Master Collection

What is CI/CD and what core problems does it solve?

CI/CD stands for Continuous Integration and Continuous Delivery/Deployment. It automates the building, testing, packaging, and deployment of software to eliminate manual human errors, reduce release cycle times from months to minutes, catch integration bugs early, and ensure code in main is always production-ready.

What is Continuous Integration (CI)?

The practice where developers frequently commit code to a shared repository (multiple times daily). Each commit triggers automated builds, linters, and unit/integration tests to provide immediate feedback on code health.

What is Continuous Delivery (CD)?

An extension of CI where code is automatically built, tested, and staged in a production-ready state. Deploying to live production requires an explicit manual business approval (e.g., clicking a button).

What is Continuous Deployment (CD)?

The fully automated release practice where every commit that passes all automated pipeline tests is deployed directly into production with zero human intervention.

What are the key stages of a production CI/CD pipeline?

1. Source Trigger (webhook), 2. Static Analysis & Linting (SAST, secret scanning), 3. Build & Compilation, 4. Unit & Integration Testing, 5. Artifact Packaging & Signing (Docker, SBOM, Cosign), 6. Staging Deployment & DAST/E2E Testing, 7. Production Progressive Rollout (Canary/GitOps).

What is an Artifact in CI/CD?

The compiled, packaged, immutable deployable unit produced by a build pipeline (Docker image, JAR, NPM package, Helm chart) that is promoted across environments.

What is the "Build Once, Deploy Anywhere" principle?

The architectural rule that code is compiled and packaged into an immutable container/binary once during CI, and the exact same binary is deployed to Dev, Staging, and Production by injecting environment-specific configs at runtime.

What is a Build Matrix in CI/CD?

A configuration that spawns multiple parallel pipeline jobs across combinations of operating systems (Ubuntu, macOS, Windows) and runtime versions (Node 18, 20, 22).

What is Pipeline Caching vs Artifact Storage?

Caching stores temporary dependencies (node_modules, Maven caches) to speed up subsequent builds; Artifact Storage persists output binaries and compliance test reports long-term.

What is Semantic Versioning (SemVer)?

Formatting release versions as MAJOR.MINOR.PATCH (e.g., 2.4.1) where MAJOR indicates breaking changes, MINOR indicates backward-compatible features, and PATCH indicates bug fixes.

What are Conventional Commits?

A structured commit message specification (feat:, fix:, chore:, feat!:) that enables automated tools (Semantic Release) to calculate version bumps and generate changelogs.

What is a Linter and why must it run early?

A static analysis tool checking code formatting, syntax errors, and style rules without running code. Running linters first provides sub-minute feedback and saves expensive build compute minutes.

What is Secret Masking in CI/CD?

Automatically detecting registered secret strings in pipeline logs and replacing them with *** to prevent accidental credential leakage in build logs.

What is a Webhook in CI/CD?

An HTTP POST callback sent from a Git repository (GitHub/GitLab) to a CI server upon events (push, pull_request_opened) to trigger immediate pipeline execution.

What are Ephemeral / Preview Environments?

Short-lived, isolated environments spun up automatically when a Pull Request is opened and destroyed upon merge or closure, allowing live feature testing.

What is a Blue-Green Deployment?

Running two identical production environments (Blue and Green) where live traffic is routed to Blue while Green is tested, switching traffic instantly via load balancer upon validation.

What is a Canary Deployment?

Rolling out a release to a small fraction of real users (e.g., 5%), monitoring error rates and latency, and incrementally shifting traffic to 100% if healthy.

What is Dark Launching?

Deploying backend code to production completely hidden behind feature flags to validate performance and database queries under live load without exposing UI features.

What is a Feature Flag (Toggle)?

A conditional code branch that decouples code deployment from feature release, enabling features to be enabled/disabled instantly via an API or management UI.

What is Trunk-Based Development?

A branching strategy where developers merge small, frequent commits into a single shared branch (main), enabling continuous integration and fast delivery.

What is GitFlow?

A branching model with long-lived branches (develop, feature, release, hotfix, master) that often leads to merge conflicts and slow delivery cycles.

What is Static Application Security Testing (SAST)?

Whitebox security testing that scans uncompiled source code for vulnerabilities (SQL injection, buffer overflows, insecure cryptography) before compilation.

