--- title: "ArgoCD: GitOps Automation with Kubernetes" description: "Test your knowledge of ArgoCD fundamentals with this comprehensive quiz covering GitOps principles, application deployment, sync policies, health status, ApplicationSets, and continuous delivery best practices for Kubernetes." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/quizzes/post/argocd-gitops-automation-quiz --- # ArgoCD: GitOps Automation with Kubernetes Welcome to the ArgoCD Basics Quiz! This quiz is designed to test your understanding of fundamental ArgoCD concepts, GitOps principles, and continuous delivery best practices for Kubernetes. Each question is multiple-choice, and you'll find hints to help you along the way. Good luck! ## Questions ### 1. What is the primary architectural pattern used by ArgoCD? - Imperative Configuration - Imperative methods use direct commands like "kubectl apply." ArgoCD is Declarative and uses version-controlled state. - **GitOps** ✅ - ArgoCD follows GitOps, where Git repositories serve as the source of truth for the desired state of a cluster. - Eventual Consistency - While ArgoCD reconciles state, Eventual Consistency is a database data-model concept, not the primary architectural pattern. - Immutable Infrastructure - ArgoCD enables immutable infrastructure, but GitOps is the specific pattern defining the workflow and automation logic. **Hint:** It involves using Git as the single source of truth. ### 2. What does the "OutOfSync" status mean in ArgoCD? - The Git repository is currently unreachable - A down repository triggers a Connection Error or Unknown state, as Argo cannot perform a comparison. - **The cluster state differs from the Git state** ✅ - This status indicates that either the cluster has drifted from Git or new changes in Git have not been applied yet. - The target namespace does not exist in the cluster - Missing namespaces typically cause a Sync Failed error rather than a simple OutOfSync comparison status. - The application health probe has failed - Health probe failures result in a Degraded health status, which is separate from the synchronization state. **Hint:** Compare the Git repository to the live cluster. ### 3. Which ArgoCD component compares running applications against the Git source? - Argo API Server - The API Server manages user requests from the UI and CLI but does not handle continuous state reconciliation. - **Application Controller** ✅ - The Controller is the background process that constantly monitors both Git and the cluster to detect state drift. - Argo Repo Server - The Repo Server generates manifests from Git sources but does not monitor the actual live state of the cluster. - Redis Cache Layer - Redis stores cached manifest data to improve speed, but it does not contain the logic for state comparison. **Hint:** It is the "brain" of the operation. ### 4. What is the purpose of an ArgoCD "Project" (AppProject)? - To store and version the application code - Code storage is the responsibility of Git providers like GitHub; Projects are internal ArgoCD administrative units. - **To define RBAC and resource limits for apps** ✅ - Projects act as security boundaries, restricting which clusters, namespaces, or resources an application can access. - To provide high-availability for the web UI - High availability is managed through Kubernetes replicas and LoadBalancers, not the AppProject resource. - To automate the merging of Git branches - ArgoCD consumes Git state but does not perform write actions like merging or branch management. **Hint:** It provides a logical grouping for multiple applications. ### 5. What does the "SelfHeal" sync policy do? - Restarts failing pods automatically - Pod lifecycle and restarts are managed by the Kubernetes Kubelet, not by the ArgoCD sync policy. - **Reverts manual cluster changes to match Git** ✅ - If a user manually modifies a resource in the cluster, SelfHeal triggers a sync to restore the Git-defined state. - Removes resources no longer defined in Git - Deleting unmanaged resources is the function of the Prune policy, which is distinct from the SelfHeal policy. - Updates the Git source with cluster changes - GitOps is a one-way flow; ArgoCD never writes cluster changes back to the Git repository. **Hint:** It reacts when someone manually changes a resource in the cluster. ### 6. Which command is used to log into ArgoCD via the CLI? - `argocd auth --server` - The "auth" subcommand is used for token management, not for the initial user login session. - **`argocd login
