DevOps / GitOps Interview Questions
1. What is GitOps and what core principles does it define?
GitOps is an operational framework that applies DevOps practices — version control, collaboration, compliance, and CI/CD automation — to infrastructure and application delivery. The term was coined by Alexis Richardson of Weaveworks in 2017. The central idea is that Git acts as both the mechanism...
2. How does GitOps differ from traditional CI/CD pipelines?
Traditional CI/CD pipelines are push-based : the CI system builds an artifact, and the CD stage runs kubectl apply or helm upgrade directly against the cluster. The pipeline holds a kubeconfig or service-account token with cluster-write access. There is no persistent desired-state record and no a...
3. What is the 'single source of truth' principle in GitOps?
In GitOps, the Git repository is the system state. Every resource that should exist in the cluster — deployments, services, config maps, RBAC rules, network policies — is represented as a committed file. The repository is not a backup or documentation artifact; it is the authoritative record, and...
4. What are the two GitOps deployment models: push-based vs pull-based?
Push-based deployment: a CI/CD pipeline (GitHub Actions, Jenkins, etc.) runs kubectl apply or helm upgrade directly against the target cluster after a build succeeds. The pipeline authenticates to the cluster using a kubeconfig or service-account token stored in the CI system's secret vault. Chan...
5. What is a GitOps operator and what role does it play?
A GitOps operator is a software agent that runs inside the target cluster and implements the pull-based reconciliation loop. It is the engine that turns a static Git repository into a live, self-correcting deployment system. Without an operator, GitOps is just a documentation convention — the ope...
6. What is declarative infrastructure and why does GitOps require it?
Declarative infrastructure means specifying the desired end state of a system rather than the sequence of commands needed to reach it. A Kubernetes Deployment manifest is declarative — it says "I want 3 replicas of this container image running with these environment variables." The Kubernetes con...
7. How does GitOps improve security and auditability compared to script-based deployments?
Script-based deployments scatter cluster-write credentials across CI systems, developer laptops, and shared servers. Any engineer with access to the deployment script or its secrets can push arbitrary changes to production with no mandatory review. Audit trails, when they exist at all, are CI job...
8. What Git branching strategies are commonly used with GitOps?
GitOps repositories have different branching needs than application source repos. The goal is to map Git branches or folders to deployment environments cleanly, while keeping promotion paths easy to reason about. Three strategies are common in practice: Environment branches: Separate branches rep...
9. What is drift detection and how does a GitOps operator handle drift?
Drift is the condition where the actual state of the cluster diverges from the desired state declared in Git. Common causes: an engineer runs kubectl scale manually during an incident, a node failure causes a deployment controller to change replica counts temporarily, or a helm upgrade is run out...
10. What is the difference between GitOps and Infrastructure as Code (IaC)?
IaC and GitOps address different layers of the stack and use different execution models, but they complement each other in modern cloud-native environments. Infrastructure as Code (Terraform, Pulumi, CloudFormation): Provisions cloud resources — VMs, VPCs, managed databases, load balancers, Kuber...
11. What is Argo CD and how does it implement GitOps?
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes, graduated in the CNCF. It implements the pull-based GitOps model: you define Application custom resources that map a Git source to a Kubernetes destination, and Argo CD's Application Controller continuously reconciles the t...
12. How does Argo CD's sync process work — desired state vs live state?
Argo CD's sync process is a six-step reconciliation cycle executed by the Application Controller on every polling interval (default: 3 minutes) or on webhook notification. Clone and render: The Repository Server clones (or updates from cache) the Git source at the specified targetRevision . It ru...
13. What are Argo CD Applications and ApplicationSets?
An Application is the fundamental Argo CD custom resource. It maps a single Git source (repository URL, path, revision) to a single Kubernetes destination (cluster API URL, namespace) and declares how to sync between them. One Application typically represents one microservice or one component of ...
14. How do you structure a GitOps repository — app-of-apps, environment folders, overlays?
The way you structure a GitOps config repo determines how easily you can promote changes between environments, onboard new applications, and keep per-environment differences small and reviewable. There is no single correct layout, but three patterns dominate. 1. Kustomize base + environment overl...
15. What is Flux CD and how does it differ from Argo CD?
Flux CD is a CNCF-graduated GitOps toolkit for Kubernetes. Unlike Argo CD — which ships as a relatively integrated platform with a built-in UI, Application model, and unified controller — Flux is composed of separate, independently deployable controllers, each managing a specific concern. You ass...
16. How does Flux's source-controller and kustomize-controller work together?
Flux splits the responsibilities of fetching config and applying config into two separate controllers, connected through an intermediate Artifact object. source-controller is responsible for watching external sources — Git repositories, Helm repositories, OCI registries, and S3-compatible buckets...
17. How do you manage secrets in a GitOps workflow — Sealed Secrets, SOPS, External Secrets Operator?
Plain Kubernetes Secrets encoded as base64 cannot be committed to a Git repository — the value is trivially decodable by anyone with repo access. Three patterns solve this, with different trust models and operational tradeoffs. 1. Sealed Secrets (Bitnami): The sealed-secrets-controller running in...
18. How do you handle multiple environments (dev/staging/prod) in a GitOps repo?
The most common and maintainable approach is Kustomize base + overlays : shared manifests live in a base/ directory, and each environment has an overlay directory that patches only what differs — typically the container image tag, replica count, resource limits, and environment-specific ConfigMap...