What is Dynamic Application Security Testing (DAST)?

Blackbox security testing that attacks a running application from the outside to discover runtime vulnerabilities, authentication bypasses, and misconfigurations.

What is Software Composition Analysis (SCA)?

Scanning open-source third-party dependencies against national vulnerability databases (NVD) for known CVEs.

What is Mutation Testing in CI?

Introducing small intentional bugs (mutations) into source code to verify if unit tests fail; if tests pass, test assertions are weak.

What is Concurrency Control in CI/CD?

Canceling obsolete in-progress pipeline runs on pull request branches when a newer commit is pushed (cancel-in-progress: true), saving compute resources.

What is a Merge Queue in GitHub?

An automated system that tests pull requests in an integrated sequential train against the anticipated merge result of prior queued PRs to ensure main never breaks.

What is Self-Hosted Runner vs Cloud-Hosted Runner?

Cloud-hosted runners are fully managed VMs by GitHub/GitLab; Self-hosted runners run in private VPCs with custom hardware, GPUs, and private network access.

What is Actions Runner Controller (ARC)?

A Kubernetes operator that deploys and autoscales ephemeral GitHub Actions runner pods on Kubernetes based on webhook events.

What is OIDC (OpenID Connect) in CI/CD?

Federated authentication allowing CI runners to request short-lived, temporary cloud credentials (AWS STS / GCP IAM) using JWT tokens without static API keys.

What is an SBOM (Software Bill of Materials)?

A formal, machine-readable nested inventory of all software packages, libraries, and transitive dependencies bundled inside a software container or binary.

What is Sigstore Cosign?

An open-source tool for cryptographically signing and verifying container images in OCI registries using keyless OIDC tokens.

What is the SLSA Framework?

Supply-chain Levels for Software Artifacts—a security framework defining standards for build platform isolation, non-falsifiable provenance, and source integrity.

What is Hermetic Build?

A build executed in a sandboxed container with zero outbound internet access, ensuring all dependencies are pre-fetched and cryptographically hashed for 100% reproducibility.

What is Docker BuildKit layer caching?

Caching intermediate container build layers in remote OCI registries, allowing ephemeral CI runners to reuse cached layers across independent builds.

What is SonarQube Quality Gate?

A policy enforcing code quality thresholds (e.g., coverage $\ge 80%$, 0 critical vulnerabilities) that blocks PR merges if not satisfied.

What is Code Coverage?

The percentage of application source code executed when automated test suites run (measured via tools like JaCoCo, Istanbul, pytest-cov).

What is Pipeline as Code?

Defining CI/CD workflows, build steps, and environment targets in declarative version-controlled files (.github/workflows/*.yml, .gitlab-ci.yml, Jenkinsfile).

What is a Monorepo CI Strategy?

Using path filtering and change-dependency graph tools (Turborepo, Nx, Bazel) so commits only rebuild and test the specific microservices modified.

What is a Pull-Through Cache?

A local container registry (Harbor, AWS ECR Pull Through Cache) that caches public images locally inside the VPC, eliminating external rate limits.

What is Automated Canary Analysis (ACA)?

Using automated statistical telemetry queries (Prometheus, Datadog) to compare canary error rates against baseline pods and trigger automatic rollbacks on anomalies.

What is Flagger?

A CNCF progressive delivery Kubernetes operator that automates canary routing and metric analysis using Istio, Linkerd, or Nginx Ingress.

What is Argo Rollouts?

A Kubernetes controller providing advanced deployment capabilities (Canary, Blue-Green, experimentation) with automated metric verification.

What is GitOps?

An operational model where Git repositories serve as the single source of truth for declarative infrastructure and application deployments.

What is ArgoCD?

A declarative, GitOps continuous delivery tool for Kubernetes that continuously reconciles desired state in Git with live cluster state.

What is FluxCD?

A modular, headless Kubernetes GitOps toolkit that automatically synchronizes cluster state from Git repositories and Helm charts.

What is Tekton?

A cloud-native Kubernetes framework for building flexible, serverless CI/CD execution pipelines using Kubernetes Custom Resource Definitions (Tasks, Pipelines).

What is Spinnaker?

