DevOps / ArgoCD interview questions
1. What is ArgoCD and what problem does it solve?
ArgoCD is a declarative, GitOps-based continuous delivery tool for Kubernetes. It automates the deployment of applications to Kubernetes clusters by continuously syncing the cluster state to match the desired state defined in a Git repository. Before ArgoCD, teams often relied on push-based CI/CD...
2. What is GitOps and how does ArgoCD implement it?
GitOps is an operational framework that uses Git as the single source of truth for infrastructure and application configuration. All desired states are stored as code in a Git repository, and automated agents continuously reconcile the live system to match what is in Git. Changes are made exclusi...
3. What are the core components of ArgoCD?
ArgoCD is composed of several distinct components that work together to deliver GitOps continuous delivery: API Server — Exposes the gRPC and REST API consumed by the ArgoCD UI, CLI ( argocd ), and any external tooling. It handles authentication, authorization (RBAC), and surfaces application sta...
4. What is an ArgoCD Application and what fields does its manifest require?
An ArgoCD Application is a Kubernetes Custom Resource (CRD) that represents a deployed application managed by ArgoCD. It is the fundamental unit of work in ArgoCD — one Application tracks one source (a Git repo path, Helm chart, or OCI artifact) and deploys it to one destination (a cluster and na...
5. What are the different application sync statuses in ArgoCD?
ArgoCD reports two orthogonal status dimensions for every application: Sync Status and Health Status . Understanding both is essential for diagnosing application state. Sync Status ArgoCD Sync Status Values Status Meaning Synced Live cluster state matches the desired state in Git exactly. OutOfSy...
6. How do you install ArgoCD on a Kubernetes cluster?
The standard installation uses the official ArgoCD manifest published in the ArgoCD GitHub repository. There are two variants: non-HA (single replica, suitable for development) and HA (multiple replicas for the API server and application controller, for production). # Create the argocd namespace ...
7. What is an ArgoCD Project and how does it differ from a Kubernetes namespace?
An ArgoCD Project (AppProject CRD) is a logical grouping and access control boundary within ArgoCD itself. It is entirely separate from Kubernetes namespaces — a Project does not correspond to any Kubernetes object but rather enforces policies on which source repositories, destination clusters, a...
8. How does ArgoCD support Helm charts?
ArgoCD has first-class support for Helm and can render Helm charts as part of its manifest generation pipeline inside the Repository Server. There are two ways to use Helm with ArgoCD: 1. Helm repository as source — You specify a Helm chart repository URL and chart name directly in the Applicatio...
9. How does ArgoCD support Kustomize?
ArgoCD has native Kustomize support built into its Repository Server. When ArgoCD detects a kustomization.yaml (or kustomization.yml / Kustomization ) file at the specified path , it automatically runs kustomize build to render the manifests before applying them to the cluster. No extra configura...
10. What is self-healing in ArgoCD and how do you enable it?
Self-healing in ArgoCD means that when the live cluster state drifts from the desired Git state — due to manual changes, operator mistakes, or other controllers modifying resources — ArgoCD automatically detects the drift and re-applies the Git state to bring the cluster back into sync, without a...
11. What is the difference between ArgoCD automated sync and self-healing?
ArgoCD's automated sync and self-healing are related but address different triggers for bringing a cluster into alignment with Git. They are configured together under syncPolicy.automated but serve distinct purposes. Automated Sync vs. Self-Healing Aspect Automated Sync Self-Healing Trigger A new...
12. How does ArgoCD handle resource pruning and what risks does enabling it carry?
Resource pruning in ArgoCD refers to the automatic deletion of Kubernetes resources that exist in the cluster but are no longer present in the Git repository. When you sync an application with pruning enabled, ArgoCD compares the live cluster state against the desired Git state and removes any re...
13. What is the ArgoCD App of Apps pattern and when should you use it?
The App of Apps pattern is an ArgoCD design where one root Application manifest manages a collection of child Application manifests stored in Git. The root app syncs a directory of Application CRDs into the cluster; ArgoCD then picks up each child Application and reconciles it independently. Stru...
14. How do ArgoCD Sync Waves and Sync Hooks work together to control deployment ordering?
ArgoCD provides two complementary mechanisms for controlling the order of resource application during a sync: Sync Waves control the sequence of resource groups, and Sync Hooks inject one-off Jobs at specific lifecycle phases. Sync Waves Every resource can be assigned an integer wave via the anno...
15. What is an ArgoCD ApplicationSet and how does the Git generator work?
An ApplicationSet is an ArgoCD CRD that automates the creation, update, and deletion of multiple Application resources from a single template. Instead of manually writing one Application manifest per environment or cluster, you define a template once and pair it with a generator that produces par...