19. How does image automation work in Flux for continuous delivery?
Flux's image automation system closes the loop between a new container image being pushed to a registry and the updated tag being committed back to the GitOps config repository — without any CI pipeline involvement. It relies on three CRs working in sequence. ImageRepository: Tells Flux to scan a...
20. What are Argo CD sync policies — automated vs manual — and sync waves?
Manual sync (default): Argo CD detects drift and marks the Application OutOfSync , but applies nothing until a human explicitly triggers synchronisation via the UI, argocd app sync CLI, or an API call. Suitable for production environments where deployments need explicit human approval. Automated ...
21. How do you roll back a deployment using GitOps?
In GitOps, a rollback is not a special out-of-band operation — it is just another change to the Git repository. The same reconciliation loop that applies new versions applies the rollback. This preserves the audit trail and keeps the single source of truth intact. Method 1 — git revert (preferred...
22. How do you integrate GitOps with a CI pipeline — separation of concerns?
The cleanest mental model is: CI builds artifacts, GitOps deploys them . The CI pipeline (GitHub Actions, GitLab CI, Jenkins) is responsible for everything up to and including pushing a container image to a registry. It is explicitly not responsible for applying changes to the cluster. That role ...
23. What is progressive delivery and how does it relate to GitOps — Argo Rollouts, Flagger?
Progressive delivery is the practice of releasing changes incrementally to a subset of users or traffic rather than all-at-once. Common strategies include canary releases (route 5% of traffic to the new version, ramp up if metrics look healthy), blue-green (maintain two identical environments and...
24. How do you handle Helm charts in a GitOps workflow?
Both Argo CD and Flux CD support Helm natively, but they integrate with it differently. The key GitOps principle is that Helm chart versions and values are declared in Git, not passed as CLI arguments — and the GitOps operator, not a human running helm upgrade , applies them. Flux CD — HelmReleas...
25. How do you use Kustomize overlays in a GitOps repository?
Kustomize is a template-free Kubernetes manifest customisation tool built into kubectl and natively supported by both Argo CD and Flux. The overlay pattern keeps shared resource definitions in a base/ directory and accumulates environment-specific differences in per-environment overlays/ director...
26. How do you implement multi-cluster GitOps at scale?
Multi-cluster GitOps adds the dimension of which cluster to deploy to on top of the standard single-cluster model. The two dominant approaches are hub-spoke (a central GitOps control plane manages all clusters) and decentralised (each cluster runs its own GitOps operator, all watching the same or...
27. How does Argo CD handle RBAC and multi-tenancy?
Argo CD implements multi-tenancy through two complementary mechanisms: AppProjects (resource-level isolation) and RBAC policies (action-level access control). AppProject is a CR that scopes what a group of Applications can do: sourceRepos : limits which Git repositories are allowed as Application...
28. What are the Argo CD app-of-apps and ApplicationSet patterns and when do you use each?
Both patterns solve the same problem — managing many Argo CD Applications without manually applying each one — but they use different mechanisms and suit different scales. App-of-apps: A parent Argo CD Application has its source.path pointing to a Git directory that contains child Application YAM...
29. How do you implement GitOps for infrastructure provisioning with Crossplane and Cluster API?
Both Crossplane and Cluster API extend the Kubernetes API with CRDs that represent infrastructure resources. Because the desired state is expressed as Kubernetes objects, a standard GitOps operator (Argo CD or Flux) can manage those objects from Git — giving you continuous reconciliation and drif...
30. How do you observe and alert on GitOps sync failures in production?
GitOps operators expose rich telemetry specifically for monitoring sync and reconciliation health. The two main surfaces are Prometheus metrics and the operators' own notification controllers. Argo CD observability: Argo CD exposes Prometheus metrics on port 8082. Key metrics: argocd_app_info (la...
31. How do you manage database schema migrations in a GitOps workflow?
Database schema migrations are inherently imperative and ordered — they run once, in sequence, and must complete successfully before the application starts. This sits awkwardly with GitOps's declarative, continuously-reconciled model. Three patterns handle this well. 1. Argo CD PreSync hook with ...
32. How do you implement policy enforcement in a GitOps pipeline — OPA/Gatekeeper, Kyverno?
Policy enforcement in GitOps works on two levels: shift-left checks in the CI pipeline (before changes reach the cluster) and runtime admission controls in the cluster (enforced on every resource creation or update, including GitOps operator applies). OPA/Gatekeeper: The gatekeeper-controller reg...
33. What are the limitations and anti-patterns of GitOps?
GitOps is powerful but not a universal solution. Being aware of its genuine limitations prevents teams from forcing it into contexts where it creates more friction than value. Genuine limitations: Secret management adds complexity: Every team member must understand at least one secret management ...
34. How do you migrate an existing deployment pipeline to GitOps?
Migrating to GitOps is not a big-bang cutover — it works best as a phased process where the old pipeline and the GitOps operator run in parallel until confidence is established, then the old pipeline is decommissioned. Step-by-step migration: Capture current state as declarative YAML: Export live...
35. How does GitOps fit into a platform engineering strategy?
Platform engineering is the discipline of building Internal Developer Platforms (IDPs) that give application teams self-service access to infrastructure and deployment capabilities through well-defined abstractions. GitOps is the delivery mechanism underneath the platform — it ensures that everyt...
