# Flux CD quiz questions > 60 multiple-choice questions on GitOps with Kustomizations, HelmReleases, sources, image automation, notifications and multi-tenancy, with answers and explanations. Quiz page: https://k8wiz.com/fluxcd/difficulty ## Beginner (Easy): 20 questions Interactive quiz: https://k8wiz.com/fluxcd/quiz/easy ### What is Flux CD? Flux CD, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/what-is-flux-cd - A. A container runtime that replaces containerd on every node - B. A GitOps tool that syncs a cluster with configuration stored in Git or OCI - C. A service mesh that routes and encrypts traffic between pods - D. A CI system that builds and tests container images from Git **Answer:** A GitOps tool that syncs a cluster with configuration stored in Git or OCI **Explanation:** Flux is a set of Kubernetes controllers that pull the desired state from sources such as Git repositories, OCI artifacts and Helm repositories, and apply it to the cluster. It keeps checking, so changes made directly in the cluster are put back to what the source declares. ### With Flux, how do changes in Git reach the cluster? Flux CD, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/with-flux-how-do-changes-in-git-reach-the-cluster - A. A CI pipeline runs kubectl apply against the cluster after each commit - B. Flux controllers in the cluster pull them from the source and apply them - C. Developers push manifests to the API server with a flux command - D. The Git provider sends the manifests to the cluster over a webhook **Answer:** Flux controllers in the cluster pull them from the source and apply them **Explanation:** Flux uses a pull model. Its controllers run inside the cluster, fetch the desired state on an interval and apply it, so CI never needs cluster credentials. A webhook can make Flux fetch sooner, but the controllers still do the pulling. ### Which Flux controller fetches Git repositories, OCI artifacts and Helm charts for the other controllers? Flux CD, Easy (Beginner), Architecture. https://k8wiz.com/uquiz/which-flux-controller-fetches-git-repositories-oci-artifacts-and-helm-charts-for-the-other-controllers - A. kustomize-controller - B. helm-controller - C. notification-controller - D. source-controller **Answer:** source-controller **Explanation:** source-controller reconciles GitRepository, OCIRepository, HelmRepository, HelmChart and Bucket objects. It downloads the content, packages it as an artifact and serves it inside the cluster, where kustomize-controller and helm-controller fetch it. ### Which Flux custom resource applies the Kubernetes manifests found at a path in a source? Flux CD, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/which-flux-custom-resource-applies-the-kubernetes-manifests-found-at-a-path-in-a-source - A. GitRepository (source.toolkit.fluxcd.io) - B. Kustomization (kustomize.toolkit.fluxcd.io) - C. HelmRelease (helm.toolkit.fluxcd.io) - D. Receiver (notification.toolkit.fluxcd.io) **Answer:** Kustomization (kustomize.toolkit.fluxcd.io) **Explanation:** A Flux Kustomization points at a source and a path inside it. kustomize-controller builds the manifests with Kustomize, generating a kustomization.yaml if the directory has none, and applies the result. It is a different thing from the kustomization.yaml file Kustomize reads, despite the shared name. ### Which command checks that a cluster meets Flux's requirements before you install it? Flux CD, Easy (Beginner), Commands. https://k8wiz.com/uquiz/which-command-checks-that-a-cluster-meets-fluxs-requirements-before-you-install-it - A. flux preflight - B. flux check --pre - C. flux doctor - D. flux status --pre **Answer:** flux check --pre **Explanation:** 'flux check --pre' runs the pre-installation checks, such as the Kubernetes version. Running 'flux check' without --pre after installing checks that the Flux controllers are deployed and healthy. ### What does 'flux bootstrap github' do? Flux CD, Easy (Beginner), Commands. https://k8wiz.com/uquiz/what-does-flux-bootstrap-github-do - A. Installs Flux and commits its manifests to a repo the cluster then syncs from - B. Creates a GitHub Actions workflow that runs kubectl apply on every push to main - C. Mirrors every manifest in the cluster into a new GitHub repository - D. Installs the Flux CLI on a GitHub-hosted runner for CI jobs **Answer:** Installs Flux and commits its manifests to a repo the cluster then syncs from **Explanation:** Bootstrap creates the repository if it doesn't exist, commits the Flux manifests under the path you choose, and configures the cluster to sync from that repository. From then on Flux manages itself from Git. Running bootstrap again with a newer CLI upgrades Flux. ### Which namespace does Flux install its controllers into by default? Flux CD, Easy (Beginner), Architecture. https://k8wiz.com/uquiz/which-namespace-does-flux-install-its-controllers-into-by-default - A. kube-system - B. flux-system - C. flux - D. gitops-system **Answer:** flux-system **Explanation:** Flux installs into flux-system by default, and bootstrap creates a GitRepository and a Kustomization, both named flux-system, in that namespace. You can pick a different namespace with --namespace. ### What does the interval field on a Flux Kustomization control? Flux CD, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/what-does-the-interval-field-on-a-flux-kustomization-control - A. How long the controller waits for all applied resources to become healthy - B. How many old revisions of the manifests the controller keeps - C. How often it is reconciled, even when nothing in the source has changed - D. How often the Git provider sends webhook events to the cluster **Answer:** How often it is reconciled, even when nothing in the source has changed **Explanation:** On every interval, kustomize-controller applies the latest artifact again