GitOps — Theory

GitOps — Theory (interview deep-dive)

Push vs pull deployments

• Push (traditional CI): CI pipeline has cluster credentials and runs kubectl apply.
• Pull (GitOps): cluster has credentials to read git; CI only updates the repo.

Pull benefits:

• CI doesn’t need cluster access.
• Same model for any cluster (local, edge, multi-cluster) — they pull themselves.
• Drift detection built in.
• Rollback = git revert.

Argo CD vs Flux

	Argo CD	Flux
UI	rich	minimal (CLI/CRDs)
App model	Application CRD	Kustomization + HelmRelease CRDs
Multi-cluster	hub model	per-cluster agents
Scale	thousands of apps	thousands of clusters
Ecosystem	Argo Rollouts, Workflows, Events, Image Updater	Flux Image Automation, Notification Controller

Both are CNCF graduated and fine. Pick by team preference.

Promotion strategy

GitOps decouples build from deploy. Build once, promote artifact across envs by changing manifests.

• Dev: auto-update on every commit.
• Staging: bot opens PR; auto-merge after CI green.
• Prod: bot opens PR; human approval required.

Tooling: kargo, environment ApplicationSets, custom GitHub bot.

Drift

When someone runs kubectl edit directly:

• Argo CD: shows OutOfSync. selfHeal=true re-applies; otherwise human resolves.
• Flux: same; reconciles every interval.

Drift is sometimes legitimate (incident scaling). Argo’s annotation argocd.argoproj.io/sync-options: IgnoreExtraneous=true or temporarily disabling self-heal helps.

Branch model in GitOps

• One branch (main) + folders per env — most common, clear.
• Branch per env — risk of divergence.
• Trunk-based with PRs — recommended.

Multi-cluster patterns

• Hub-and-spoke: central Argo manages many clusters via API access.
• Per-cluster agent: each cluster runs its own Flux/Argo, pulls its own subdir.
• ApplicationSets (Argo): generate Applications from a pattern (one Application per cluster).

Drift vs reconciliation gotchas

• Resource managed by HPA / VPA / autoscaler with replicas in manifest → fight. Solution: ignoreDifferences for spec.replicas.
• Same for cert-manager mutating annotations, Istio injection, etc.

Common interview Qs

1. What’s the diff between CI and CD in GitOps? CI builds, CD = controller reconciling git. Manifest change ≡ deploy intent.
2. Where do secrets go? Not raw in git; use sealed secrets / external secrets / SOPS.
3. You see OutOfSync — what now? Inspect diff. If unintended manual change, restore via sync; if intentional, commit it back.
4. Roll back a bad deploy. git revert <sha> and let controller reconcile.
5. One repo or two (apps + manifests)? Two recommended. Decouples build from deploy; manifests repo is what the cluster sees.
6. Argo CD vs Flux — pick. Argo for visibility / many app teams. Flux for many-cluster / ops-heavy.
7. HPA conflicts with deployment replicas in git? ignoreDifferences for that field; or omit replicas entirely from manifest.
8. How does GitOps handle DB migrations? Init container, Job, Argo PreSync hook. Schema must lead code.
9. Deploy a hotfix straight to prod manifests, skip dev? Possible (commit to prod overlay) but breaks the promotion model. Better: hotfix branch, accelerated canary.
10. What’s app-of-apps? Root Argo Application that contains many child Application CRDs — bootstraps a cluster from one click.

Anti-patterns

• Reaching into cluster directly with kubectl in prod.
• Repo with no branch protection.
• Auto-sync prod without review.
• Storing image tag as latest (no immutability).
• Sealed secrets without rotation policy.
• Committing IaC for one env into wrong env folder.
• Multi-tenant cluster + flat repo without RBAC mapping.