Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Why tag images with the Git commit SHA instead of `latest`?

   1. AIt's shorter
   2. BEvery build gets a unique, traceable tag, so Kubernetes actually rolls out the change, you know exactly which code runs, and rollback targets a known version
   3. CRegistries require it
   4. D`latest` is not allowed
   Show answer

   B. With a mutable `latest`, the Deployment spec doesn't change, so no rollout happens, and you can't tell what's running.

   From lesson 01 · AWS VMs → kubeadm → Cilium → Jenkins deploys from Git

2. Q2. Your kubeadm nodes on EC2 can't pull images from a private ECR repository. Why, and what fixes it?

   1. AECR doesn't work with kubeadm
   2. BNodes need registry credentials: ECR tokens expire after 12 hours, so use the kubelet ECR credential provider with an instance IAM role (or refresh an imagePullSecret), or use a registry with long-lived pull credentials
   3. COpen port 443
   4. DUse a bigger instance
   Show answer

   B. EKS nodes handle this for you; self-managed clusters must configure it.

   From lesson 01 · AWS VMs → kubeadm → Cilium → Jenkins deploys from Git

3. Q3. Why give Jenkins a namespace-scoped ServiceAccount instead of admin.conf?

   1. AIt's faster
   2. BLeast privilege: if Jenkins (or a pipeline) is compromised, the attacker can only change the demo namespace, not the whole cluster
   3. Cadmin.conf doesn't work remotely
   4. DServiceAccounts are required for NodePorts
   Show answer

   B. CI systems are high-value targets. The next project removes cluster credentials from CI entirely (GitOps).

   From lesson 01 · AWS VMs → kubeadm → Cilium → Jenkins deploys from Git

4. Q4. What's the key security difference between project 1 and this design?

   1. ANone
   2. BJenkins no longer needs cluster credentials; it only writes to the GitOps repo, and Argo CD (inside the cluster) pulls changes
   3. CArgo CD needs admin on GitHub
   4. DThe registry is public
   Show answer

   B. Pull-based delivery keeps cluster credentials inside the cluster.

   From lesson 02 · The same pipeline, GitOps style with Argo CD

5. Q5. Why keep a separate GitOps repo instead of putting manifests in the app repo?

   1. AGit can't hold YAML
   2. BCI commits to it on every build without re-triggering itself; it has its own reviewers and history of what's deployed where; many apps and environments can live in one place
   3. CArgo CD requires two repos
   4. DIt's faster
   Show answer

   B. Separating 'code changed' from 'desired state changed' keeps both clean. (A single repo works for small setups with care.)

   From lesson 02 · The same pipeline, GitOps style with Argo CD

6. Q6. How do you roll back in this setup?

   1. Akubectl rollout undo
   2. BRevert the tag commit in the GitOps repo; Argo CD syncs the previous state (a kubectl-only rollback would be reverted by self-heal)
   3. CDelete Argo CD
   4. DRebuild the old image
   Show answer

   B. Git is the source of truth; roll back where the truth lives.

   From lesson 02 · The same pipeline, GitOps style with Argo CD