and corrects any drift in the cluster. The source has its own interval, which controls how often Flux looks for new commits. How long to wait for readiness is spec.timeout. ### Which command makes Flux reconcile a Kustomization now instead of waiting for its interval? Flux CD, Easy (Beginner), Commands. https://k8wiz.com/uquiz/which-command-makes-flux-reconcile-a-kustomization-now-instead-of-waiting-for-its-interval - A. flux reconcile kustomization - B. flux sync kustomization - C. flux apply kustomization - D. flux refresh kustomization **Answer:** flux reconcile kustomization **Explanation:** 'flux reconcile' asks the controller to reconcile right away and waits for the result. Add --with-source to fetch the latest revision from the source first, which is what you usually want after a push. ### Someone changes a Flux-managed Deployment with kubectl edit. What happens? Flux CD, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/someone-changes-a-flux-managed-deployment-with-kubectl-edit-what-happens - A. Flux commits the change back to the Git repository - B. Flux stops managing the Deployment until someone undoes the change - C. Flux puts it back to the state in Git at the next reconciliation - D. Flux deletes the Deployment and waits for a new commit **Answer:** Flux puts it back to the state in Git at the next reconciliation **Explanation:** Git is the source of truth. On each reconciliation kustomize-controller applies the manifests with server-side apply, which resets the fields it manages. To change the Deployment for good, change it in Git. ### Which Flux custom resource installs and upgrades a Helm chart? Flux CD, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/which-flux-custom-resource-installs-and-upgrades-a-helm-chart - A. HelmRepository - B. HelmChart - C. Kustomization - D. HelmRelease **Answer:** HelmRelease **Explanation:** A HelmRelease names a chart and its values. helm-controller installs or upgrades the release with the Helm SDK, so 'helm list' still shows it. HelmRepository and HelmChart are sources that provide the chart. ### Which command lists Flux Kustomizations and whether each one is ready? Flux CD, Easy (Beginner), Commands. https://k8wiz.com/uquiz/which-command-lists-flux-kustomizations-and-whether-each-one-is-ready - A. flux list kustomizations - B. flux status kustomizations - C. flux show kustomizations - D. flux get kustomizations **Answer:** flux get kustomizations **Explanation:** 'flux get kustomizations' shows each Kustomization with its Ready status, the revision it applied and the last message. Add -A for all namespaces, or run 'flux get all' to include sources and Helm releases too. ### What does prune: true do on a Flux Kustomization? Flux CD, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/what-does-prune-true-do-on-a-flux-kustomization - A. Deletes objects from the cluster once you remove them from the source - B. Removes old revisions of the source artifact from source-controller's storage - C. Deletes pods that are stuck in a failed state - D. Removes unused container images from the nodes **Answer:** Deletes objects from the cluster once you remove them from the source **Explanation:** kustomize-controller keeps an inventory of the objects it applied. With prune enabled, an object that disappears from the source is deleted from the cluster on the next reconciliation. Without it, removed objects are left running. ### Which command pauses reconciliation of a Kustomization, for example during an incident? Flux CD, Easy (Beginner), Commands. https://k8wiz.com/uquiz/which-command-pauses-reconciliation-of-a-kustomization-for-example-during-an-incident - A. flux suspend kustomization - B. flux pause kustomization - C. flux stop kustomization - D. flux disable kustomization **Answer:** flux suspend kustomization **Explanation:** 'flux suspend' sets spec.suspend: true, so the controller stops reconciling the object and changes made by hand stay in place. 'flux resume' turns reconciliation back on and applies the source again. ### Which Flux source pulls manifests that were pushed to a container registry as an OCI artifact? Flux CD, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/which-flux-source-pulls-manifests-that-were-pushed-to-a-container-registry-as-an-oci-artifact - A. GitRepository - B. HelmRepository - C. OCIRepository - D. Bucket **Answer:** OCIRepository **Explanation:** OCIRepository pulls an OCI artifact from a registry such as GHCR or ECR. 'flux push artifact' packages a directory of manifests for this, so the cluster can pull from a registry instead of Git. Bucket is for S3-compatible object storage. ### Which Flux controller forwards alerts to Slack or Microsoft Teams when a reconciliation fails? Flux CD, Easy (Beginner), Integration. https://k8wiz.com/uquiz/which-flux-controller-forwards-alerts-to-slack-or-microsoft-teams-when-a-reconciliation-fails - A. source-controller - B. kustomize-controller - C. notification-controller - D. image-reflector-controller **Answer:** notification-controller **Explanation:** The other Flux controllers send their events to notification-controller. An Alert selects which events to forward, and a Provider says where they go, such as Slack, Microsoft Teams or a generic webhook. ### Where does helm-controller get the Helm charts it installs? Flux CD, Easy (Beginner), Architecture. https://k8wiz.com/uquiz/where-does-helm-controller-get-the-helm-charts-it-installs - A. From the local Helm cache of the person who created the release - B. From Flux sources such as a HelmRepository, OCIRepository or GitRepository - C. Only from Artifact Hub, which helm-controller queries directly - D. From charts uploaded to the cluster with a helm push command **Answer:** From Flux sources such as a HelmRepository, OCIRepository or GitRepository **Explanation:** helm-controller doesn't