GitOps Solution: Fundamentals (EN)

This solution guide belongs to the assessment Fundamentals. It does not provide one rigid answer; it defines verifiable answer criteria.

Grading Rubric

Area	Expectation
Principles	Declarative, versioned, automatically pulled and continuously reconciled are applied correctly.
Evidence	Answers name source, commit, rendering, controller and status evidence.
Operations	Drift, promotion, rollback, multi-tenancy and observability are covered.
Security	Secrets, RBAC, policy, signatures and supply chain are assessed.

Sample Criteria

Solution 01: OpenGitOps-Prinzipien

A strong answer for OpenGitOps-Prinzipien names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 02: gewünschter Zustand

A strong answer for gewünschter Zustand names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 03: Git als Quelle

A strong answer for Git als Quelle names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 04: Kubernetes-Manifeste

A strong answer for Kubernetes-Manifeste names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 05: Reconciliation

A strong answer for Reconciliation names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 06: Drift

A strong answer for Drift names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 07: OpenGitOps-Prinzipien

A strong answer for OpenGitOps-Prinzipien names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 08: gewünschter Zustand

A strong answer for gewünschter Zustand names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 09: Git als Quelle

A strong answer for Git als Quelle names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 10: Kubernetes-Manifeste

A strong answer for Kubernetes-Manifeste names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 11: Reconciliation

A strong answer for Reconciliation names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 12: Drift

A strong answer for Drift names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 13: OpenGitOps-Prinzipien

A strong answer for OpenGitOps-Prinzipien names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 14: gewünschter Zustand

A strong answer for gewünschter Zustand names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 15: Git als Quelle

A strong answer for Git als Quelle names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 16: Kubernetes-Manifeste

A strong answer for Kubernetes-Manifeste names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 17: Reconciliation

A strong answer for Reconciliation names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 18: Drift

A strong answer for Drift names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 19: OpenGitOps-Prinzipien

A strong answer for OpenGitOps-Prinzipien names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 20: gewünschter Zustand

A strong answer for gewünschter Zustand names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 21: Git als Quelle

A strong answer for Git als Quelle names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 22: Kubernetes-Manifeste

A strong answer for Kubernetes-Manifeste names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 23: Reconciliation

A strong answer for Reconciliation names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 24: Drift

A strong answer for Drift names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 25: OpenGitOps-Prinzipien

A strong answer for OpenGitOps-Prinzipien names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 26: gewünschter Zustand

A strong answer for gewünschter Zustand names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 27: Git als Quelle

A strong answer for Git als Quelle names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 28: Kubernetes-Manifeste

A strong answer for Kubernetes-Manifeste names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 29: Reconciliation

A strong answer for Reconciliation names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 30: Drift

A strong answer for Drift names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 31: OpenGitOps-Prinzipien

A strong answer for OpenGitOps-Prinzipien names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 32: gewünschter Zustand

A strong answer for gewünschter Zustand names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 33: Git als Quelle

A strong answer for Git als Quelle names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 34: Kubernetes-Manifeste

A strong answer for Kubernetes-Manifeste names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 35: Reconciliation

A strong answer for Reconciliation names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 36: Drift

A strong answer for Drift names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 37: OpenGitOps-Prinzipien

A strong answer for OpenGitOps-Prinzipien names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 38: gewünschter Zustand

A strong answer for gewünschter Zustand names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 39: Git als Quelle

A strong answer for Git als Quelle names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Solution 40: Kubernetes-Manifeste

A strong answer for Kubernetes-Manifeste names the affected GitOps source, describes the reconciliation path, separates desired and actual state and states a concrete recovery path.

Good evidence: Git commit, rendered manifest, Argo CD Application status, Flux condition, Kubernetes event or traceable diff.
Common mistake: equating GitOps with CI or enabling auto-sync without RBAC, secret and drift assessment.
Security expectation: no plaintext secrets, minimal controller permissions, checked signature or policy boundaries and documented incident response.

Practice Appendix: Fundamentals Solution

This appendix provides a backlog for longer trainings, reviews and repetition. Each task is small enough to verify with local YAML artifacts and a Git repository.