`** ✅ - The login command establishes a session between your local CLI and the ArgoCD API server. - `argocd connect --url` - There is no "connect" command in the ArgoCD CLI; "login" is the standard method for authentication. - `kubectl login argocd` - Kubectl manages the Kubernetes cluster; you must use the specialized argocd binary for ArgoCD tasks. **Hint:** You need the server address. ### 7. What is an "App-of-Apps" pattern? - Nesting multiple ArgoCD controllers - This pattern involves nesting Application resources, not the controller software itself. - **A root application that deploys other apps** ✅ - This pattern uses a single "parent" application to manage and deploy a collection of "child" applications. - A cluster with multiple control planes - This describes a multi-master Kubernetes architecture, which is a infrastructure-level configuration. - A hierarchical namespace management strategy - Namespace hierarchies are managed by the Hierarchical Namespace Controller (HNC), not by this Argo pattern. **Hint:** One Application resource to rule them all. ### 8. What is the purpose of the "Prune" option in a Sync Policy? - To delete stale Git repository branches - ArgoCD does not have permissions to delete or manage branches within your Git repository. - **To delete cluster resources removed from Git** ✅ - Pruning ensures that if a resource YAML is deleted from Git, the corresponding object is removed from Kubernetes. - To compress the local Redis cache storage - Cache management is handled automatically by Redis eviction policies, not by the Sync Prune option. - To rotate logs within the API server pods - Log rotation is a standard Linux/Kubernetes node function and is not controlled by ArgoCD sync settings. **Hint:** Cleaning up the "garbage". ### 9. How does ArgoCD handle sensitive data like passwords? - Encrypting values in the local database - ArgoCD does not act as a primary secret vault and does not perform its own encryption of secret values. - **Integrating with external Secret Managers** ✅ - ArgoCD works with tools like Vault or Sealed Secrets to securely inject sensitive data without plain-text Git storage. - Masking all YAML values in the web UI - While the UI may hide some fields, actual security requires a specialized secret management workflow. - Storing values in the Application spec - Placing secrets in the Application CRD is a major security risk, as they would be visible to anyone with API access. **Hint:** It doesn't store secrets itself. ### 10. Which CRD is the core object for defining a deployment in ArgoCD? - `Deployment` - Deployment is a native Kubernetes resource; ArgoCD uses a Custom Resource to manage the GitOps wrapper. - **`Application`** ✅ - The Application CRD is the central configuration where you define the source Git and the destination cluster. - `ArgoConfig` - Configuration is typically handled via ConfigMaps and Secrets rather than a CRD named ArgoConfig. - `SyncTask` - Syncing is a controller function; there is no specific CRD named SyncTask for standard deployments. **Hint:** It shares a name with a common software term. ### 11. What is the "Refresh" action in the ArgoCD UI? - A rollout restart of the application pods - Restarting pods is a cluster-side action; Refresh is a metadata-side action involving the Git repository. - **An immediate comparison of Git vs Cluster** ✅ - Refresh forces the controller to check Git for new commits and compare them against the live state immediately. - A hard reset of the local ArgoCD database - Database resets are destructive administrative tasks that cannot be triggered by a simple UI refresh. - An update of the web browser interface - The Refresh button in the UI triggers a server-side reconciliation check, not just a page reload. **Hint:** Checking Git for updates. ### 12. What happens if a sync fails with a "Hook" error? - The Git repository access is revoked - ArgoCD does not manage Git permissions and cannot revoke credentials due to a sync failure. - **A lifecycle job failed during the sync** ✅ - Hook errors occur when a PreSync or PostSync job (like a database migration) fails to complete successfully. - The user login session has expired - Session expiration results in an Authentication error, which is separate from a resource Hook error. - The cluster has run out of IP addresses - Networking issues are reported as infrastructure errors by Kubernetes, not as specific ArgoCD Hook errors. **Hint:** ArgoCD supports Resource Hooks like PreSync and PostSync. ### 13. What is the purpose of "ApplicationSets"? - To group applications for resource billing - Billing is a cloud provider metric; ApplicationSets are strictly a deployment automation tool. - **To automate app creation at massive scale** ✅ - ApplicationSets use templates to automatically generate many ArgoCD Applications across multiple clusters or Git paths. - To delete multiple applications in a batch - While deleting a set removes its children, the primary goal is the automated generation of resources. - To create backups of the Argo configuration - Backups are managed by external tools or the argocd-util CLI, not by the ApplicationSet controller. **Hint:** Automating the creation of many Applications. ### 14. Which port does the ArgoCD API server use by default for HTTPS? - `80` - Port 80 is used for unencrypted HTTP traffic, while ArgoCD defaults to secure communications. - **`443`** ✅ - ArgoCD follows standard web conventions by using port 443 for its secure HTTPS API and Web UI. - `8080` - While common for local development, 8080 is not the default production port for the ArgoCD API server. - `22` - Port 22 is reserved for SSH traffic; ArgoCD uses HTTPS for its external management interface. **Hint:** Standard HTTPS port. ### 15. What is "Helm" in the context of ArgoCD? - A network-level firewall for Git traffic - Firewalls operate at the network layer; Helm is an application-layer package manager for Kubernetes. - **A tool for rendering charts via ArgoCD** ✅ - ArgoCD has native support for Helm, allowing it to render charts into manifests without a local Helm CLI. - The underlying database for storing apps - ArgoCD uses Redis and the Kubernetes etcd database for storage, not the Helm tool. - A system for monitoring CPU performance - Performance monitoring is the responsibility of tools like Prometheus, not a manifest tool like Helm. **Hint:** A supported tool for manifest templating. ### 16. What does the "Automatic Sync" policy do? - It triggers a rolling reboot of nodes - Sync policies manage application manifests, not the underlying Kubernetes node infrastructure. - **It deploys Git changes without manual clicks** ✅ - This policy automates the deployment process, removing the need for a user to manually trigger a sync in the UI. - It sends email alerts to the DevOps team - Notifications are handled by the ArgoCD Notifications controller, which is separate from the sync policy. - It merges code changes into the main branch - ArgoCD acts as a consumer of Git; it never modifies or merges code within your repository. **Hint:** No human interaction needed. ### 17. What is the "Health Status" of an application in ArgoCD? - The hardware health of the physical node - ArgoCD tracks application resource status, not the hardware metrics of the physical servers. - **The operational state of the live resources** ✅ - Health status indicates if resources are Healthy, Progressing, or Degraded based on their actual behavior in the cluster. - The security score of the Git repository - ArgoCD does not perform security audits of Git code; health is strictly about Kubernetes resource readiness. - The latency of the API server response - API latency is a performance metric, not an application health status within the ArgoCD dashboard. **Hint:** It tells you if the pods are actually running correctly. ### 18. Which command lists the applications managed by ArgoCD? - `argocd get applications` - The "get" command is usually for detailed info on one app; "app list" is used for the full summary. - **`argocd app list`** ✅ - This command provides a summarized table of all apps, including their health and synchronization status. - `kubectl show apps` - Kubectl does not have a "show" command; the Argo CLI is the preferred tool for managing Argo applications. - `argocd info --all` - While descriptive, "info" is not the primary command for listing multiple managed applications. **Hint:** Think "list". ### 19. What is the "Manifest" in ArgoCD? - A list of administrators with access - Access lists are part of RBAC configurations, which are different from application manifests. - **The desired state defined in YAML or JSON** ✅ - Manifests are the declarative files that tell Kubernetes exactly which resources should be created and configured. - A file containing all historical logs - Logs are historical output data; manifests are the input definitions used to build the environment. - A certificate for encrypted traffic - Traffic certificates are stored in Secrets or managed by Service Meshes, not in the application manifest. **Hint:** The YAML file. ### 20. What is a "Sync Wave"? - A fluctuation in the network bandwidth - Waves refer to the logical ordering of resources, not to network physics or throughput. - **An annotation to control resource order** ✅ - Sync Waves allow you to ensure that certain resources (like Databases) are ready before others (like Web Apps) are created. - A method for accelerating pod deletion - Waves manage the chronological sequence of application, not the speed of the deletion process. - A specific visualization in the dashboard - While the UI shows waves, they are a functional part of the backend reconciliation logic. **Hint:** Controlling the order of resource creation. ### 21. What is the "History" tab used for in the ArgoCD UI? - To review the history of Git commits - Git history is managed by the Git provider; Argo history tracks actual deployment (sync) events. - **To view past syncs and perform rollbacks** ✅ - The History tab allows you to see every time the app was synced and revert to a previous state if needed. - To track the history of cluster node reboots - Node reboots are tracked in system logs or Kubernetes events, not in the ArgoCD application history. - To audit the changes to user passwords - Password changes are captured in authentication logs, whereas Application history is about deployment state. **Hint:** Looking into the past. ### 22. What is a "Destination" in an ArgoCD Application? - The URL of the source Git repository - The Git repository is defined as the "Source" in the Application spec, not the "Destination." - **The target cluster and namespace for deployment** ✅ - The Destination specifies which Kubernetes cluster and which specific namespace the application should live in. - The email address used for alert routing - Alerting endpoints are called "sinks" or "receivers" and are not part of the Application Destination block. - The local file path on the Argo server - ArgoCD works with remote Git URLs; local paths are not used for production GitOps destinations. **Hint:** Where the code goes. ### 23. What is the purpose of the "argocd-cm" ConfigMap? - Storing encrypted user credentials - Credentials and sensitive data are stored in Kubernetes Secrets, while