download charts itself. source-controller fetches them from a Helm repository, from an OCI registry, or from a chart directory in a Git repository or bucket, and helm-controller installs the result. ### How does a Flux Kustomization or HelmRelease report that its last reconciliation succeeded? Flux CD, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/how-does-a-flux-kustomization-or-helmrelease-report-that-its-last-reconciliation-succeeded - A. With a Success event on every pod it applied - B. With a fluxcd.io/synced label on the object - C. With a ConfigMap in flux-system holding the result - D. With a Ready condition set to True in its status **Answer:** With a Ready condition set to True in its status **Explanation:** Flux objects follow Kubernetes status conventions. Ready=True means the last reconciliation succeeded, and Ready=False comes with a reason and message. 'flux get' and 'kubectl wait --for=condition=Ready' both read this condition. ### What is Flux's status in the Cloud Native Computing Foundation? Flux CD, Easy (Beginner), Concepts. https://k8wiz.com/uquiz/what-is-fluxs-status-in-the-cloud-native-computing-foundation - A. A graduated project - B. A sandbox project - C. An incubating project - D. It is not a CNCF project **Answer:** A graduated project **Explanation:** Flux graduated in the CNCF in 2022, the foundation's highest maturity level. Graduated projects have passed a security audit and show broad production adoption. ### Which command prints the logs of the Flux controllers? Flux CD, Easy (Beginner), Commands. https://k8wiz.com/uquiz/which-command-prints-the-logs-of-the-flux-controllers - A. flux events --logs - B. flux debug controllers - C. flux get logs - D. flux logs **Answer:** flux logs **Explanation:** 'flux logs' gathers logs from the Flux controllers, and flags such as --level=error, --kind and --name narrow them to one object. 'flux events' shows the Kubernetes events recorded for Flux objects. ## Advanced (Medium): 20 questions Interactive quiz: https://k8wiz.com/fluxcd/quiz/medium ### A Kustomization must only be applied after another Kustomization that installs CRDs is ready. Which field do you set? Flux CD, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/a-kustomization-must-only-be-applied-after-another-kustomization-that-installs-crds-is-ready-which-field-do-you-set - A. spec.dependsOn - B. spec.healthChecks - C. spec.wait - D. spec.retryInterval **Answer:** spec.dependsOn **Explanation:** dependsOn lists Kustomizations that must have Ready=True before this one is applied. A common layout has an infrastructure Kustomization for CRDs and controllers, and an apps Kustomization that depends on it. HelmRelease has its own dependsOn. ### What does spec.wait: true do on a Flux Kustomization? Flux CD, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/what-does-specwait-true-do-on-a-flux-kustomization - A. Waits for every applied resource to be ready, and spec.healthChecks is ignored - B. Waits for the source to publish a new revision before applying any of the manifests - C. Waits for a manual approval before each new revision is applied - D. Waits for the previous Kustomization in the file to finish first **Answer:** Waits for every applied resource to be ready, and spec.healthChecks is ignored **Explanation:** With wait enabled, the Kustomization is only marked Ready once all applied objects pass their health checks within spec.timeout. healthChecks lets you name specific objects instead, but it's ignored when wait is true. ### How do you substitute a per-cluster value such as ${cluster_region} into the manifests a Flux Kustomization applies? Flux CD, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/how-do-you-substitute-a-per-cluster-value-such-as-cluster_region-into-the-manifests-a-flux-kustomization-applies - A. With a Helm values file referenced from the Kustomization - B. With environment variables set on the kustomize-controller Deployment's pods - C. With spec.postBuild.substitute, or substituteFrom a ConfigMap or Secret - D. With a Kustomize patch that runs envsubst on the files **Answer:** With spec.postBuild.substitute, or substituteFrom a ConfigMap or Secret **Explanation:** After building the manifests, kustomize-controller replaces ${var} with values from postBuild.substitute or from the ConfigMaps and Secrets in substituteFrom. ${var:=default} sets a fallback for a missing variable. ### How does Flux decrypt Secrets that are stored encrypted with SOPS in Git? Flux CD, Medium (Advanced), Security. https://k8wiz.com/uquiz/how-does-flux-decrypt-secrets-that-are-stored-encrypted-with-sops-in-git - A. source-controller decrypts the files while it clones the repository - B. A mutating webhook decrypts each Secret when it is created - C. The age private key is committed to the repository next to the encrypted files - D. The Kustomization sets spec.decryption to sops with a Secret holding the key **Answer:** The Kustomization sets spec.decryption to sops with a Secret holding the key **Explanation:** kustomize-controller decrypts SOPS files at build time with keys from the Secret in spec.decryption.secretRef, such as an entry ending in .agekey for age, or with cloud KMS credentials. The files stay encrypted in Git and in the source artifact. ### What does the --no-cross-namespace-refs=true flag on the Flux controllers do? Flux CD, Medium (Advanced), Security. https://k8wiz.com/uquiz/what-does-the-no-cross-namespace-refstrue-flag-on-the-flux-controllers-do - A. Stops Flux from applying resources outside the Kustomization's namespace - B. Hides Flux objects in other namespaces from the flux CLI - C. Stops Flux objects from referring to sources or objects in other namespaces - D. Blocks network traffic between pods in different namespaces **Answer:** Stops Flux objects from referring to sources or objects in