Configuration as Code is a GitOps-related practice where configurations are stored as declarative

definitions in version control. Helm charts, for example, allow applications deployed on Kubernetes

to have both their container images and configuration specified declaratively.

“Configuration as Code enables teams to manage application and infrastructure configuration in

version control systems, using declarative approaches such as Kubernetes manifests or Helm charts.

This ensures repeatability, automation, and auditability.”

Thus, Helm charts are a prime example of this practice, making C correct.

Reference: GitOps Related Practices (CNCF GitOps Working Group), Configuration as Code.

===========

One of the four fundamental GitOps principles is Versioned and Immutable. This means that the

entire system’s desired state must be stored in a Git repository with version control. Each change

must be represented as a commit, and Git’s immutability guarantees a reliable, auditable history of

how the system evolved.

“The desired state is stored in a version control system. The record of truth is stored in an immutable

history, and changes can be audited and reverted if necessary. This guarantees that the system’s

configuration is versioned, immutable, and traceable.”

Thus, configuration and infrastructure must be version-controlled and immutable, never changed

directly in production.

Reference: GitOps Principles (CNCF GitOps Working Group), Principle 2: The desired system state is

stored as versioned and immutable.

===========

GitOps enhances DevSecOps by ensuring security-related configurations and changes are stored in

version control, where a complete audit history is available. This provides traceability, accountability,

and compliance enforcement.

“With GitOps, the entire version history of desired state changes is stored immutably in Git. This

audit trail supports security and compliance goals in DevSecOps practices.”

Thus, the correct answer is B.

Reference: GitOps Related Practices (CNCF GitOps Working Group), DevSecOps Integration.

===========

In GitOps, Git is the single source of truth. If changes are made manually in the cluster (via kubectl),

those changes will drift from the desired state in Git. To ensure consistency, the correct approach is

to update the Git repository (Desired State store) so that the reconciler can continuously apply and

maintain those changes.

“The desired state must always be declared in Git. Manual changes in the cluster will be overwritten

by reconciliation unless they are committed to the Git repository.”

Thus, the correct answer is B.

Reference: GitOps Principles (CNCF GitOps Working Group), Drift and Reconciliation Practices.

===========

GitOps emphasizes immutability and auditability. If an error occurs in the configuration stored in Git,

the system should be rolled back to the last known good state while the error is fixed. This preserves

system reliability and aligns with the GitOps principle of rollback through version control.

“With Git as the source of truth, if an error is introduced, the system can be rolled back by reverting

to a previous commit. This ensures stability while the faulty configuration is corrected.”

Thus, the recommended action is C: Roll back to the previous working version.

Reference: GitOps Principles (CNCF GitOps Working Group).

===========

Kustomize is a Kubernetes-native configuration management tool that allows manifest customization

without modifying the original YAML files. It uses overlays and patches to adapt configurations for

different environments.

“Kustomize provides a declarative way to customize Kubernetes manifests by applying patches and

overlays. This allows managing multiple environments without duplicating manifest files.”

Thus, the correct answer is D.

Reference: GitOps Tooling (CNCF GitOps Working Group), Kustomize.

===========

A reconciler ensures that the actual system matches the desired state declared in Git. External

reconcilers run outside the core cluster orchestration process. Flux is a widely used GitOps external

reconciler that continuously syncs cluster state with the repository.

“Flux is an example of a GitOps reconciler that continuously monitors Git repositories and applies

changes to the cluster. As an external reconciler, it handles synchronization and reconciliation loops

outside the direct application code.”

Thus, A: Flux is correct.

Reference: GitOps Tooling (CNCF GitOps Working Group).

===========

The Desired State is the declarative specification stored in Git that defines how the system should

look and behave. It is the reference point against which the actual state is continuously reconciled.

“Desired state is the complete declarative specification of a system stored in Git. It defines how the

system should be configured and serves as the source of truth for reconciliation.”

Thus, the correct answer is A.

Reference: GitOps Terminology (CNCF GitOps Working Group).

The State Store is typically implemented using a version control system (VCS) such as Git. This

ensures that the system’s state is auditable, versioned, and immutable. Other systems like databases

or distributed file systems do not meet the immutability and versioning requirements of GitOps.

“In GitOps, the desired state must be stored in a version control system. This serves as the State

Store, providing a complete, immutable, and auditable history of changes.”

Thus, the correct answer is D: version control system.

Reference: GitOps Terminology (CNCF GitOps Working Group).

A Canary Deployment gradually introduces a new application version to a small subset of users

before expanding to the full user base. This pattern allows testing and validation in production while

reducing risk.

“Canary deployments progressively roll out changes to a small group of users, monitoring for issues

before routing all traffic to the new version. This gradual shift minimizes risk and ensures safer

releases.”

Thus, the correct answer is B.

Reference: GitOps Patterns (CNCF GitOps Working Group), Progressive Delivery.

===========