Sync & Health Interview Questions & Answers

Q: What does OutOfSync mean and what should you do about it?

OutOfSync means the live cluster state differs from the desired state in Git. You review the diff to see the difference, then either sync to apply Git's state, or update Git if the live change is desired. With auto-sync it reconciles automatically.

Q: What is the Degraded health status?

Degraded means a resource has failed to reach or maintain a working state—e.g., a Deployment whose pods are crash-looping or not becoming ready. It signals an operational problem distinct from sync status, and turns the aggregated Application health red.

Q: How does ArgoCD assess Deployment health specifically?

For a Deployment, ArgoCD checks the rollout status: it's Healthy when the desired replicas are updated, available, and the rollout has completed; Progressing while pods are still rolling; and Degraded if it fails to progress (e.g., timeout, unavailable replicas). It reads the Deployment status conditions to decide.

Q: What is the Suspended health status?

Suspended indicates a resource is intentionally paused, such as a suspended CronJob or a paused Argo Rollout. ArgoCD reports it distinctly so it's not confused with a failure; the resource isn't Degraded, it's deliberately not active.

Q: How do you debug why an app never reaches Healthy after a successful sync?

Sync success means resources applied, but health depends on runtime readiness. Check pod status/logs, readiness/liveness probes, events, and for CRDs whether a custom health check exists (else it may stay Progressing/Unknown). Fix the root cause—failing probes, missing dependencies, or an absent health script.

Q: How do you skip health assessment or diff for specific fields?

Use ignoreDifferences to exclude controller-managed fields from diffs (preventing false OutOfSync), and custom health scripts to define health for CRDs. For fields set by admission/webhooks, ignoring them or using ServerSideApply avoids perpetual drift and health noise.

Q: How do sync windows control when syncs are allowed?

Sync windows, defined on an AppProject, allow or deny syncs on a cron schedule for matching apps—useful for change freezes or maintenance windows. A deny window blocks automated (and optionally manual) syncs during sensitive periods; allow windows restrict syncs to approved times.

Q: What is a dry-run sync?

A dry-run sync asks the API server to validate what would be applied without persisting changes, surfacing errors (schema, admission) before a real sync. It's a safety check to catch problems early, though some issues only appear on actual apply.

Q: How do you integrate Argo Rollouts analysis into sync health?

Argo Rollouts runs AnalysisRuns (querying Prometheus, etc.) during canary/blue-green steps; if analysis fails, the Rollout is marked Degraded and can auto-abort. With the Rollouts health extension, ArgoCD reflects the Rollout's progressive status, so a failing canary shows as unhealthy and can gate promotion.

What does OutOfSync mean and what should you do about it?

Beginner

OutOfSync means the live cluster state differs from the desired state in Git. You review the diff to see the difference, then either sync to apply Git's state, or update Git if the live change is desired. With auto-sync it reconciles automatically.

Real-world example After a manifest edit, the app shows OutOfSync; reviewing the diff confirms the intended change before syncing.

Common follow-ups: How do you inspect what's OutOfSync? | Does auto-sync fix it automatically?

Applications GitOps Principles Sync & Health

What is the Degraded health status?

Beginner

Degraded means a resource has failed to reach or maintain a working state—e.g., a Deployment whose pods are crash-looping or not becoming ready. It signals an operational problem distinct from sync status, and turns the aggregated Application health red.

Real-world example A bad image causes crash-looping pods, so the Deployment and the Application show Degraded.

Common follow-ups: Is Degraded about sync or operation? | What commonly causes it?

Applications Sync Waves & Hooks Sync & Health

How does ArgoCD assess Deployment health specifically?

Intermediate

For a Deployment, ArgoCD checks the rollout status: it's Healthy when the desired replicas are updated, available, and the rollout has completed; Progressing while pods are still rolling; and Degraded if it fails to progress (e.g., timeout, unavailable replicas). It reads the Deployment status conditions to decide.

Real-world example A Deployment stuck with unavailable replicas past its progress deadline is reported Degraded.

Common follow-ups: What conditions does it read? | When is a Deployment Progressing?

Applications Sync Waves & Hooks Sync & Health

What is the Suspended health status?

Intermediate

Suspended indicates a resource is intentionally paused, such as a suspended CronJob or a paused Argo Rollout. ArgoCD reports it distinctly so it's not confused with a failure; the resource isn't Degraded, it's deliberately not active.

Real-world example A CronJob with spec.suspend true shows Suspended rather than Degraded or Healthy.

Common follow-ups: Is Suspended a failure? | What resources can be Suspended?

Applications Sync Waves & Hooks Sync & Health

How do you debug why an app never reaches Healthy after a successful sync?

Advanced

Sync success means resources applied, but health depends on runtime readiness. Check pod status/logs, readiness/liveness probes, events, and for CRDs whether a custom health check exists (else it may stay Progressing/Unknown). Fix the root cause—failing probes, missing dependencies, or an absent health script.

argocd app get app --refresh
kubectl get pods -n ns; kubectl describe pod <p>

Real-world example An app stays Progressing because a readiness probe path is wrong; correcting it lets the app report Healthy.

Common follow-ups: Why might a CRD stay Progressing forever? | What runtime issues block Healthy?

Applications Sync Waves & Hooks Sync & Health

How do you skip health assessment or diff for specific fields?

Intermediate

Use ignoreDifferences to exclude controller-managed fields from diffs (preventing false OutOfSync), and custom health scripts to define health for CRDs. For fields set by admission/webhooks, ignoring them or using ServerSideApply avoids perpetual drift and health noise.

spec:
  ignoreDifferences:
    - group: apps
      kind: Deployment
      jsonPointers: [ /spec/replicas ]

Real-world example Ignoring HPA-managed replicas stops the app flapping between Synced and OutOfSync every reconcile.

Common follow-ups: Which fields commonly need ignoring? | How does SSA reduce noise?

Applications GitOps Principles Sync & Health

How do sync windows control when syncs are allowed?

Advanced

Sync windows, defined on an AppProject, allow or deny syncs on a cron schedule for matching apps—useful for change freezes or maintenance windows. A deny window blocks automated (and optionally manual) syncs during sensitive periods; allow windows restrict syncs to approved times.

syncWindows:
  - kind: allow
    schedule: '0 9 * * 1-5'
    duration: 8h
    applications: ['prod-*']

Real-world example Production apps can only auto-sync during business hours via an allow window, freezing deploys overnight.

Common follow-ups: Where are sync windows defined? | Can they block manual syncs?

Applications RBAC Sync & Health

What is a dry-run sync?

Beginner

A dry-run sync asks the API server to validate what would be applied without persisting changes, surfacing errors (schema, admission) before a real sync. It's a safety check to catch problems early, though some issues only appear on actual apply.

argocd app sync app --dry-run

Real-world example A dry-run reveals an invalid field so the manifest is fixed before the real sync runs.

Common follow-ups: What does dry-run catch? | What might it miss?

Applications GitOps Principles Sync & Health

How do you integrate Argo Rollouts analysis into sync health?

Advanced

Argo Rollouts runs AnalysisRuns (querying Prometheus, etc.) during canary/blue-green steps; if analysis fails, the Rollout is marked Degraded and can auto-abort. With the Rollouts health extension, ArgoCD reflects the Rollout's progressive status, so a failing canary shows as unhealthy and can gate promotion.

analysis:
  templates: [ { templateName: success-rate } ]

Real-world example A canary with a failing success-rate analysis is auto-aborted and shows Degraded in ArgoCD.

Common follow-ups: What is an AnalysisRun? | How does a failed analysis affect health?

Applications Sync Waves & Hooks Sync & Health