other namespaces **Explanation:** Without the flag, a Kustomization in a tenant namespace can point at a GitRepository in another namespace. With it, references must stay in the object's own namespace, which is a key step in locking down a multi-tenant cluster. ### How can a Kustomization apply resources with a tenant's limited permissions instead of kustomize-controller's own? Flux CD, Medium (Advanced), Security. https://k8wiz.com/uquiz/how-can-a-kustomization-apply-resources-with-a-tenants-limited-permissions-instead-of-kustomize-controllers-own - A. Set spec.serviceAccountName, which the controller then impersonates - B. Set spec.targetNamespace, which limits the controller to that namespace - C. Add an RBAC Role to the GitRepository the Kustomization reads - D. Run a separate kustomize-controller in every tenant namespace **Answer:** Set spec.serviceAccountName, which the controller then impersonates **Explanation:** kustomize-controller impersonates the named ServiceAccount when applying, so the tenant can only create what that account's RBAC allows. Platform admins can set --default-service-account so Kustomizations without the field still get a restricted account. ### What does 'flux diff kustomization my-app --path ./apps/my-app' show? Flux CD, Medium (Advanced), Commands. https://k8wiz.com/uquiz/what-does-flux-diff-kustomization-my-app-path-appsmy-app-show - A. The differences between two branches or tags of the source Git repository - B. The changes Flux applied during its last two reconciliations - C. What would change in the cluster if the local manifests were applied - D. The difference between the Kustomization and its HelmReleases **Answer:** What would change in the cluster if the local manifests were applied **Explanation:** The command builds the local manifests the way the in-cluster Kustomization would, runs a server-side dry-run apply and prints the differences. Running it on a pull request shows reviewers the real effect before merging. ### How can a HelmRelease take its Helm values from a ConfigMap or Secret? Flux CD, Medium (Advanced), Integration. https://k8wiz.com/uquiz/how-can-a-helmrelease-take-its-helm-values-from-a-configmap-or-secret - A. Mount them into the helm-controller pod - B. Reference them from the chart's values.yaml - C. Set spec.values.configMapRef to their names - D. List them in spec.valuesFrom **Answer:** List them in spec.valuesFrom **Explanation:** valuesFrom merges values from the listed ConfigMaps and Secrets in order, and spec.values is merged on top. Keeping sensitive values in a Secret lets you encrypt them with SOPS instead of writing them into the HelmRelease. ### Which HelmRelease setting makes helm-controller retry a failed first install? Flux CD, Medium (Advanced), Troubleshooting. https://k8wiz.com/uquiz/which-helmrelease-setting-makes-helm-controller-retry-a-failed-first-install - A. spec.upgrade.remediation.retries - B. spec.rollback.retries - C. spec.install.remediation.retries - D. spec.maxHistory **Answer:** spec.install.remediation.retries **Explanation:** install.remediation.retries sets how many times to retry a failed install, uninstalling between attempts. upgrade.remediation does the same for upgrades. Both default to 0, so failures aren't retried unless you set them. ### What does driftDetection.mode: enabled do on a HelmRelease? Flux CD, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/what-does-driftdetectionmode-enabled-do-on-a-helmrelease - A. Detects new chart versions and upgrades the release automatically - B. Compares the release values with the chart's values.yaml in Git - C. Detects changes made in the cluster to the release's resources and reverts them - D. Blocks kubectl edits to resources owned by the release **Answer:** Detects changes made in the cluster to the release's resources and reverts them **Explanation:** helm-controller compares the manifest Helm stored with the cluster using a server-side dry-run apply. With mode: warn it only emits an event about the drift; with enabled it also patches the resources back. Without it, Helm only touches resources during an install or upgrade. ### Which Flux objects work together to update an image tag in Git when a new version is pushed to a registry? Flux CD, Medium (Advanced), Integration. https://k8wiz.com/uquiz/which-flux-objects-work-together-to-update-an-image-tag-in-git-when-a-new-version-is-pushed-to-a-registry - A. ImageRepository, ImagePolicy and ImageUpdateAutomation - B. OCIRepository, ImagePolicy and HelmRelease - C. ImageRepository, Receiver and GitRepository - D. GitRepository, Kustomization and Alert objects **Answer:** ImageRepository, ImagePolicy and ImageUpdateAutomation **Explanation:** image-reflector-controller scans registry tags for each ImageRepository and picks the newest allowed tag for each ImagePolicy. image-automation-controller's ImageUpdateAutomation then edits the marked fields in Git and commits, and Flux applies that commit like any other. ### How does image-automation-controller know which field in a YAML file to update? Flux CD, Medium (Advanced), Integration. https://k8wiz.com/uquiz/how-does-image-automation-controller-know-which-field-in-a-yaml-file-to-update - A. A Kustomize images entry that names the ImagePolicy - B. An annotation fluxcd.io/automated: "true" on the Deployment object - C. A # {"$imagepolicy": "flux-system:my-app"} comment on that line - D. Any field named image in the files under the update path **Answer:** A # {"$imagepolicy": "flux-system:my-app"} comment on that line **Explanation:** Setters are comments at the end of a line. The plain form updates the full image reference, and :tag or :name update just that part. Only marked fields under the automation's update path change. Flux v1 used the fluxcd.io/automated annotation, which current Flux ignores. ### An ImagePolicy should pick the newest 1.x release tag and ignore 2.0 and later. Which policy fits? Flux CD, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/an-imagepolicy-should-pick-the-newest-1x-release-tag-and-ignore-20-and-later-which-policy-fits - A. policy.alphabetical.order: asc - B. policy.numerical.order: asc - C. policy.semver.range: '>=1.0.0 <2.0.0' - D. filterTags.pattern: '^1.