Sync & Health Interview Questions & Answers

Q: How do you force a refresh or hard refresh of an Application?

A refresh makes ArgoCD re-check Git and recompute status without applying; a hard refresh also re-runs manifest generation (bypassing the repo cache), useful when a Helm/Kustomize render or external chart changed but the cache is stale. Use `argocd app get --refresh` or `--hard-refresh`, or the UI refresh options.

Q: How can you customize health checks for third-party or custom resources?

Add Lua scripts under resource.customizations.health in the argocd-cm ConfigMap keyed by group_kind. The script inspects the resource's status and returns a health status and message. ArgoCD ships many built-ins (e.g., for cert-manager, Rollouts); you add scripts for CRDs it doesn't know so aggregated app health is accurate.

Q: What causes an Application to be perpetually OutOfSync and how do you fix it?

Perpetual OutOfSync usually means a field differs every reconcile: mutating webhooks or controllers add/change fields, defaults are injected, or ordering/normalization differs. Fixes include ignoreDifferences for controller-managed fields, correct resource normalization, ServerSideApply, or aligning the manifest with what the API server returns.

Q: How do notifications work for sync and health events?

The Argo CD Notifications controller (now built-in) sends alerts to Slack, email, Teams, webhooks, etc., based on triggers (e.g., on-sync-failed, on-health-degraded) and templates. You configure triggers/templates in a ConfigMap and subscribe apps via annotations, enabling proactive alerting on failures or drift.

Q: How do you implement progressive delivery (canary/blue-green) with ArgoCD?

ArgoCD deploys the manifests, but progressive delivery is handled by Argo Rollouts, which replaces Deployment with a Rollout resource supporting canary and blue-green strategies, traffic shifting, and analysis. ArgoCD syncs the Rollout from Git and (with the Rollouts health extension) reports its progressive status as health.

Q: What does the diff view show and how do you use it?

The diff view shows the differences between the desired state (Git) and the live state for each out-of-sync resource, highlighting added, removed, or changed fields. It's used to review exactly what a sync will change before applying, and to diagnose why an app is OutOfSync.

Q: How do you prevent auto-sync from applying an unwanted change during an incident?

You can disable automated sync temporarily (remove/patch syncPolicy.automated), use sync windows to block syncs during a change freeze, set the app to manual, or add maintenance annotations. Sync windows (defined on the Project) allow/deny syncs on a schedule so automated reconciliation pauses during sensitive periods.

Q: What is the resource hooks vs health relationship during a sync?

During a sync, ArgoCD orders resources by waves and runs hooks (PreSync/Sync/PostSync) at the right phases, waiting for each wave's resources to become Healthy before proceeding. So health assessment gates progression: if a resource in an earlier wave isn't Healthy, later waves and PostSync hooks won't run.

Q: How do you monitor ArgoCD itself (metrics and observability)?

ArgoCD exposes Prometheus metrics from its controllers (app sync counts, reconciliation performance, health status, repo-server and API server metrics). You scrape them, build Grafana dashboards, and alert on sync failures, reconciliation latency, or OutOfSync counts. Logs and the app events/audit provide deeper diagnostics.

Q: What happens during a sync when a resource apply fails?

If applying a resource fails, the sync operation is marked failed; ArgoCD stops progressing further waves and reports the error on the resource. With retry configured it backs off and retries. Already-applied resources remain; you fix the cause (manifest error, RBAC, missing CRD) and re-sync. Hooks may run failure hooks if defined.

How do you force a refresh or hard refresh of an Application?

Beginner

A refresh makes ArgoCD re-check Git and recompute status without applying; a hard refresh also re-runs manifest generation (bypassing the repo cache), useful when a Helm/Kustomize render or external chart changed but the cache is stale. Use `argocd app get --refresh` or `--hard-refresh`, or the UI refresh options.

argocd app get my-app --refresh
argocd app get my-app --hard-refresh

Real-world example After updating a values file, a hard refresh forces ArgoCD to re-render the chart instead of using cached manifests.

Common follow-ups: When is a hard refresh needed? | Does refresh apply changes?

Applications GitOps Principles Sync & Health

How can you customize health checks for third-party or custom resources?

Advanced

Add Lua scripts under resource.customizations.health in the argocd-cm ConfigMap keyed by group_kind. The script inspects the resource's status and returns a health status and message. ArgoCD ships many built-ins (e.g., for cert-manager, Rollouts); you add scripts for CRDs it doesn't know so aggregated app health is accurate.

resource.customizations.health.cert-manager.io_Certificate: |
  hs = {}
  for i, c in ipairs(obj.status.conditions) do
    if c.type == "Ready" and c.status == "True" then
      hs.status = "Healthy"; return hs
    end
  end
  hs.status = "Progressing"; return hs

Real-world example A Certificate resource reports Healthy only once its Ready condition is true, thanks to a custom Lua check.

Common follow-ups: Where are custom health scripts stored? | What does a Lua health script return?

Applications Sync Waves & Hooks Sync & Health

What causes an Application to be perpetually OutOfSync and how do you fix it?