An open-source multi-cloud continuous delivery platform developed by Netflix for managing complex, multi-stage deployment pipelines across AWS, GCP, and Kubernetes.

What is Gitleaks?

A fast, open-source secret scanning tool used in pre-commit hooks and CI pipelines to detect committed API keys, tokens, and private keys.

What is Trivy?

A comprehensive vulnerability scanner for container images, filesystems, Git repos, and Kubernetes configurations.

What is a GitHub Actions Workflow?

An automated process defined in YAML under .github/workflows/ composed of one or more jobs triggered by events (push, pull_request, schedule).

What is a GitHub Actions Job vs Step?

A Job is a collection of sequential steps executed on the same runner environment. Steps are individual tasks (running shell scripts or actions). Multiple jobs run in parallel by default.

What is a Reusable Workflow in GitHub Actions?

A workflow triggered by workflow_call that can be called from other repositories to enforce standardized organization-wide compliance and deployment pipelines.

What is a Composite Action in GitHub Actions?

A custom action (action.yml) that packages multiple shell commands and action steps into a single reusable step within a job.

How do you share files between jobs in GitHub Actions?

Since jobs run on independent virtual machines, files must be uploaded as artifacts using actions/upload-artifact in Job A and downloaded using actions/download-artifact in Job B.

How do you configure OIDC with AWS in GitHub Actions?

Set permissions: { id-token: write, contents: read }, then use aws-actions/configure-aws-credentials@v4 with role-to-assume to exchange the GitHub JWT for temporary AWS IAM credentials.

What is needs in GitHub Actions?

An attribute that defines sequential job dependencies (e.g., needs: [build, test] ensures the deploy job runs only after both build and test succeed).

What is fail-fast in GitHub Actions Matrix builds?

A boolean setting under strategy:. If true (default), GitHub cancels all running matrix jobs if any single job fails. Setting fail-fast: false allows all matrix variations to run to completion.

What are GitHub Actions Environments and Protection Rules?

Deployment targets (e.g., production) configured with required reviewers, wait timers, and branch protection rules that must be approved before deployment jobs execute.

How do you securely pass secrets to Reusable Workflows?

Use secrets: inherit in the calling workflow to pass all caller secrets, or explicitly pass specific secrets via secrets: { DB_PASSWORD: ${{ secrets.DB_PASS }} }.

What is the .gitlab-ci.yml architecture?

A declarative configuration file defining stages, jobs, scripts, and artifact handling natively integrated into GitLab repositories and container registries.

What are GitLab CI Stages?

Sequential execution blocks (e.g., stages: [build, test, deploy]). All jobs within the same stage run concurrently; the next stage starts only after all jobs in the current stage succeed.

What is GitLab CI rules keyword?

A powerful conditional syntax determining whether a job is included in the pipeline based on branch names, commit messages, file changes, or pipeline variables.

What is a GitLab Runner?

An open-source application that executes pipeline jobs defined in .gitlab-ci.yml, supporting Docker, Kubernetes, SSH, and Shell executors.

What is GitLab Auto DevOps?

A pre-configured CI/CD pipeline template that automatically detects programming languages, builds container images, executes security tests, and deploys to Kubernetes without manual pipeline coding.

What is a Declarative Jenkinsfile?

A structured, syntax-checked pipeline format (pipeline { agent any; stages { ... } }) with built-in directives for environments, parameters, and post-build actions.

What is a Scripted Jenkinsfile?

A Groovy-based procedural pipeline format (node { ... }) offering unlimited programmatic flexibility at the cost of higher maintenance complexity.

What is Jenkins Configuration as Code (JCasC)?

Defining the entire Jenkins controller configuration (plugins, security realms, credentials, node settings) in declarative YAML files stored in Git.

What is the Jenkins Kubernetes Plugin?

A plugin that allows the Jenkins controller to dynamically spawn ephemeral agent pods in a Kubernetes cluster to execute build jobs, terminating pods immediately on job completion.

What is Jenkins Shared Libraries?

A centralized Git repository of reusable Groovy code and pipeline steps that can be imported and executed across multiple independent Jenkinsfiles.

How do you prevent credentials leakage in Jenkins logs?

Use withCredentials([string(credentialsId: '...', variable: 'API_TOKEN')]) { ... } which automatically masks the secret value in console logs.