*' with no policy **Answer:** policy.semver.range: '>=1.0.0 <2.0.0' **Explanation:** A SemVer policy parses tags as versions and picks the highest one in the range, so 1.10.0 beats 1.9.0. Alphabetical ordering would rank 1.9.0 higher, and numerical policies need tags that are plain numbers, such as timestamps pulled out with filterTags.extract. ### How can a push to Git make Flux fetch the new commit right away instead of waiting for the GitRepository interval? Flux CD, Medium (Advanced), Integration. https://k8wiz.com/uquiz/how-can-a-push-to-git-make-flux-fetch-the-new-commit-right-away-instead-of-waiting-for-the-gitrepository-interval - A. Lower the GitRepository interval to 0 so source-controller polls nonstop - B. Run flux bootstrap from a CI job after every push - C. Create a Receiver and point the Git provider's webhook at its URL - D. Add a git.fluxcd.io/push annotation to the GitRepository **Answer:** Create a Receiver and point the Git provider's webhook at its URL **Explanation:** notification-controller serves a webhook path for each Receiver and shows it in status.webhookPath. When a verified event arrives, it asks for an immediate reconciliation of the objects listed in the Receiver. The webhook-receiver Service has to be reachable from the Git provider, for example through an Ingress. ### Which Flux setup reports deployment results back to GitHub as commit statuses? Flux CD, Medium (Advanced), Integration. https://k8wiz.com/uquiz/which-flux-setup-reports-deployment-results-back-to-github-as-commit-statuses - A. A Receiver of type github with its status field enabled - B. The --commit-status flag on flux bootstrap github - C. A GitHub Action that polls flux get kustomizations - D. An Alert that sends Kustomization events to a Provider of type github **Answer:** An Alert that sends Kustomization events to a Provider of type github **Explanation:** Providers such as github, gitlab, gitea and bitbucket support commit status updates. Flux marks the commit it applied as succeeded or failed based on the Kustomization's events, so the Git UI shows whether a commit reached the cluster. ### You delete a Flux Kustomization that has prune: true and no deletionPolicy. What happens to the objects it applied? Flux CD, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/you-delete-a-flux-kustomization-that-has-prune-true-and-no-deletionpolicy-what-happens-to-the-objects-it-applied - A. They are deleted from the cluster - B. They stay and are adopted by flux-system - C. They stay, but drift is no longer corrected - D. They are moved into the flux-system namespace **Answer:** They are deleted from the cluster **Explanation:** The default deletion policy, MirrorPrune, follows prune: with prune: true, kustomize-controller garbage-collects everything in the Kustomization's inventory before the object goes away. Set spec.deletionPolicy: Orphan to keep the objects. ### Which file in a Git repository tells source-controller to leave files out of the artifact it builds? Flux CD, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/which-file-in-a-git-repository-tells-source-controller-to-leave-files-out-of-the-artifact-it-builds - A. .fluxignore - B. .sourceignore - C. .helmignore - D. .dockerignore **Answer:** .sourceignore **Explanation:** A .sourceignore file uses .gitignore syntax, and the GitRepository's spec.ignore field does the same from the cluster side. Leaving out CI workflows and docs matters when a Kustomization would otherwise try to apply every YAML file under its path. ### How can a HelmRelease install a chart that is stored in an OCI registry? Flux CD, Medium (Advanced), Integration. https://k8wiz.com/uquiz/how-can-a-helmrelease-install-a-chart-that-is-stored-in-an-oci-registry - A. Set spec.values.repository to the oci:// address of the chart - B. Run helm pull in an init container of helm-controller - C. Point spec.chartRef at an OCIRepository that holds the chart - D. Mirror the chart to a Git repository first, since OCI isn't supported **Answer:** Point spec.chartRef at an OCIRepository that holds the chart **Explanation:** An OCIRepository pulls the chart artifact and the HelmRelease's chartRef names it. The release then follows the tag, semver range or digest set on the OCIRepository, and the chart's signature can be checked with Cosign or Notation first. ### A GitRepository sets both ref.branch: main and ref.tag: v1.2.0. Which one does Flux check out? Flux CD, Medium (Advanced), Concepts. https://k8wiz.com/uquiz/a-gitrepository-sets-both-refbranch-main-and-reftag-v120-which-one-does-flux-check-out - A. The branch, because it is listed first - B. Neither, because the object then fails API validation - C. Whichever of the two changed most recently - D. The tag, because tag takes precedence over branch **Answer:** The tag, because tag takes precedence over branch **Explanation:** When several ref fields are set, the later ones in the order branch, tag, semver, name, commit take precedence. commit pins an exact SHA and wins over everything else. ### A Deployment keeps changing and you don't know which Flux object manages it. Which command tells you? Flux CD, Medium (Advanced), Troubleshooting. https://k8wiz.com/uquiz/a-deployment-keeps-changing-and-you-dont-know-which-flux-object-manages-it-which-command-tells-you - A. flux tree deployment -n - B. flux trace deployment -n - C. flux owner deployment -n - D. flux get sources --for deployment/ **Answer:** flux trace deployment -n **Explanation:** 'flux trace' follows the labels Flux puts on applied objects back to the Kustomization or HelmRelease that applied it, and on to the source and revision. 