16. How does ArgoCD integrate with external secret management tools like Vault or Sealed Secrets?
ArgoCD deliberately does not manage secrets natively — it stores no sensitive values and recommends keeping plaintext secrets out of Git. Two widely adopted patterns bridge ArgoCD with secret management: 1. Sealed Secrets (Bitnami) Sealed Secrets encrypts a Kubernetes Secret into a SealedSecret C...
17. How do you configure ArgoCD RBAC and what are the built-in roles?
ArgoCD's RBAC is configured via the argocd-rbac-cm ConfigMap in the argocd namespace. Policies are written in Casbin CSV format and map subjects (users, groups, SSO claims) to resources and actions. Built-in Roles Role Permissions role:readonly Read-only access to all resources: applications, clu...
18. What is ArgoCD Image Updater and how does it automate container image updates?
ArgoCD Image Updater is an optional add-on controller that monitors container registries for new image tags and automatically updates the image tag references used by ArgoCD Applications — without requiring a CI pipeline to commit changes back to Git manually. Image Updater watches Applications a...
19. How does ArgoCD manage multiple clusters and what are the methods for registering them?
ArgoCD is designed to manage applications across multiple Kubernetes clusters from a single control plane. Each cluster is registered with the ArgoCD API server and stored as a Secret in the argocd namespace with the label argocd.argoproj.io/secret-type: cluster . Two Methods for Registering Clus...
20. What are ArgoCD Sync Windows and how do you configure them?
ArgoCD Sync Windows are time-based rules that allow or deny automated sync operations during specific time periods. They give platform teams the ability to prevent ArgoCD from automatically deploying changes during critical periods (e.g., business hours for production, or during a maintenance fre...
21. How does ArgoCD handle ignoreDifferences and when should you use it?
The ignoreDifferences field in an ArgoCD Application spec tells ArgoCD to exclude specific fields from the diff calculation between the desired Git state and the live cluster state. Without it, any field that differs — even one managed by Kubernetes controllers or admission webhooks — causes the ...
22. What are ArgoCD resource health checks and how do you write a custom one?
ArgoCD evaluates the health of every managed Kubernetes resource using health check scripts written in Lua . For built-in resource types (Deployments, StatefulSets, DaemonSets, Services, Ingresses, PVCs, Jobs, CronJobs, etc.), ArgoCD ships with health checks out of the box. For Custom Resource De...
23. How does ArgoCD handle SSO and what identity providers does it support?
ArgoCD supports Single Sign-On (SSO) through two integration paths: built-in Dex (bundled OpenID Connect identity broker) and external OIDC providers (configured directly in argocd-cm without Dex). Built-in Dex Dex acts as an OIDC proxy that federates authentication to upstream identity providers...
24. What is the ArgoCD CLI and what are the most common commands used day-to-day?
The ArgoCD CLI ( argocd ) is a command-line tool for interacting with the ArgoCD API Server. It is the primary interface for operators who prefer the terminal over the UI and is also used in CI/CD pipelines for triggering or waiting on syncs. Before using the CLI, you must log in: argocd login
25. How does ArgoCD compare to Flux and when would you choose one over the other?
ArgoCD and Flux are the two most popular GitOps tools for Kubernetes, and both implement the GitOps principles well. The key differences come down to architecture, UX, and ecosystem fit. ArgoCD vs. Flux Comparison Dimension ArgoCD Flux Architecture Centralized: one ArgoCD instance can manage mult...
26. What is server-side apply in ArgoCD and why might you enable it?
Server-side apply (SSA) is a Kubernetes API feature (GA since Kubernetes 1.22) where the API server — rather than the client — merges resource updates and tracks field ownership via managed fields . ArgoCD can use SSA instead of its default client-side apply ( kubectl apply ) by setting the Serve...
27. How does ArgoCD handle notifications and what channels does it support?
ArgoCD Notifications is a separate controller (shipped as part of the ArgoCD Helm chart and optionally in the install manifest) that sends alerts and messages when ArgoCD Application events occur. It subscribes to Application state changes and triggers configured notification services when condit...
28. How do you perform a rollback in ArgoCD?
ArgoCD stores a history of every sync operation for each Application, including the Git commit SHA, parameters, and manifests that were applied. Rolling back means telling ArgoCD to re-sync the Application to a specific previous revision from this history, overriding the current HEAD of the track...
29. What is the ArgoCD repository server caching strategy and how does it affect performance?
The ArgoCD Repository Server caches rendered manifests to avoid redundant Git clones and template renders on every reconciliation cycle. Understanding this cache is important for diagnosing stale manifest issues and tuning performance at scale. What is cached: Rendered manifests keyed by (repoURL...