A001. OpenGitOps-Prinzipien

Task: document desired state and explicitly relate the observation to OpenGitOps-Prinzipien.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A002. gewünschter Zustand

Task: identify source and commit and explicitly relate the observation to gewünschter Zustand.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A003. Git als Quelle

Task: explain reconciliation path and explicitly relate the observation to Git als Quelle.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A004. Kubernetes-Manifeste

Task: prove drift and explicitly relate the observation to Kubernetes-Manifeste.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A005. Reconciliation

Task: check Kustomize or Helm rendering and explicitly relate the observation to Reconciliation.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A006. Drift

Task: read Argo CD or Flux resource and explicitly relate the observation to Drift.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A007. GitOps

Task: assess promotion risk and explicitly relate the observation to GitOps.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A008. Desired State

Task: write down rollback path and explicitly relate the observation to Desired State.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A009. Actual State

Task: mark secret boundary and explicitly relate the observation to Actual State.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A010. Reconciliation

Task: check RBAC and tenant boundary and explicitly relate the observation to Reconciliation.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A011. Drift

Task: name policy impact and explicitly relate the observation to Drift.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A012. Source of Truth

Task: describe feedback loop and explicitly relate the observation to Source of Truth.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A013. Pull Model

Task: document desired state and explicitly relate the observation to Pull Model.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A014. Argo CD Application

Task: identify source and commit and explicitly relate the observation to Argo CD Application.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A015. Argo CD AppProject

Task: explain reconciliation path and explicitly relate the observation to Argo CD AppProject.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A016. Flux Source

Task: prove drift and explicitly relate the observation to Flux Source.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A017. Flux Kustomization

Task: check Kustomize or Helm rendering and explicitly relate the observation to Flux Kustomization.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A018. HelmRelease

Task: read Argo CD or Flux resource and explicitly relate the observation to HelmRelease.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A019. Kustomize Overlay

Task: assess promotion risk and explicitly relate the observation to Kustomize Overlay.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A020. Promotion

Task: write down rollback path and explicitly relate the observation to Promotion.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A021. Progressive Delivery

Task: mark secret boundary and explicitly relate the observation to Progressive Delivery.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A022. Secret Management

Task: check RBAC and tenant boundary and explicitly relate the observation to Secret Management.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A023. OpenGitOps-Prinzipien

Task: name policy impact and explicitly relate the observation to OpenGitOps-Prinzipien.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A024. gewünschter Zustand

Task: describe feedback loop and explicitly relate the observation to gewünschter Zustand.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A025. Git als Quelle

Task: document desired state and explicitly relate the observation to Git als Quelle.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A026. Kubernetes-Manifeste

Task: identify source and commit and explicitly relate the observation to Kubernetes-Manifeste.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A027. Reconciliation

Task: explain reconciliation path and explicitly relate the observation to Reconciliation.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A028. Drift

Task: prove drift and explicitly relate the observation to Drift.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A029. GitOps

Task: check Kustomize or Helm rendering and explicitly relate the observation to GitOps.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A030. Desired State

Task: read Argo CD or Flux resource and explicitly relate the observation to Desired State.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A031. Actual State

Task: assess promotion risk and explicitly relate the observation to Actual State.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A032. Reconciliation

Task: write down rollback path and explicitly relate the observation to Reconciliation.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A033. Drift

Task: mark secret boundary and explicitly relate the observation to Drift.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A034. Source of Truth

Task: check RBAC and tenant boundary and explicitly relate the observation to Source of Truth.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A035. Pull Model

Task: name policy impact and explicitly relate the observation to Pull Model.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A036. Argo CD Application

Task: describe feedback loop and explicitly relate the observation to Argo CD Application.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A037. Argo CD AppProject

Task: document desired state and explicitly relate the observation to Argo CD AppProject.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A038. Flux Source

Task: identify source and commit and explicitly relate the observation to Flux Source.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A039. Flux Kustomization

Task: explain reconciliation path and explicitly relate the observation to Flux Kustomization.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A040. HelmRelease

Task: prove drift and explicitly relate the observation to HelmRelease.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A041. Kustomize Overlay

Task: check Kustomize or Helm rendering and explicitly relate the observation to Kustomize Overlay.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A042. Promotion

Task: read Argo CD or Flux resource and explicitly relate the observation to Promotion.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A043. Progressive Delivery

Task: assess promotion risk and explicitly relate the observation to Progressive Delivery.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A044. Secret Management