argocd-cm stores general settings. - **Defining global settings and UI themes** ✅ - This ConfigMap is the primary place to configure the behavior, branding, and external links for the ArgoCD instance. - Managing the list of all connected clusters - Clusters are managed as Secrets or via the CLI; argocd-cm is for general application settings. - Executing automated database migrations - Migrations are performed by Jobs or Sync Hooks, while ConfigMaps are static data structures. **Hint:** Central configuration. ### 24. What does "Degraded" status usually imply? - The Git repository is currently empty - An empty repository results in an OutOfSync or Missing status rather than a Degraded health status. - **Active resources are failing in the cluster** ✅ - Degraded means the manifests were successfully applied, but the objects (like Pods) are in a failing state. - The web UI is experiencing high latency - UI performance does not affect the health status of the managed Kubernetes applications. - The administrator has been logged out - User authentication status is independent of the functional health of the deployed applications. **Hint:** The resources are there, but they aren't working. ### 25. What is "Kustomize" in ArgoCD? - A way to modify the ArgoCD UI colors - Kustomize is a configuration tool for Kubernetes YAML, not a CSS or UI branding tool. - **A tool for template-free YAML customization** ✅ - ArgoCD supports Kustomize to allow environment-specific overrides (overlays) without complex templating logic. - A security scanner for container images - Scanning is performed by tools like Trivy; Kustomize is strictly for manifest organization and modification. - A plugin for managing GitHub Actions - Kustomize is a Kubernetes tool used by ArgoCD internally to process manifests before deployment. **Hint:** Another supported manifest tool. ### 26. What is the "Source" in an ArgoCD Application? - The destination Kubernetes cluster endpoint - The cluster endpoint is the Destination; the Source is where the configuration files originate. - **The Git URL, branch, and directory path** ✅ - The Source defines exactly which repository and folder ArgoCD should monitor for the desired state. - The Docker registry containing the images - ArgoCD reads configuration from Git; the resulting manifests point Kubernetes to the Docker registry. - The local workspace of the developer - ArgoCD is designed for centralized GitOps and does not pull manifests from local developer machines. **Hint:** Where the code comes from. ### 27. What happens if you delete an ArgoCD Application resource? - The source Git repository is deleted - ArgoCD does not have the authority or capability to delete repositories in your Git provider. - **Cluster resources are also deleted by default** ✅ - ArgoCD uses cascading deletion to ensure that removing an application also cleans up its Kubernetes objects. - The entire Kubernetes cluster is reset - Deletion is scoped to the specific application; it does not affect unrelated resources or the cluster itself. - Only the ArgoCD database record is removed - By default, ArgoCD also cleans up the live resources in the cluster unless non-cascading deletion is selected. **Hint:** Cascading deletion. ### 28. What is the purpose of the "argocd-rbac-cm" ConfigMap? - To manage encrypted network traffic - Network encryption is the role of Service Meshes or TLS; this ConfigMap manages user permissions. - **To define user and group permissions** ✅ - This ConfigMap uses a policy-based format to control which users can view, sync, or delete applications. - To store cluster connection parameters - Cluster details are stored in Secrets; the RBAC ConfigMap is dedicated to access control policies. - To assign specific labels to worker nodes - Node labels are a Kubernetes infrastructure task and are not managed through ArgoCD RBAC settings. **Hint:** Role Based Access Control. ### 29. How can you trigger a sync without waiting for the poll? - By restarting the API server pods - Restarting pods causes downtime and is an inefficient way to force a metadata synchronization. - **By configuring a Git Webhook** ✅ - Webhooks allow Git to notify ArgoCD the moment a commit is pushed, triggering a sync in near real-time. - By adding more CPU to the controller - Polling is a software interval; adding hardware resources does not change the frequency of the check. - By clearing the local browser cookies - Syncing is a server-side controller task; local browser state has no impact on the sync interval. **Hint:** GitHub/GitLab can "push" a notification to Argo. ### 30. What is "Argo Rollouts"? - A tool for backing up ArgoCD data - Rollouts is a deployment controller, whereas backups are handled by tools like Velero or argocd-util. - **An extension for Canary and Blue-Green deploys** ✅ - Rollouts provides advanced deployment strategies that are more sophisticated than standard Kubernetes rolling updates. - A command to list all cluster namespaces - Namespace listing is performed by kubectl; Argo Rollouts is a custom controller for resource management. - A mobile application for monitoring pods - There is no official mobile app for ArgoCD; Rollouts is a Kubernetes-native resource controller. **Hint:** Advanced deployment strategies.