'flux tree kustomization ' goes the other way and lists everything a Kustomization manages. ## Expert (Hard): 20 questions Interactive quiz: https://k8wiz.com/fluxcd/quiz/hard ### What does the annotation kustomize.toolkit.fluxcd.io/ssa: IfNotPresent do on an object in a Flux source? Flux CD, Hard (Expert), Concepts. https://k8wiz.com/uquiz/what-does-the-annotation-kustomizetoolkitfluxcdiossa-ifnotpresent-do-on-an-object-in-a-flux-source - A. Flux applies the object only when Helm doesn't already manage it - B. Flux skips the object until its namespace has been created - C. Flux creates the object if it doesn't exist and never updates it afterwards - D. Flux applies only the fields that are missing from the live object **Answer:** Flux creates the object if it doesn't exist and never updates it afterwards **Explanation:** IfNotPresent suits objects that other controllers change after creation, such as Secrets and webhook configurations that cert-manager fills in. Merge keeps fields added by other tools when they don't overlap, Ignore skips the object, and the default, Override, applies the state from the source. ### A change to an immutable field makes Flux's apply of a Job fail. Which annotation on the Job tells Flux to delete and recreate it? Flux CD, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/a-change-to-an-immutable-field-makes-fluxs-apply-of-a-job-fail-which-annotation-on-the-job-tells-flux-to-delete-and-recreate-it - A. kustomize.toolkit.fluxcd.io/ssa: Merge - B. kustomize.toolkit.fluxcd.io/prune: disabled - C. kustomize.toolkit.fluxcd.io/reconcile: disabled - D. kustomize.toolkit.fluxcd.io/force: enabled **Answer:** kustomize.toolkit.fluxcd.io/force: enabled **Explanation:** With force enabled on an object, kustomize-controller recreates it when an apply fails on an immutable field. Setting spec.force: true on the Kustomization does the same for every object it applies, which is broader than most cases need. ### A GitRepository has no ref field, and the repository's default branch is main. What does Flux check out? Flux CD, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/a-gitrepository-has-no-ref-field-and-the-repositorys-default-branch-is-main-what-does-flux-check-out - A. The repository's default branch, main - B. The newest tag in the repository - C. The master branch, the default when no ref is set - D. The commit that the remote HEAD points to on the server **Answer:** The master branch, the default when no ref is set **Explanation:** When spec.ref is empty, source-controller uses a branch named master. If the repository only has main, the GitRepository fails until you set ref.branch: main. flux bootstrap sets the branch for you, so this mostly catches hand-written GitRepository objects. ### kustomize-controller can't tell when a custom resource from a third-party operator is healthy. How do you teach it? Flux CD, Hard (Expert), Concepts. https://k8wiz.com/uquiz/kustomize-controller-cant-tell-when-a-custom-resource-from-a-third-party-operator-is-healthy-how-do-you-teach-it - A. List the CRD in spec.healthChecks with a longer timeout - B. Add spec.healthCheckExprs with CEL expressions for that kind - C. Annotate the CRD with kustomize.toolkit.fluxcd.io/health: ready - D. Set spec.wait: false so the resource counts as healthy **Answer:** Add spec.healthCheckExprs with CEL expressions for that kind **Explanation:** Flux judges health with kstatus, which understands standard conditions but not every operator's status format. Each healthCheckExprs entry matches an API group and kind and gives CEL expressions: current for ready, and optionally inProgress and failed. ### You want to delete a Flux Kustomization but keep the workloads it created running. Which field do you set first? Flux CD, Hard (Expert), Concepts. https://k8wiz.com/uquiz/you-want-to-delete-a-flux-kustomization-but-keep-the-workloads-it-created-running-which-field-do-you-set-first - A. spec.deletionPolicy: Delete - B. spec.deletionPolicy: WaitForTermination - C. spec.wait: false - D. spec.deletionPolicy: Orphan **Answer:** spec.deletionPolicy: Orphan **Explanation:** Orphan leaves the managed objects in place when the Kustomization is deleted. The default, MirrorPrune, deletes them when prune is true. Delete always deletes them, and WaitForTermination also waits for them to be gone. If a parent Kustomization still has this one in Git, it is recreated on the next reconciliation. ### In a CI job, 'flux diff kustomization' exits with status 1. What does that mean? Flux CD, Hard (Expert), Testing. https://k8wiz.com/uquiz/in-a-ci-job-flux-diff-kustomization-exits-with-status-1-what-does-that-mean - A. It couldn't reach the cluster, so the diff failed - B. The local manifests failed Kustomize validation - C. It found differences between the local manifests and the cluster - D. It found no differences, so there is nothing left for Flux to apply **Answer:** It found differences between the local manifests and the cluster **Explanation:** flux diff exits with 0 when there are no differences, 1 when it finds some, and above 1 when the diff itself fails. A CI step that fails on any non-zero exit will fail on every pull request that changes something, so treat only codes above 1 as errors. ### A chart ships CRDs in its crds/ directory, and the HelmRelease has no crds settings. What happens to those CRDs on upgrade? Flux CD, Hard (Expert), Concepts. https://k8wiz.com/uquiz/a-chart-ships-crds-in-its-crds-directory-and-the-helmrelease-has-no-crds-settings-what-happens-to-those-crds-on-upgrade - A. They are replaced with the versions in the new chart - B. They are skipped on both install and upgrade - C. New CRDs are created, but existing