Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Which is one of the four OpenGitOps principles?

   1. ADeploy only from laptops
   2. BContinuously reconciled: software agents keep observing the actual state and correct it towards the desired state
   3. CUse a single cluster
   4. DOnly use Helm
   Show answer

   B. The four principles: declarative, versioned and immutable, pulled automatically, continuously reconciled.

   From lesson 01 · What GitOps is

2. Q2. Why is pull-based delivery safer for clusters than CI pushing with kubectl?

   1. AIt's faster
   2. BCI no longer needs cluster credentials, the cluster only reaches out to Git, and drift is detected and corrected continuously
   3. CIt avoids YAML
   4. DIt needs no Git server
   Show answer

   B. Removing cluster admin credentials from CI shrinks the attack surface, and reconciliation catches manual changes.

   From lesson 01 · What GitOps is

3. Q3. Someone runs kubectl edit on a GitOps-managed Deployment. What happens with self-heal enabled?

   1. AThe change stays forever
   2. BThe agent notices the drift and reverts the object to what Git says
   3. CGit is updated automatically
   4. DThe cluster is deleted
   Show answer

   B. Git is the source of truth. Changes must go through Git; manual edits are undone (or at least reported).

   From lesson 01 · What GitOps is

4. Q4. Why keep deployment configuration in a separate repository from application source?

   1. AGit can't handle both
   2. BDeploy changes (image bumps, replicas) don't trigger app CI, access can differ (who may change prod), and the config history reads as a clean deployment log
   3. CIt's required by Argo CD
   4. DIt's cheaper
   Show answer

   B. Separation keeps CI loops simple and gives production configuration its own review rules and history. Small teams can start with a folder in the app repo.

   From lesson 02 · Repository design

5. Q5. What's the benefit of Kustomize base + overlays?

   1. ASmaller images
   2. BOne shared base, and each environment states only its differences (replicas, resources, image), so environments can't silently diverge
   3. CNo YAML
   4. DIt replaces Helm charts entirely
   Show answer

   B. Differences are explicit and reviewable; everything else is shared.

   From lesson 02 · Repository design

6. Q6. What is the rendered-manifests pattern?

   1. ADeleting manifests
   2. BCI renders Helm/Kustomize into plain YAML committed to Git, so reviews show the exact objects that will change and the agent applies plain manifests
   3. CRendering images
   4. DEncrypting manifests
   Show answer

   B. Reviewers see the real diff (not just a values change), at the cost of an extra CI step and larger diffs.

   From lesson 02 · Repository design

7. Q7. What should be promoted between environments?

   1. AThe source code again
   2. BThe exact same artifact (image digest, chart version) that passed the previous environment, never a rebuild
   3. CA new build per environment
   4. DOnly configuration
   Show answer

   B. Rebuilding per environment means production runs something that was never tested. Promote the identical digest.

   From lesson 03 · Promotion between environments

8. Q8. A good promotion policy for most teams is:

   1. AEverything auto-deploys to prod
   2. BAutomatic to dev, automatic or lightly gated to staging, PR with approval and checks to prod
   3. CManual kubectl everywhere
   4. DProd first, then dev
   Show answer

   B. Speed where risk is low, human review and evidence where it isn't.

   From lesson 03 · Promotion between environments

9. Q9. How do you roll back a bad release in GitOps?

   1. Akubectl rollout undo in prod
   2. Bgit revert the promotion commit (or set the previous digest); the agent applies it
   3. CDelete the namespace
   4. DRebuild the old version
   Show answer

   B. Rollback is a Git change like any other: fast, reviewable if needed, recorded, and not undone by self-heal.

   From lesson 03 · Promotion between environments