Task: write down rollback path and explicitly relate the observation to Secret Management.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A045. OpenGitOps-Prinzipien

Task: mark secret boundary and explicitly relate the observation to OpenGitOps-Prinzipien.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A046. gewünschter Zustand

Task: check RBAC and tenant boundary and explicitly relate the observation to gewünschter Zustand.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A047. Git als Quelle

Task: name policy impact and explicitly relate the observation to Git als Quelle.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A048. Kubernetes-Manifeste

Task: describe feedback loop and explicitly relate the observation to Kubernetes-Manifeste.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A049. Reconciliation

Task: document desired state and explicitly relate the observation to Reconciliation.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A050. Drift

Task: identify source and commit and explicitly relate the observation to Drift.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A051. GitOps

Task: explain reconciliation path and explicitly relate the observation to GitOps.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A052. Desired State

Task: prove drift and explicitly relate the observation to Desired State.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A053. Actual State

Task: check Kustomize or Helm rendering and explicitly relate the observation to Actual State.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A054. Reconciliation

Task: read Argo CD or Flux resource and explicitly relate the observation to Reconciliation.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A055. Drift

Task: assess promotion risk and explicitly relate the observation to Drift.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A056. Source of Truth

Task: write down rollback path and explicitly relate the observation to Source of Truth.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A057. Pull Model

Task: mark secret boundary and explicitly relate the observation to Pull Model.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A058. Argo CD Application

Task: check RBAC and tenant boundary and explicitly relate the observation to Argo CD Application.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A059. Argo CD AppProject

Task: name policy impact and explicitly relate the observation to Argo CD AppProject.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A060. Flux Source

Task: describe feedback loop and explicitly relate the observation to Flux Source.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A061. Flux Kustomization

Task: document desired state and explicitly relate the observation to Flux Kustomization.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A062. HelmRelease

Task: identify source and commit and explicitly relate the observation to HelmRelease.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A063. Kustomize Overlay

Task: explain reconciliation path and explicitly relate the observation to Kustomize Overlay.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A064. Promotion

Task: prove drift and explicitly relate the observation to Promotion.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A065. Progressive Delivery

Task: check Kustomize or Helm rendering and explicitly relate the observation to Progressive Delivery.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A066. Secret Management

Task: read Argo CD or Flux resource and explicitly relate the observation to Secret Management.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A067. OpenGitOps-Prinzipien

Task: assess promotion risk and explicitly relate the observation to OpenGitOps-Prinzipien.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A068. gewünschter Zustand

Task: write down rollback path and explicitly relate the observation to gewünschter Zustand.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A069. Git als Quelle

Task: mark secret boundary and explicitly relate the observation to Git als Quelle.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A070. Kubernetes-Manifeste

Task: check RBAC and tenant boundary and explicitly relate the observation to Kubernetes-Manifeste.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A071. Reconciliation

Task: name policy impact and explicitly relate the observation to Reconciliation.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A072. Drift

Task: describe feedback loop and explicitly relate the observation to Drift.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A073. GitOps

Task: document desired state and explicitly relate the observation to GitOps.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

A074. Desired State

Task: identify source and commit and explicitly relate the observation to Desired State.
Evidence: Write down at least one GitOps-adjacent command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in dev, staging and prod clusters?
Security question: Which credentials, secrets, roles, signatures or policy rules would be critical?
Recovery: Explain whether Git revert, sync rollback, suspend, manual drift correction or secret rotation is required.

Official Sources and Scope

The material is aligned with public GitOps and Kubernetes documentation. Argo CD, Flux, Kustomize, Helm, policy controllers and secret tools are positioned where they represent common GitOps workflows. An example artifact is not an installation promise for a specific cluster.

OpenGitOps: https://opengitops.dev/
OpenGitOps Principles: https://github.com/open-gitops/documents/blob/main/PRINCIPLES.md
Argo CD Documentation: https://argo-cd.readthedocs.io/en/stable/
Argo CD Declarative Setup: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/
Argo CD Project Page: https://argoproj.github.io/cd/
Flux Documentation: https://fluxcd.io/flux/
Flux Core Concepts: https://fluxcd.io/flux/concepts/
CNCF GitOps Certified Associate (CGOA): https://www.cncf.io/training/certification/cgoa/
Linux Foundation Certified GitOps Associate (CGOA): https://training.linuxfoundation.org/certification/certified-gitops-associate-cgoa/

Additional Review Drills

Use these drills when the primary task is complete and the learner needs another pass over operational reasoning. They are intentionally evidence-oriented and can be answered with local GitOps artifacts.

