GitOps Tooling: CGOA practice questions

GitOps tooling is 14% of the CGOA curriculum and covers four things: manifest format and packaging, state store systems (Git and alternatives), reconciliation engines (Argo CD, Flux and alternatives), and interoperability with notification, observability and continuous integration tools.

Manifest format and packaging decide how desired state is written. Plain YAML manifests work, but two tools dominate. Helm calls itself the package manager for Kubernetes: a chart is a Helm package containing the resource definitions needed to run an application, the configuration is a set of values usually taken from a values.yaml file, and a release is an instance of a chart running in a cluster. Kustomize customizes plain manifests without templates. A base is a directory with a kustomization.yaml and a set of resources; an overlay is a directory with its own kustomization.yaml that refers to other kustomization directories, and a base can be reused by several overlays, which is how per-environment variations are expressed. Patches are applied through the patches field, and configMapGenerator and secretGenerator create ConfigMaps and Secrets. kubectl has supported kustomization files since 1.14 through kubectl apply -k.

Reconciliation engines run the loop. Argo CD describes itself as a declarative, GitOps continuous delivery tool for Kubernetes. It is a controller that compares each application's live state with the target state in Git, marks a deviating application OutOfSync, and can sync manually or automatically. An Application is a custom resource whose source names a repository, revision and path and whose destination names a cluster and namespace; it understands Kustomize, Helm, Jsonnet and plain directories of YAML or JSON, and ships a web UI and CLI. Automated sync does not delete resources removed from Git unless prune is enabled, and it does not react to live edits unless selfHeal is enabled.

Flux is built as the GitOps Toolkit, a set of controllers configured through custom resources. Source controllers produce artifacts from GitRepository, OCIRepository, HelmRepository and Bucket objects; the kustomize controller reconciles Kustomization objects; the helm controller reconciles HelmRelease objects; and image automation controllers use ImageRepository, ImagePolicy and ImageUpdateAutomation. A Flux Kustomization reconciles every five minutes by default, set by spec.interval, and manual edits to resources it manages are reverted.

Interoperability means the engine reports to and listens for other systems. Flux's notification controller sends events from the source, kustomize and helm controllers to tools such as Slack and Microsoft Teams, and receives webhooks from GitHub, GitLab, Bitbucket, Harbor or Jenkins. Argo CD exposes Prometheus metrics and supports PreSync, Sync and PostSync hooks.

Secrets need a tool of their own because a plain Secret manifest in Git exposes its value to everyone who can read the repository. Sealed Secrets, documented in the Flux guides, encrypts a Secret with a cluster's public key into a SealedSecret custom resource that only the controller in that cluster can decrypt.