Study notes · 7% of the exam

Helm, GitOps, CRDs and Operators

The Kubernetes ecosystem packages, delivers and extends what the core API offers: Helm and Kustomize shape manifests, GitOps controllers keep clusters in sync with Git, and CRDs plus controllers (operators) add new APIs with their own reconcile loops.

Key points

1
Helm values precedence, lowest to highest: chart values.yaml, parent chart values, each -f file (rightmost wins), then --set. Releases are stored as Secrets in the release namespace, and a rollback creates a new revision.
2
Helm installs CRDs from crds/ only on first install and never upgrades or deletes them; upgrade CRDs in a separate step or chart.
3
Pull-based GitOps (Argo CD, Flux) keeps cluster credentials inside the cluster. CI builds images and updates Git; the agent pulls and reconciles.
4
Argo CD automated sync neither prunes nor self-heals by default: enable prune and selfHeal explicitly. Use sync waves and ignoreDifferences to order resources and share fields with other controllers.
5
Controllers are level-triggered: reconcile must be idempotent, tolerate a stale informer cache, and use deterministic names, owner references and finalizers.
6
With the status subresource, spec and status are written through separate endpoints, and metadata.generation tracks spec changes; report progress with status.observedGeneration and conditions.
7
Admission runs mutating webhooks first and validating webhooks last. A failurePolicy: Fail webhook that can't reach its server can block the whole cluster.

Common traps

lookup returns nothing under helm template, so "create only if missing" logic always fires in GitOps tools that render charts.
A finalizer whose controller was uninstalled leaves objects stuck in Terminating forever.
Keeping replicas in Git while an HPA scales the Deployment makes self-heal fight the autoscaler.

Read the source

Test yourself on Helm, GitOps, CRDs and Operators

Ten questions, with the answer and explanation after each one.