ones aren't updated - D. They are deleted and recreated from the new chart **Answer:** New CRDs are created, but existing ones aren't updated **Explanation:** Create is the default for both install.crds and upgrade.crds: missing CRDs are created and existing ones are left alone, following Helm's caution about CRD changes. Set CreateReplace to update CRDs on upgrade. Flux doesn't delete CRDs that disappear from a chart. ### How many Helm release revisions does helm-controller keep for a HelmRelease that doesn't set maxHistory? Flux CD, Hard (Expert), Architecture. https://k8wiz.com/uquiz/how-many-helm-release-revisions-does-helm-controller-keep-for-a-helmrelease-that-doesnt-set-maxhistory - A. 10 - B. 1 - C. No limit - D. 5 **Answer:** 5 **Explanation:** helm-controller keeps 5 revisions by default, half of the Helm CLI's default of 10. Older revision Secrets are removed after each upgrade. Setting maxHistory: 0 keeps every revision, which the Flux docs advise against for performance reasons. ### A HelmRelease sets upgrade.remediation.retries: 3 and nothing else under remediation. What happens between failed upgrade attempts? Flux CD, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/a-helmrelease-sets-upgraderemediationretries-3-and-nothing-else-under-remediation-what-happens-between-failed-upgrade-attempts - A. helm-controller uninstalls the release and installs it again - B. Nothing, and the release stays failed until the next commit - C. helm-controller rolls the release back, the default strategy - D. helm-controller deletes the release's pods so they restart **Answer:** helm-controller rolls the release back, the default strategy **Explanation:** Between attempts helm-controller remediates with upgrade.remediation.strategy, which defaults to rollback. Set uninstall to remove and reinstall instead. remediateLastFailure defaults to true once retries is above 0, so the final failure is rolled back too. ### How does notification-controller build the webhook URL path for a Receiver? Flux CD, Hard (Expert), Security. https://k8wiz.com/uquiz/how-does-notification-controller-build-the-webhook-url-path-for-a-receiver - A. /hook/ followed by a hash of the token, Receiver name and namespace - B. /hook//, with the token sent as a query string - C. /webhook/ on port 9292 of the controller - D. A random path generated once when the Receiver is created **Answer:** /hook/ followed by a hash of the token, Receiver name and namespace **Explanation:** The path is /hook/ plus a SHA-256 digest of the token from the Receiver's Secret combined with its name and namespace, and it is shown in status.webhookPath. Rotating the token changes the URL, so update the webhook in your Git provider when you rotate it. ### A HelmRelease's chartRef points at an OCIRepository holding a Helm chart. How should the OCIRepository's layerSelector handle the chart layer? Flux CD, Hard (Expert), Architecture. https://k8wiz.com/uquiz/a-helmreleases-chartref-points-at-an-ocirepository-holding-a-helm-chart-how-should-the-ocirepositorys-layerselector-handle-the-c - A. Select the Helm chart media type with operation: extract - B. Select the Helm chart media type with operation: copy - C. Leave layerSelector out, since charts are always copied - D. Select the image config layer with operation: copy **Answer:** Select the Helm chart media type with operation: copy **Explanation:** layerSelector picks a layer by media type, here application/vnd.cncf.helm.chart.content.v1.tar+gzip. The default operation, extract, unpacks the layer; copy keeps the chart tarball unchanged, which is how the HelmRelease docs configure it. Without a layerSelector, the first layer is extracted. ### How can you make Flux refuse an OCI artifact that wasn't signed by your CI pipeline? Flux CD, Hard (Expert), Security. https://k8wiz.com/uquiz/how-can-you-make-flux-refuse-an-oci-artifact-that-wasnt-signed-by-your-ci-pipeline - A. Set spec.insecure: false, which turns on signature checks - B. Add a Kyverno verifyImages policy that targets the flux-system namespace - C. Set spec.verify on the OCIRepository with provider cosign or notation - D. Enable commit signing on the Kustomization's sourceRef **Answer:** Set spec.verify on the OCIRepository with provider cosign or notation **Explanation:** With spec.verify, source-controller checks the Cosign or Notation signature before it produces an artifact, so no Kustomization or HelmRelease sees unsigned content. For keyless Cosign signatures from CI, matchOIDCIdentity pins the expected issuer and subject. ### Which GitRepository setting makes Flux check that the tag it checks out was signed with a trusted PGP key? Flux CD, Hard (Expert), Security. https://k8wiz.com/uquiz/which-gitrepository-setting-makes-flux-check-that-the-tag-it-checks-out-was-signed-with-a-trusted-pgp-key - A. spec.verify.mode: Tag, with a secretRef to the public keys - B. spec.ref.tag together with a signed: true field under spec.ref - C. spec.verify.mode: HEAD, using the deploy key - D. spec.ignore with a pattern for unsigned tags **Answer:** spec.verify.mode: Tag, with a secretRef to the public keys **Explanation:** verify.mode chooses what to check: HEAD checks the commit that was checked out, Tag checks the tag object, and TagAndHEAD checks the tag and the commit it points to. The Secret holds the trusted public keys. If verification fails, no new revision reaches the cluster. ### One kustomize-controller can't keep up with thousands of Kustomizations. How does Flux split the work? Flux CD, Hard (Expert), Architecture. https://k8wiz.com/uquiz/one-kustomize-controller-cant-keep-up-with-thousands-of-kustomizations-how-does-flux-split-the-work - A. More replicas of the Deployment, which share objects through leader election - B. Extra controller instances, each with --watch-label-selector for one sharding.fluxcd.io/key