Drill 01: desired state

State which source, controller or environment is affected by desired state.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 02: source commit

State which source, controller or environment is affected by source commit.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 03: reconciliation

State which source, controller or environment is affected by reconciliation.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 04: drift

State which source, controller or environment is affected by drift.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 05: Argo CD Application

State which source, controller or environment is affected by Argo CD Application.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 06: Flux Kustomization

State which source, controller or environment is affected by Flux Kustomization.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 07: Kustomize overlay

State which source, controller or environment is affected by Kustomize overlay.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 08: HelmRelease

State which source, controller or environment is affected by HelmRelease.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 09: secret management

State which source, controller or environment is affected by secret management.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 10: RBAC boundary

State which source, controller or environment is affected by RBAC boundary.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 11: policy gate

State which source, controller or environment is affected by policy gate.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 12: rollback

State which source, controller or environment is affected by rollback.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 13: desired state

State which source, controller or environment is affected by desired state.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 14: source commit

State which source, controller or environment is affected by source commit.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 15: reconciliation

State which source, controller or environment is affected by reconciliation.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

Drill 16: drift

State which source, controller or environment is affected by drift.
Name one command or manifest field that produces evidence.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest recovery path for a shared GitOps platform.

GitOps Solution: Fundamentals (EN)

Grading Rubric

Sample Criteria

Solution 01: OpenGitOps-Prinzipien

Solution 02: gewünschter Zustand

Solution 03: Git als Quelle

Solution 04: Kubernetes-Manifeste

Solution 05: Reconciliation

Solution 06: Drift

Solution 07: OpenGitOps-Prinzipien

Solution 08: gewünschter Zustand

Solution 09: Git als Quelle

Solution 10: Kubernetes-Manifeste

Solution 11: Reconciliation

Solution 12: Drift

Solution 13: OpenGitOps-Prinzipien

Solution 14: gewünschter Zustand

Solution 15: Git als Quelle

Solution 16: Kubernetes-Manifeste

Solution 17: Reconciliation

Solution 18: Drift

Solution 19: OpenGitOps-Prinzipien

Solution 20: gewünschter Zustand

Solution 21: Git als Quelle

Solution 22: Kubernetes-Manifeste

Solution 23: Reconciliation

Solution 24: Drift

Solution 25: OpenGitOps-Prinzipien

Solution 26: gewünschter Zustand

Solution 27: Git als Quelle

Solution 28: Kubernetes-Manifeste

Solution 29: Reconciliation

Solution 30: Drift

Solution 31: OpenGitOps-Prinzipien

Solution 32: gewünschter Zustand

Solution 33: Git als Quelle

Solution 34: Kubernetes-Manifeste

Solution 35: Reconciliation

Solution 36: Drift

Solution 37: OpenGitOps-Prinzipien

Solution 38: gewünschter Zustand

Solution 39: Git als Quelle

Solution 40: Kubernetes-Manifeste

Review Checklist for Fundamentals Solution

Practice Appendix: Fundamentals Solution

A001. OpenGitOps-Prinzipien

A002. gewünschter Zustand

A003. Git als Quelle

A004. Kubernetes-Manifeste

A005. Reconciliation

A006. Drift

A007. GitOps

A008. Desired State

A009. Actual State

A010. Reconciliation

A011. Drift

A012. Source of Truth

A013. Pull Model

A014. Argo CD Application

A015. Argo CD AppProject

A016. Flux Source

A017. Flux Kustomization

A018. HelmRelease

A019. Kustomize Overlay

A020. Promotion

A021. Progressive Delivery

A022. Secret Management

A023. OpenGitOps-Prinzipien

A024. gewünschter Zustand

A025. Git als Quelle

A026. Kubernetes-Manifeste

A027. Reconciliation

A028. Drift

A029. GitOps

A030. Desired State

A031. Actual State

A032. Reconciliation

A033. Drift

A034. Source of Truth

A035. Pull Model