kernelry
PricingSign in
Delivery & GitOps8 min read•September 2026•Kernelry Staff

CI/CD Pipelines & GitOps Delivery Interview Scenarios

Continuous Integration and Continuous Delivery have evolved from shell scripts on Jenkins servers into declarative GitOps pipelines and progressive delivery controllers. Production-grade delivery requires deep mastery of immutable container tags, cryptographic signing, automated rollback triggers, and multi-environment drift reconciliation.

Architecture Blueprint

GitOps Pull-Based Reconciliation & Canary Rollout Flow

Tracing how Git commits trigger CI verification, OCI image signing, ArgoCD pull reconciliation, and metric-analyzed canary traffic shifts.

Architecture Blueprint: GitOps Pull Reconciliation & Canary RolloutDelivery Pipeline
01Git RepositorySingle Source of Truth02CI Build & SignTest & Cosign Image03OCI RegistryImmutable Digest (sha256)04ArgoCD EnginePull Reconciliation LoopAutomated Progressive Canary DeliveryRoute 10% traffic to canary • Monitor P99 latency, error budgets & 5xx error ratePass = Promote canary to 100% rollout • Fail = Instant automated rollback
The Core Concept

GitOps means using your Git repository as the single source of truth for your production infrastructure. Instead of pushing changes directly to clusters from CI runners, an in-cluster agent (like ArgoCD) continuously monitors Git and pulls updates to match the desired state.

Key Rules of Thumb for Production Systems

•Pull-based GitOps (ArgoCD/Flux) is more secure than push-based CI: the cluster pulls changes from Git, so your CI runner never needs cluster admin credentials.
•Never deploy mutable image tags like :latest. Always deploy immutable SHA-256 digests or Git commit SHA tags.
•Progressive delivery pairs canary traffic shifting with real-time metrics (P99 latency, 5xx rate) to trigger automatic rollbacks without human delays.
•Separate your application code repository from your deployment configuration repository to avoid infinite CI trigger loops.

Why Production Systems Demand This Depth

Shipping code safely at scale requires deterministic pipelines. Preventing a broken commit from impacting 100% of users requires canary deployments, metric-driven rollbacks, and pull-based GitOps controllers like ArgoCD or Flux.

Common Diagnostic Pitfalls

  • •Granting CI runners full cluster-admin credentials to push deployments (violating least-privilege principles).
  • •Using mutable image tags like ":latest" or ":v1" which prevent reliable rollbacks and deterministic reproduces.
  • •Lacking automated rollback criteria, forcing humans to notice outages on Twitter before initiating rollbacks.
  • •Mixing application source code and deployment manifests in the same repository, leading to recursive build triggers.

Best Practices for Scenario Drills

  • •Highlight the difference between push-based CI/CD (Jenkins/GitHub Actions applying to cluster) and pull-based GitOps (ArgoCD inside cluster pulling from Git).
  • •Discuss DORA metrics: Deployment Frequency, Lead Time for Changes, Change Failure Rate, and Mean Time to Recovery (MTTR).
  • •Explain how Flagger or Argo Rollouts analyzes Prometheus metrics to automate canary promotions.

Worked Production Scenarios

Worked Production Scenarios

Study real-world outage patterns, diagnostic trees, and clarifying questions.

#1

Designing a Zero-Downtime Canary Rollout with Automated Rollback

Difficulty: senior

Scenario Prompt:

“You are designing the deployment pipeline for an e-commerce checkout service. Management demands zero downtime and automated rollbacks if error rates exceed 0.5% during rollouts. How do you architect this using progressive delivery?”

Substantive Technical Concepts to Hit:

Traffic Shifting via Service Mesh / Ingress

Use Argo Rollouts or Flagger with Envoy/Istio to split traffic: start by routing 5% of requests to the canary pod fleet while 95% remains on stable.

Automated Metric Analysis

Query Prometheus every 60 seconds to measure the HTTP 5xx error rate and P99 latency of the canary pods specifically compared against the baseline stable pods.

Automated Rollback Trigger

If the canary error rate exceeds the 0.5% threshold for 2 consecutive measurement cycles, instantly terminate the canary and shift 100% traffic back to stable.

Progressive Promotion

If all metric checks pass, gradually increase traffic (5% -> 20% -> 50% -> 100%) before retiring the old replica set.

Senior Clarifying Questions to Investigate:
  • What ingress controller or service mesh (Envoy, NGINX, or AWS ALB) will manage the traffic splitting weights?
  • Is the service stateless, or does it require database schema migrations that could break backward compatibility?
  • What Prometheus metric interval is statistically significant for our traffic volume to prevent false-positive rollbacks?
#2

Resolving GitOps State Drift and Out-of-Sync Ingestion Loops

Difficulty: mid

Scenario Prompt:

“An ArgoCD application managing production shows an "OutOfSync" status. A developer manually edited a live Deployment replicas count via kubectl during an incident, but Git still specifies the old count. How do you resolve this and prevent future drift?”

Substantive Technical Concepts to Hit:

Understanding Drift Mechanisms

ArgoCD detected a mismatch between the desired state in Git (e.g. replicas: 3) and the actual live state in the cluster (replicas: 8).

Auto-Sync & Self-Heal

If selfHeal is enabled, ArgoCD automatically overwrites manual cluster edits with the Git state. If disabled, it flags OutOfSync for operator intervention.

HPA and Replicas Conflict

If an HPA manages replicas, remove the replicas field from the Git Deployment manifest to prevent ArgoCD and the HPA from constantly fighting over replica counts.

RBAC Enforcement

Lock down developer permissions in production using Kubernetes RBAC so all mutations must pass through audited Git Pull Requests.

Senior Clarifying Questions to Investigate:
  • Was the manual scaling intended to be permanent, requiring an immediate Git PR update?
  • Is an Horizontal Pod Autoscaler (HPA) attached to this deployment causing a reconciliation conflict?
  • Is ArgoCD configured for automated self-healing or manual sync approval in this environment?
Interactive Scenario Drills

That's where we come in.

Explaining architectural trade-offs under time constraints is very different from reading about them.

Kernelry helps you rehearse technical questions, evidence-led debugging, safe next steps, and the clear communication teams expect. The drills adapt to your answer, so you practice the reasoning rather than memorize a company-specific script. During early access, free accounts include ten daily scenarios across our mixed question pool, with no credit card required.

Start Today's Free Drill
Back to All Blog Posts