What is Jenkins Multibranch Pipeline?

A Jenkins job type that automatically scans a Git repository, creates pipeline jobs for every detected branch with a Jenkinsfile, and deletes jobs for merged branches.

What is Blue Ocean in Jenkins?

A modern, visual user interface for Jenkins designed to visualize complex multi-stage pipeline executions and failure points.

What is GitLab CI cache vs artifacts?

cache is used to speed up subsequent runs by caching project dependencies across pipelines; artifacts are files passed between sequential stages within the same pipeline.

What is GitHub Actions hashFiles() function?

Computes an MD5/SHA256 hash of matching files (e.g., hashFiles('**/package-lock.json')) used as a dynamic cache key to invalidate dependencies when lockfiles change.

What is GitHub Actions workflow_dispatch?

An event trigger allowing users to trigger workflows manually from the GitHub UI or API with customizable input parameters.

What is GitHub Actions repository_dispatch?

An HTTP webhook trigger allowing external systems (e.g., third-party webhooks, custom microservices) to trigger a GitHub Actions workflow with a JSON payload.

How do you debug GitHub Actions workflows in real time?

Enable runner diagnostic logging by setting repository secrets ACTIONS_RUNNER_DEBUG=true and ACTIONS_STEP_DEBUG=true, or use tools like tmate for interactive SSH debugging.

What is a Jenkins Blue-Green deployment plugin?

Plugins or custom pipeline scripts that orchestrate swapping load balancer target groups or updating DNS records between Blue and Green environments.

What is GitLab CI DAG (Directed Acyclic Graph) Pipeline?

Using the needs keyword in GitLab CI to allow jobs to start immediately once their specific prerequisites complete, regardless of stage ordering.

What is GitHub Actions Concurrency Group?

A named grouping (concurrency: ${{ github.workflow }}-${{ github.ref }}) that limits concurrent execution of workflows, queuing or canceling redundant runs.

How do you implement automated semantic releases in GitLab CI?

Run the semantic-release NPM package in the release stage, which analyzes commit messages, creates Git tags, generates release notes, and publishes packages.

What is the Jenkins Pipeline post section?

Directives (always, success, failure, unstable, cleanup) executed at the completion of a pipeline or stage to send Slack alerts or clean workspace disks.

What is a Jenkins Agent vs Controller?

The Controller manages the web UI, parses pipeline scripts, and schedules builds; Agents are worker instances that execute the actual build steps.

How do you secure Jenkins Controller from malicious agents?

Enable Agent-to-Controller Access Control, disable CLI access over remoting, and run build agents in isolated ephemeral containers with minimal host permissions.

What is GitHub Actions step-security/harden-runner?

A security action that monitors outbound network traffic from GitHub runners, blocks DNS exfiltration, and detects file tampering during CI execution.

What is GitHub Actions Composite Action using: "composite"?

The declaration in action.yml indicating the action is built using composite steps rather than a Docker container or JavaScript runtime.

What is GitLab CI Include keyword?

Directives (include:local, include:file, include:remote, include:template) allowing pipelines to modularize and import external YAML files.

What is GitHub Actions runner.temp vs runner.workspace?

runner.temp is an isolated temporary directory wiped after job completion; runner.workspace is the directory where the repository is cloned.

How do you manage Docker-in-Docker (dind) securely in GitLab CI?

Use rootless Docker or TLS-enabled Docker daemons (DOCKER_TLS_CERTDIR="/certs"), or switch to daemonless build tools like Kaniko.

What is Kaniko and why is it preferred for building containers in Kubernetes?

A Google open-source tool that builds container images from a Dockerfile inside a Kubernetes pod without requiring a Docker daemon or privileged host root access.

What is Buildah?

A command-line tool for building OCI container images without requiring a background container daemon or root privileges.

What is GitHub Actions Token (GITHUB_TOKEN)?

An automatically generated, short-lived secret token provided to each workflow run with scoped permissions defined via the permissions: block.

What is GitHub Actions Least-Privilege Permissions?

Explicitly defining permissions: { contents: read, id-token: write } at the top of workflows to override overly permissive default repository settings.

How do you run scheduled cron jobs in GitHub Actions?

