CGOA: GitOps Patterns

The GitOps Patterns domain tests the recurring repository and deployment structures used to apply GitOps at scale. The exam asks you to choose a pattern for a scenario and to recognize its tradeoffs.

Common patterns

• Environment per directory: one repository with base/, staging/, and production/ overlays. Promotion is a pull request that changes the production overlay's image tag or patch. Simple review and rollback.
• Environment per branch: branches represent environments. Promotion is a merge. This can drift into long-lived branches and merge conflicts; directory-per-environment is usually easier to audit.
• App of apps: a root application points to child Application or Kustomization objects. It bootstraps many apps, but creates a central dependency and blast-radius concern.
• Multi-cluster: one management plane or one agent per cluster. Argo CD ApplicationSet and Flux Kustomization can target clusters; choose based on credentials, isolation, and failure domains.
• Progressive delivery: canary or blue-green rollout gated by metrics. GitOps declares the desired version; a rollout controller such as Argo Rollouts or Flagger manages traffic steps. GitOps alone does not provide canary analysis.
• Pull-based promotion: the agent in each environment pulls its own overlay. Promotion changes the source, not a push from a central pipeline.

Worked example

A team has apps/base and environments/staging and environments/production directories. Staging tracks app:2.3; production tracks app:2.2. To promote, an engineer opens a PR changing only the production kustomization to 2.3. Reviewers see the diff, CI validates rendering, and the production agent pulls the merge commit and reconciles. Rollback is a revert PR. The reasoning: the pattern makes promotion a reviewable source change, keeps environments in one history, and avoids branch merges.

Traps that cost marks

Assuming branch-per-environment is required. Forgetting that app-of-apps can concentrate failure. Confusing progressive delivery with GitOps reconciliation; they are complementary. Storing plaintext secrets in overlays. Using one shared overlay for all environments and losing promotion control.