value - C. One controller per namespace, which Flux starts on its own - D. A spec.shard field on each Kustomization naming a controller pod **Answer:** Extra controller instances, each with --watch-label-selector for one sharding.fluxcd.io/key value **Explanation:** You label Flux objects with sharding.fluxcd.io/key, run additional controller instances that only watch their shard through --watch-label-selector, and make the main instance skip those labels. Extra replicas of one Deployment don't help, because only the leader reconciles. ### What does 'flux reconcile kustomization my-app' change on the object to trigger a reconciliation? Flux CD, Hard (Expert), Architecture. https://k8wiz.com/uquiz/what-does-flux-reconcile-kustomization-my-app-change-on-the-object-to-trigger-a-reconciliation - A. It deletes the Kustomization and immediately creates it again from the same spec - B. It bumps metadata.generation by rewriting spec.interval - C. It sends a webhook event to notification-controller - D. It sets the reconcile.fluxcd.io/requestedAt annotation to the current time **Answer:** It sets the reconcile.fluxcd.io/requestedAt annotation to the current time **Explanation:** Flux controllers reconcile as soon as the reconcile.fluxcd.io/requestedAt annotation changes. The CLI sets it and waits until the status shows the request was handled. A script can trigger the same thing with kubectl annotate --overwrite. ### A ConfigMap applied by a Flux Kustomization holds a shell script using ${HOME}, and postBuild substitution blanks it out. What stops that? Flux CD, Hard (Expert), Troubleshooting. https://k8wiz.com/uquiz/a-configmap-applied-by-a-flux-kustomization-holds-a-shell-script-using-home-and-postbuild-substitution-blanks-it-out-what-stops - A. Wrapping the variable in single quotes, as '${HOME}', in the YAML - B. Storing the script in a Secret instead of a ConfigMap - C. Annotating it with kustomize.toolkit.fluxcd.io/substitute: disabled - D. Writing the variable name in lower case so Flux skips it **Answer:** Annotating it with kustomize.toolkit.fluxcd.io/substitute: disabled **Explanation:** postBuild substitution replaces every ${var} in the built manifests, and an undefined variable without a default becomes an empty string. The substitute: disabled annotation skips the object. You can also write $HOME without braces, or $${HOME}, which comes out as ${HOME}. ### A HelmRelease in flux-system sets targetNamespace: apps and no storageNamespace. Where does Helm keep the release's storage Secrets? Flux CD, Hard (Expert), Architecture. https://k8wiz.com/uquiz/a-helmrelease-in-flux-system-sets-targetnamespace-apps-and-no-storagenamespace-where-does-helm-keep-the-releases-storage-secrets - A. In apps, the target namespace - B. In flux-system, the HelmRelease's own namespace - C. In kube-system, where Helm 2 kept releases - D. In default, unless the chart sets one **Answer:** In flux-system, the HelmRelease's own namespace **Explanation:** storageNamespace defaults to the namespace of the HelmRelease, not targetNamespace, so 'helm list -n flux-system' shows the release and 'helm list -n apps' doesn't. Decide on storageNamespace before the first install, because the docs warn against changing it on an existing release. ### How can an OCIRepository authenticate to Amazon ECR without a static registry password? Flux CD, Hard (Expert), Security. https://k8wiz.com/uquiz/how-can-an-ocirepository-authenticate-to-amazon-ecr-without-a-static-registry-password - A. Set spec.secretRef to the ARN of the node's IAM role - B. Set spec.insecure: true so no credentials are needed - C. Set spec.provider: aws so source-controller uses the cloud identity - D. Set spec.provider: generic and grant the node's IAM role access to ECR **Answer:** Set spec.provider: aws so source-controller uses the cloud identity **Explanation:** With provider aws, azure or gcp, source-controller gets registry credentials from the cloud's workload identity instead of a Secret. The default, generic, uses a Secret or anonymous access. ImageRepository supports the same provider field for scanning private registries. ### You need to add a label to a Deployment that a third-party chart renders, and the chart has no value for it. What does a HelmRelease offer? Flux CD, Hard (Expert), Integration. https://k8wiz.com/uquiz/you-need-to-add-a-label-to-a-deployment-that-a-third-party-chart-renders-and-the-chart-has-no-value-for-it-what-does-a-helmrelea - A. spec.postRenderers with Kustomize patches applied to the rendered manifests - B. spec.values with a commonLabels key that Helm merges into every rendered object - C. A patch in the parent Kustomization that targets the HelmRelease - D. spec.chart.spec.valuesFiles pointing at a patch file **Answer:** spec.postRenderers with Kustomize patches applied to the rendered manifests **Explanation:** Post-renderers run on the manifests Helm rendered, before they're applied, so you can patch fields the chart doesn't expose. A patch on the HelmRelease object itself only changes its spec, not the resources the chart creates. ### What permissions does the deploy key created by 'flux bootstrap github' have by default? Flux CD, Hard (Expert), Security. https://k8wiz.com/uquiz/what-permissions-does-the-deploy-key-created-by-flux-bootstrap-github-have-by-default - A. Read-only, unless you pass --read-write-key - B. Read and write, so image automation can push - C. Admin, so Flux can manage the repository's webhooks - D. None, because bootstrap always uses your token **Answer:** Read-only, unless you pass --read-write-key **Explanation:** Bootstrap creates an SSH deploy key with read-only access, which is all syncing needs. Image update automation has to push commits, so it needs --read-write-key or separate credentials. With --token-auth, Flux uses the token over HTTPS instead of a deploy key.