Using the schedule trigger: on: schedule: - cron: '0 2 * * *' (runs daily at 2:00 AM UTC).

What is GitLab CI Environment Variables Hierarchy?

Variables are resolved with precedence: Project Variables $>$ Group Variables $>$ Instance Variables $>$ Pipeline Variables $>$ YAML Variables.

What is Jenkins Pipeline Syntax Generator?

A built-in web tool (/pipeline-syntax) that generates accurate Groovy code snippets for specific plugins and steps.

What is SonarQube Scanner in CI?

A CLI tool that executes static code analysis, uploads AST reports to the SonarQube server, and awaits Quality Gate webhook evaluation.

What is GitLab Review Apps?

Ephemeral dynamic environments spun up automatically per branch in GitLab CI, integrated directly with merge request review pages.

What is GitHub Actions continue-on-error?

A step-level attribute that prevents a job from failing if a non-critical step (e.g., an experimental linter) returns a non-zero exit code.

What is GitOps?

An operational model where Git repositories serve as the single source of truth for declarative infrastructure and application deployments, using automated pull-based reconciliation operators.

What are the Four Principles of GitOps (OpenGitOps)?

1. Declarative Desired State, 2. Versioned and Immutable Storage in Git, 3. Pulled Automatically by In-Cluster Agents, 4. Continuously Reconciled with Automated Drift Correction.

What is ArgoCD?

A declarative GitOps continuous delivery operator for Kubernetes that continuously monitors Git repositories and synchronizes live cluster state with desired state.

What is the ArgoCD Application CRD?

A Kubernetes Custom Resource defining the source repository, path, target cluster, target namespace, and sync policies for an application.

What is an ArgoCD ApplicationSet?

A controller that automates the generation and multi-cluster deployment of multiple ArgoCD Application resources using List, Cluster, Git Directory, or Matrix generators.

What are ArgoCD Sync Waves?

Annotations (argocd.argoproj.io/sync-wave: "1") that control the exact numerical execution order of Kubernetes resources during synchronization (lower/negative numbers apply first).

What are ArgoCD Sync Phases?

PreSync $\rightarrow$ Sync $\rightarrow$ PostSync $\rightarrow$ SyncFail. Allows running prerequisite jobs (database migrations) before updating application deployments.

What is ArgoCD Auto-Sync and Self-Healing?

Auto-Sync automatically applies new Git commits to the cluster; Self-Healing detects manual out-of-band cluster edits and overwrites them back to the Git source of truth.

What is ArgoCD Prune?

An automated synchronization setting that deletes Kubernetes resources from the cluster when their corresponding manifest files are removed from Git.

What is FluxCD?

A set of continuous and progressive delivery controllers for Kubernetes (Source Controller, Kustomize Controller, Helm Controller) implementing GitOps.

What is FluxCD Kustomization CRD?

A resource defining a pipeline for applying Kustomize overlays from a Git repository to a target Kubernetes cluster with health checking and automated rollback.

What is FluxCD HelmRelease?

A declarative resource that manages the lifecycle of Helm chart releases, automatically pulling charts from OCI or HTTP repositories and reconciling values.

What is Progressive Delivery?

Advanced continuous delivery combining canary deployments, traffic routing, feature flags, and automated metric analysis to minimize blast radius during releases.

What is Argo Rollouts?

A Kubernetes operator replacing standard Deployments with a Rollout CRD that coordinates canary traffic splitting and automated metric analysis.

What is an AnalysisTemplate in Argo Rollouts?

A declarative template defining Prometheus, Datadog, or CloudWatch queries used to evaluate canary health during progressive rollouts.

What is Flagger?

A progressive delivery operator that automates canary releases, A/B testing, and blue-green deployments on Kubernetes using Service Meshes (Istio, Linkerd) and Ingress controllers.

What is Software Supply Chain Security?

Protecting against unauthorized modifications, malicious dependency injections, and compromised build systems across the entire software development lifecycle.

What is the SLSA Framework (Levels 1–3)?

Level 1: Scripted build generating provenance; Level 2: Hosted build service with source integrity; Level 3: Isolated, ephemeral, hermetic build platform with cryptographically signed, non-falsifiable provenance.

What is Keyless Signing with Sigstore Cosign?

Signing container images using short-lived OIDC tokens exchanged for X.509 certificates from Fulcio, recording signatures in the Rekor transparency log.

What is Rekor in Sigstore?

An immutable, tamper-evident, append-only transparency log that records signed artifact metadata and proof of provenance.

What is Fulcio in Sigstore?

A free, public Certificate Authority that issues short-lived (10-minute) X.509 certificates bound to OpenID Connect identities (e.g., GitHub Actions workflows).

What is Syft?

An open-source CLI tool and library for generating Software Bill of Materials (SBOMs) from container images, filesystems, and archives in CycloneDX and SPDX formats.

What is Grype?

An open-source vulnerability scanner specifically designed to scan container images and SBOM files for known security vulnerabilities.

What is In-Toto?

A framework for cryptographic verification of software supply chain integrity, ensuring every step from commit to build to packaging was performed by authorized actors.

What is Kyverno Image Verification?

An admission policy rule that verifies container image cryptographic signatures against Sigstore Cosign before allowing pods to schedule in Kubernetes.

What is Bitnami Sealed Secrets?

A GitOps secret management tool where secrets are encrypted client-side with a public key and committed to Git, decrypted inside the cluster by a controller possessing the private key.

What is External Secrets Operator (ESO)?

A Kubernetes operator that synchronizes secrets from enterprise vaults (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) into native Kubernetes Secret resources.

What is HashiCorp Vault Agent Sidecar Injector?

A Kubernetes mutating webhook that injects a Vault agent container into application pods to dynamically fetch and render secrets into an in-memory volume.

What is Atlantis for Terraform?

An open-source application that executes terraform plan and terraform apply directly inside GitHub/GitLab Pull Request comments with automated state locking.

What is Spacelift?

A specialized CI/CD management platform for Infrastructure as Code (Terraform, OpenTofu, Pulumi, CloudFormation, Kubernetes) with policy enforcement via OPA.

What is GitHub Actions Runner Controller (ARC) Autoscaling?

Autoscaling runner pods dynamically based on GitHub API metrics (workflow_job queue depth) from 0 to hundreds of instances.

What is Ephemeral Runner Security?

Destroying self-hosted runner pods/VMs immediately after completing a single job to prevent lateral movement, credential theft, and state pollution.

What is Snyk?

A commercial developer security platform scanning source code (SAST), dependencies (SCA), container images, and IaC templates for security vulnerabilities.

What is SonarQube?

A continuous code quality platform evaluating code coverage, duplication, complexity, code smells, and security vulnerabilities.

What is OWASP ZAP in CI/CD?

An open-source web application security scanner used in CI pipelines to execute automated Dynamic Application Security Testing (DAST).

What is Checkov?

A static analysis tool for IaC that scans Terraform, Kubernetes manifests, Helm charts, and Dockerfiles for security misconfigurations.

What is tfsec?

A fast static analysis security scanner for Terraform code, now integrated into Trivy.

What is Infracost?

A FinOps tool that parses Terraform code in pull requests to calculate monthly cloud cost impact before merging code.

What is Kustomize in GitOps?

A template-free configuration manager that customizes Kubernetes YAML manifests using declarative overlays (dev, staging, prod) over a base configuration.

What is Helm in GitOps?

A package manager for Kubernetes that bundles related manifests into reusable Charts, parameterized using values.yaml files.

What is Helmfile?

A declarative spec for deploying multiple Helm charts across multiple Kubernetes clusters in dependency order.

What is Tekton Pipelines?

A Kubernetes-native CRD defining a Directed Acyclic Graph (DAG) of Tasks executed sequentially or in parallel inside ephemeral pods.

What is Spinnaker Automated Canary Analysis (Kayenta)?

An automated statistical analysis engine comparing canary metrics against baseline metrics over time to make automated promotion decisions.

What is Chaos Mesh in CI/CD?

Injecting automated network delays, pod failures, and disk stress into staging environments during CI pipeline execution to validate resilience.

What is Semantic Release?

An automated tool that analyzes commit messages to determine the next SemVer version, generates changelogs, creates Git tags, and publishes releases.

What is Release Please?

A Google tool that generates Release PRs containing updated changelogs and version bumps based on conventional commit history.

