators, not infra tools, for live execution.
What is configuration drift in GitOps and how do tools handle it?
This tests declared and actual state and GitOps reconciliation. A strong answer defines drift as out-of-band changes, notes auditability, and contrasts self-healing sync with read-only detection. A red flag is suggesting manual patches rather than fixing Git.
Two common GitOps repository layouts for multiple environments
Tests GitOps state-store trade-offs beyond single-cluster demos. Contrast a monorepo with directory overlays against repo-per-env; weigh polling overhead, blast radius, and promotion flow. Recommending branch-per-env destroys immutability and invites drift.
How do you secure secrets in a GitOps repository?
Tests whether you treat Git as source of truth while excluding plaintext credentials. A strong answer covers encrypting at rest with SOPS or Sealed Secrets, external stores like Vault, and operator workflows.
Walk me through deploying a new version using a GitOps workflow
Merge updates manifests; the GitOps controller compares desired state in Git to live state and reconciles. Separation of CI from CD and Git as the single source of truth. Mixing CI with CD or recommending manual deploy.
How do you securely manage and inject Helm secrets in CI/CD?
Tests secret lifecycle trade-offs in GitOps. Strong answers compare SOPS-encrypted values in Git, direct Vault injection for dynamic secrets, and External Secrets Operator to decouple secrets from charts.
Compare GitOps and Kustomize vs Ansible for environment configs
Tests declarative vs imperative trade-offs. Contrast GitOps drift detection with Ansible's imperative flexibility. Note Kustomize overlays for K8s vs Ansible's broader reach.
GitOps for MLOps: Your ML System as Code
GitOps for MLOps treats your entire machine learning pipeline—data, code, and models—as declarative configuration in Git. It automates ML workflows, ensuring reproducibility by making every change a reviewable commit.
Flux Image Update Automation: Closing the GitOps Loop
Flux's image update automation acts like a bot that watches your container registry. It finds new image tags that match your policies (like semver) and automatically commits the change back to your Git repository, triggering a deployment.
Argo CD Sync Phases and Waves: Ordering Your Deployments
Argo CD Sync Phases and Waves are a recipe for ordering deployments. Use them for complex apps where a database migration must run pre-sync. The footgun: a single failed resource in a wave halts the entire sync process, making it brittle if overused.
Get Gitops bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.