GitOps Principles
The GitOps Principles domain tests the four normative principles that define GitOps, and whether you can apply them to a scenario rather than merely recite them. The exam favors questions that ask which principle a practice violates.
The four principles
- Declarative: the entire system, including infrastructure, workloads, and configuration, is described declaratively as desired state. You declare outcomes, not imperative commands.
- Versioned and immutable: desired state is stored with versioning and immutability enforced, preserving complete history. Git is the common implementation, but the principle is about versioned immutable storage, not the Git brand.
- Pulled automatically: software agents automatically pull desired state from the source. Humans and CI do not push changes into the cluster; the agent initiates retrieval.
- Continuously reconciled: agents continuously observe actual state and converge it toward desired state, correcting drift rather than applying once.
Worked example
A platform team stores a Kustomize base and per-environment overlays in Git. A Flux Kustomization object points at the production overlay. Flux's controller pulls the repository revision, renders the overlay, applies it, and keeps watching. If an operator edits a Deployment's replica count manually, the controller detects the difference and restores the declared value. If the repository is temporarily unreachable, the controller cannot fetch a new revision, but it has not violated the pull principle; it simply cannot reconcile until the source returns. The reasoning maps each step to a principle: declarative manifests, immutable Git history, automatic pull by the agent, continuous convergence.
Traps that cost marks
Assuming GitOps requires Kubernetes; the principles are tool- and platform-neutral. Assuming Git is mandatory; versioned immutable storage is the requirement. Confusing CI with deployment: a CI pipeline may build images, but a push-based deploy step violates the pulled-automatically principle. Treating reconciliation as a one-time apply. Believing declarative means YAML only; any declarative representation can work. Thinking continuous reconciliation means every commit deploys instantly; it means ongoing convergence.