What is Dependabot / Renovate?

Automated dependency update bots that scan repository manifests, check for new package releases, and automatically open PRs with changelog summaries.

What is Renovate Bot?

A highly configurable, multi-platform dependency update tool supporting automated merging of non-breaking security patches.

What is a Pull Request Builder Job?

An automated CI job that triggers when a PR is created or updated to compile code, run tests, and report status checks back to the PR.

What is a GitOps Out-of-Sync State?

A condition where the live state of Kubernetes cluster resources differs from the declared configuration stored in Git.

What is GitOps Drift Correction?

The automatic overwrite of unauthorized out-of-band manual changes in a cluster back to the version declared in Git.

What is an ArgoCD PreSync Hook?

A Kubernetes resource (Job) executed before any other deployment resources are applied, commonly used for database schema migrations.

What is an ArgoCD PostSync Hook?

A script or notification Job executed only after all deployment resources have successfully become healthy in the cluster.

What is an ArgoCD SyncFail Hook?

A remediation Job executed when an ArgoCD synchronization operation fails.

What is Secret Masking Bypass Risk?

If secrets are base64-encoded or split across multiple strings, CI engines will fail to match the secret string and print it in plain text.

What is Git Credential Helper in CI?

A utility allowing CI/CD runners to authenticate with remote Git repositories using short-lived OAuth tokens instead of hardcoded passwords.

What is GitHub Actions Reusable Workflow Inheritance?

Passing all secrets and context from a caller workflow to a reusable workflow using secrets: inherit.

What is Container Layer Squashing?

Merging all intermediate build layers of a container into a single layer to reduce image size and discard temporary files.

What is Multi-Arch Container Building?

Using Docker buildx to compile container images for multiple CPU architectures (linux/amd64, linux/arm64) from a single Dockerfile.

What is OCI (Open Container Initiative)?

An open governance industry standard defining specifications for container image formats (Image Spec) and runtimes (Runtime Spec).

What is Cosign Attestation?

Cryptographically signing metadata predicates (SBOMs, test results, vulnerability scan reports) and attaching them to the container image in the registry.

What is Kyverno ClusterPolicy vs Policy?

ClusterPolicy applies to all resources across the entire cluster; Policy is scoped strictly to a single namespace.

What is OPA Gatekeeper ConstraintTemplate?

A Custom Resource defining the declarative Rego logic for a policy, instantiated by Constraint CRDs.

What is a Continuous Integration Feedback Loop?

The time elapsed from a developer pushing a commit to receiving automated test results; must be $< 10$ minutes to maintain high velocity.

What is Monorepo Incremental Building?

Using cached compilation outputs so that changing one file only recompiles that file and its direct dependents.

What is Bazel?

A fast, scalable, multi-language build system developed by Google that enforces hermetic, reproducible builds and aggressive caching.

What is Turborepo?

A high-performance build system for JavaScript/TypeScript monorepos that caches build and test execution outputs remotely.

What is Nx?

A smart, extensible build framework with advanced dependency graph visualization and distributed task execution for monorepos.

What is a Git Pre-Commit Hook?

A client-side script executed automatically before git commit runs, used to lint code, format files, and check for committed secrets locally.

What is pre-commit framework?

A multi-language package manager for managing and maintaining pre-commit hooks via a declarative .pre-commit-config.yaml file.

What is Trunk-Based Feature Flag Lifecycle?

1. Create flag $\rightarrow$ 2. Implement logic behind flag $\rightarrow$ 3. Merge to main $\rightarrow$ 4. Enable flag in production $\rightarrow$ 5. Clean up flag conditional code.

What is Dark Launching vs Shadowing?

Dark launching deploys backend code with no UI changes; Shadowing duplicates live incoming HTTP traffic and replays it against the new version.

What is an Artifact Provenance Document?

Cryptographically signed metadata recording exactly who built the artifact, from which commit SHA, on which CI runner, and using which build parameters.

What is CycloneDX?

An OWASP-backed, lightweight Software Bill of Materials (SBOM) standard designed for application security and vulnerability analysis.

What is SPDX?

An open standard (ISO/IEC 5962:2021) for communicating Software Bill of Materials data, including components, licenses, and copyrights.

