Use this cheat sheet for Certified GitOps Associate (CGOA) after you know the vocabulary but before you start mixed practice. The exam is not asking you to operate a cluster from memory. It is asking whether you can reason from GitOps principles: declarative desired state, versioned state store, pull-based reconciliation, drift detection, rollback, and tool-aware delivery.
CGOA answer sequence
flowchart TD
S["Scenario"] --> D["What desired state should exist?"]
D --> G["Where is that state versioned?"]
G --> R["Which reconciler compares desired and live state?"]
R --> F["What feedback proves sync, drift, failure, or rollback?"]
F --> P["Choose the pattern that preserves GitOps principles"]
If an answer fixes production manually but leaves Git unchanged, it usually violates the exam’s central model.
Domain compression
| Domain |
Weight |
Final-review cue |
| GitOps Terminology |
20% |
desired state, state drift, reconciliation, managed system, state store, feedback loop, rollback |
| GitOps Principles |
30% |
declarative, versioned and immutable, pulled automatically, continuously reconciled |
| Related Practices |
16% |
Configuration as Code, Infrastructure as Code, DevOps, DevSecOps, CI, and CD |
| GitOps Patterns |
20% |
deployment/release patterns, progressive delivery, pull vs event-driven, architecture patterns |
| Tooling |
14% |
manifest packaging, state stores, reconcilers, notifications, observability, CI integration |
What to know cold
| Concept |
Decision rule |
Reject when |
| Desired state |
The intended system state is declared and stored outside the live runtime. |
The live cluster is the only source of truth. |
| State store |
Git is the common state store, but the key idea is versioned, reviewed desired state. |
Changes happen directly in production with no versioned record. |
| Reconciliation |
A reconciler compares desired state to live state and moves live toward desired. |
Humans repeatedly patch drift by hand. |
| Drift |
Drift means live state differs from declared desired state. |
The answer ignores why drift happened or how it is detected. |
| Rollback |
Rollback should use versioned state history or controlled release history. |
The answer reconstructs old state from memory. |
| Feedback loop |
Operators need sync, health, alert, and deployment evidence. |
The system changes silently with no status or notification path. |
Scenario eliminations
| Stem clue |
Eliminate first |
Keep in play |
| live state differs from Git |
manual hotfix only |
reconcile or update desired state through review |
| rollback required |
kubectl recreate from memory |
revert/promote known versioned state |
| CI/CD confusion |
CI directly mutates production |
CI builds/tests artifacts; GitOps CD reconciles state |
| compliance requires review |
unreviewed cluster changes |
pull request, policy checks, audit trail, signed changes where relevant |
| progressive delivery |
all-at-once deployment only |
canary, blue-green, feature flags, traffic shift with feedback |
| multi-cluster consistency |
copy manifests manually |
shared state model, environment overlays, controller-based sync |
| secrets or policy risk |
broad reconciler permissions |
scoped access, secret-management pattern, policy validation |
| tool choice question |
brand name only |
state store, package format, reconciler behavior, observability fit |
Pull vs event-driven mental model
| Pattern |
Better fit |
Watch for |
| Pull-based GitOps |
Reconciler watches state store and pulls changes into the managed system. |
Stronger isolation because cluster does not need broad external push access. |
| Event-driven trigger |
Webhook or event nudges a sync or pipeline step. |
Event helps responsiveness but should not replace versioned desired state. |
| CI pipeline |
Build, test, scan, package, and publish artifacts or state updates. |
CI should not become the only uncontrolled deployment actor. |
| CD reconciler |
Applies declared state and reports sync/health/drift. |
Needs scoped permissions and observable failure behavior. |
| Need |
Strong first thought |
| Kubernetes manifest reconciliation |
Argo CD, Flux, or comparable reconciler |
| packaging and overlays |
Helm, Kustomize, or tool-specific packaging |
| image update automation |
controlled image update workflow with review or policy |
| policy enforcement |
admission/policy checks and Git review gates |
| notifications |
sync, health, drift, and rollout status alerts |
| observability |
logs, metrics, events, dashboards, and deployment history |
Final 15-minute review
| If the stem says… |
Start with |
| “drift” |
compare desired state and live state, then reconcile |
| “rollback” |
versioned state history and controlled promotion |
| “GitOps principle” |
declarative, versioned, pulled automatically, continuously reconciled |
| “CI/CD” |
separate artifact build/test from state reconciliation |
| “progressive delivery” |
canary, blue-green, traffic shift, feedback, rollback |
| “tooling” |
state store, package format, reconciler, notification, observability |