Intermediate

Perpetual OutOfSync usually means a field differs every reconcile: mutating webhooks or controllers add/change fields, defaults are injected, or ordering/normalization differs. Fixes include ignoreDifferences for controller-managed fields, correct resource normalization, ServerSideApply, or aligning the manifest with what the API server returns.

spec:
  ignoreDifferences:
    - group: ""
      kind: Service
      jqPathExpressions:
        - .spec.clusterIP

Real-world example A Service showing constant drift is fixed by ignoring the auto-assigned clusterIP field the API server injects.

Common follow-ups: What commonly injects drift-causing fields? | How does ignoreDifferences help?

Applications GitOps Principles Sync & Health

How do notifications work for sync and health events?

Intermediate

The Argo CD Notifications controller (now built-in) sends alerts to Slack, email, Teams, webhooks, etc., based on triggers (e.g., on-sync-failed, on-health-degraded) and templates. You configure triggers/templates in a ConfigMap and subscribe apps via annotations, enabling proactive alerting on failures or drift.

metadata:
  annotations:
    notifications.argoproj.io/subscribe.on-health-degraded.slack: my-channel

Real-world example When an app goes Degraded, the team gets a Slack alert immediately via the notifications controller.

Common follow-ups: What triggers are available? | How do you subscribe an app to notifications?

Applications Sync & Health RBAC

How do you implement progressive delivery (canary/blue-green) with ArgoCD?

Advanced

ArgoCD deploys the manifests, but progressive delivery is handled by Argo Rollouts, which replaces Deployment with a Rollout resource supporting canary and blue-green strategies, traffic shifting, and analysis. ArgoCD syncs the Rollout from Git and (with the Rollouts health extension) reports its progressive status as health.

kind: Rollout
spec:
  strategy:
    canary:
      steps:
        - setWeight: 20
        - pause: { duration: 5m }

Real-world example A new version rolls out to 20% of traffic, pauses for analysis, then proceeds—managed by Argo Rollouts and synced by ArgoCD.

Common follow-ups: How does Argo Rollouts relate to ArgoCD? | What strategies does it support?

Applications Sync Waves & Hooks Sync & Health

What does the diff view show and how do you use it?

Beginner

The diff view shows the differences between the desired state (Git) and the live state for each out-of-sync resource, highlighting added, removed, or changed fields. It's used to review exactly what a sync will change before applying, and to diagnose why an app is OutOfSync.

argocd app diff my-app

Real-world example Before approving a production sync, the reviewer inspects the diff to confirm only the intended image tag changed.

Common follow-ups: Why review the diff before sync? | Where do you see the diff?

Applications GitOps Principles Sync & Health

How do you prevent auto-sync from applying an unwanted change during an incident?

Advanced

You can disable automated sync temporarily (remove/patch syncPolicy.automated), use sync windows to block syncs during a change freeze, set the app to manual, or add maintenance annotations. Sync windows (defined on the Project) allow/deny syncs on a schedule so automated reconciliation pauses during sensitive periods.

kind: AppProject
spec:
  syncWindows:
    - kind: deny
      schedule: '0 22 * * *'
      duration: 8h
      applications: ['*']

Real-world example A nightly deny sync window freezes deployments during the change-freeze period so no auto-sync fires.

Common follow-ups: What is a sync window? | How do you pause auto-sync safely?

Applications RBAC Sync & Health

What is the resource hooks vs health relationship during a sync?

Intermediate

During a sync, ArgoCD orders resources by waves and runs hooks (PreSync/Sync/PostSync) at the right phases, waiting for each wave's resources to become Healthy before proceeding. So health assessment gates progression: if a resource in an earlier wave isn't Healthy, later waves and PostSync hooks won't run.

Real-world example A database migration PreSync hook must complete Healthy before the app's Deployment in the next wave is applied.

Common follow-ups: How does health gate wave progression? | What are the hook phases?

Sync Waves & Hooks Applications Sync & Health

How do you monitor ArgoCD itself (metrics and observability)?

Advanced

ArgoCD exposes Prometheus metrics from its controllers (app sync counts, reconciliation performance, health status, repo-server and API server metrics). You scrape them, build Grafana dashboards, and alert on sync failures, reconciliation latency, or OutOfSync counts. Logs and the app events/audit provide deeper diagnostics.

# ServiceMonitor scraping argocd-metrics, repo-server, api-server
# Alert on: argocd_app_info{sync_status="OutOfSync"} and sync failures

Real-world example A Grafana dashboard tracks sync success rate and reconciliation latency, alerting when OutOfSync apps spike.

Common follow-ups: Which components expose metrics? | What would you alert on?

Applications Multi-cluster Sync & Health

What happens during a sync when a resource apply fails?

Intermediate

If applying a resource fails, the sync operation is marked failed; ArgoCD stops progressing further waves and reports the error on the resource. With retry configured it backs off and retries. Already-applied resources remain; you fix the cause (manifest error, RBAC, missing CRD) and re-sync. Hooks may run failure hooks if defined.

Real-world example A sync fails because a manifest references a missing CRD; ArgoCD reports the error, and after installing the CRD the re-sync succeeds.

Common follow-ups: Does a failed sync roll back applied resources? | What is a SyncFail hook?

Sync Waves & Hooks Applications Sync & Health