What is a Vulnerability Exploitability eXchange (VEX)?

A machine-readable companion to an SBOM that declares whether a specific CVE in a dependency is actually exploitable in the context of the application.

What is Supply Chain Security SLSA Provenance?

An in-toto attestation generated during the build step certifying the source repository, commit, and build environment.

What is Docker Content Trust (DCT)?

A legacy Docker feature using Notary and digital signatures to verify the integrity and publisher of specific image tags.

What is a Pipeline Deadlock?

A state where two or more pipeline jobs wait indefinitely on mutually dependent resources or locks (e.g., job A holds lock 1 waiting for job B, while job B holds lock 2 waiting for job A).

What is CI/CD Pipeline Blast Radius?

The maximum potential damage caused if a CI/CD system is compromised (mitigated by using pull-based GitOps and ephemeral runners).

What is Automated Rollback in Argo Rollouts?

Automatically aborting a canary deployment and reverting traffic to stable pods when an AnalysisTemplate metric breach occurs.

What is a Canary Step Weight?

The percentage of total traffic allocated to the canary version during a specific phase of a progressive rollout (e.g., setWeight: 20).

What is a Flagger Metric Template?

A Custom Resource defining Prometheus PromQL queries (e.g., error rate $< 1%$, latency $< 500\text{ms}$) checked during canary analysis.

What is Blue-Green Cutover Latency?

The time taken for load balancers or DNS to update routing rules from Blue to Green; with Kubernetes Services, this occurs in sub-seconds.

What is a Pipeline Concurrency Lock?

Restricting deployment pipelines to execute one at a time per target environment to prevent concurrent overlapping state modifications.

What is a GitOps Sync Window?

Scheduled maintenance windows in ArgoCD that allow or deny automated synchronizations during specific hours (e.g., blocking prod syncs on weekends).

What is ArgoCD SSO (Single Sign-On)?

Integrating ArgoCD with enterprise identity providers (Okta, Azure AD, GitHub) via OIDC or SAML to enforce role-based access control.

What is FluxCD Source Controller?

A dedicated Flux controller that watches Git repositories, Helm charts, and S3 buckets for changes and produces artifact archives for other controllers.

What is FluxCD Kustomize Controller?

A Flux controller that takes artifacts from the Source Controller, generates Kubernetes manifests via Kustomize, and applies them to the cluster.

What is FluxCD Notification Controller?

A Flux controller that handles inbound webhooks from Git providers and dispatches outbound event notifications to Slack, MS Teams, and Discord.

What is Tekton PipelineRun?

A Custom Resource that instantiates and executes a Pipeline on a Kubernetes cluster, binding concrete parameters and workspaces.

What is Tekton TaskRun?

A Custom Resource that instantiates and executes a single Task inside a Kubernetes pod composed of sequential container steps.

What is a Matrix Job in GitLab CI?

Using the parallel: matrix: keyword in .gitlab-ci.yml to run multiple job variations across defined variables concurrently.

What is a Pipeline Secret Store CSI Driver?

Mounting secrets stored in enterprise vaults directly into Kubernetes pods as in-memory files without persisting them as Kubernetes Secret objects.

What is a Zero-Downtime Database Migration sequence in CI/CD?

1. Add nullable columns (Expand), 2. Deploy app writing to both old and new columns, 3. Backfill data, 4. Deploy app reading from new column, 5. Drop old columns (Contract).

What is In-Tree vs Out-of-Tree CI Plugins?

In-tree plugins are compiled directly into the core CI engine; Out-of-tree plugins are external community actions downloaded dynamically at runtime.

What is Action Pinning in GitHub Actions?

Pinning third-party actions to full commit SHAs (uses: actions/setup-node@60edb5...) rather than mutable tags (@v4) to protect against supply chain attacks.

What is Hermetic Container Building with Kaniko?

Executing container image builds inside an isolated pod with no host Docker socket mount, pushing directly to an OCI registry.

What is a Pipeline Flakiness Rate?

The percentage of pipeline runs that fail due to unstable tests or network timeouts rather than actual code defects, eroding developer trust.

What is Progressive Delivery Automated Metric Gating?

Evaluating real-time Prometheus golden signal telemetry during canary deployments to autonomously promote or abort releases without human intervention.