Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud DevOps Engineer practice bank has 1,455 more like it. Try 10 free: instant score, no account.
Your enterprise organization is designing an automated GitOps workflow across multi-tenant Google Kubernetes Engine (GKE) clusters to manage infrastructure configurations and Kubernetes policies.
The design must satisfy the following operational requirements:
kubectl interventions, and automatically remediate the drift back to the declared source state.How should you configure the GitOps synchronization architecture using Config Sync?
This option couples the nomos command-line validation tool (nomos vet) with an external CI/CD runner (Azure Pipelines) on a scheduled cron cadence to push configurations to the cluster.
nomos vet command is a static analysis tool used during development or CI to validate syntax and repository formatting against Config Sync schema rules. It does not synchronize state, monitor running clusters, or remediate drift in real time.nomos vet is intended for pre-commit or CI linting checks, not runtime cluster state management.The objective was solely to implement pre-merge pull request validation to check manifest syntax before code is committed to a Git repository.
This approach uses a single RootSync custom resource to manage the entire cluster's configurations, mapping every namespace and cluster-wide policy from a single repository or structured directories.
RootSync object, Config Sync creates only one root reconciler deployment. If any single configuration error, invalid YAML syntax, or synchronization issue occurs anywhere in the shared repository, the reconciler can become blocked, impacting all application teams simultaneously.root-reconciler instance that executes with cluster-admin privileges.The cluster were a small, single-tenant environment where a single infrastructure team managed all cluster and application configurations in a unified repository without needing segregated permissions or independent fault domains.
Config Sync is a continuous delivery and GitOps management tool for Kubernetes that automatically reconciles the state of a cluster with configurations stored in a source of truth such as a Git repository, OCI registry, or Helm repository. Its multi-instancing architecture utilizes RootSync and RepoSync Custom Resources to manage cluster-level and namespace-level resources independently.
RootSync object manages cluster-scoped configurations and platform foundations, while RepoSync objects restrict individual tenant teams to their specific Kubernetes namespaces.RootSync and RepoSync custom resource spawns its own dedicated reconciler deployment and Pod. The reconciler includes a dedicated git-sync sidecar container that polls the assigned repository branch and directory path. If a tenant's repository fails to parse or loses authentication, other tenant reconcilers continue running unaffected.kubectl, Config Sync detects the discrepancy and immediately applies the version-controlled configuration, remediating the configuration drift.git revert.Using native RootSync and RepoSync objects provides declarative, in-cluster reconciliation that runs continuously without external CI/CD push triggers, enforcing continuous compliance and automatic drift self-healing across isolated tenant boundaries.
This pattern represents a traditional push-based CI/CD pipeline, where an external orchestrator (Cloud Build) listens for Git webhooks and runs deployment commands (kubectl apply) directly against the target cluster API.
kubectl or if an emergency change is applied in-cluster, Cloud Build is unaware of the change and cannot detect or correct the drift.The organization explicitly required push-based continuous integration with manual deployment approvals outside of Kubernetes instead of a continuous GitOps pull reconciliation model.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated