Version Control for Infrastructure Code Questions

Understand Git fundamentals applied to infrastructure - branching strategies, pull requests, code reviews for infrastructure changes. Know how infrastructure code differs from application code. Discuss infrastructure change management - how you'd safely deploy changes, rollback if needed. Understand the risks of infrastructure changes and how to mitigate them. Know about infrastructure documentation alongside code - README files, architecture diagrams, variable explanations. Practice discussing a git workflow for collaborative infrastructure development.

MediumSystem Design

39 practiced

Explain how GitOps applies to managing infrastructure. Design a GitOps workflow for an SRE team using a declarative controller (for example Flux or ArgoCD) that ensures environments are reconciled from Git. Include how you handle environment overlays, secret injection, drift reconciliation, and emergency out-of-band changes.

EasyTechnical

37 practiced

Compare trunk-based development and git-flow for infrastructure code repositories. For an SRE team that owns global production infrastructure, which strategy would you choose and why? Discuss release frequency, risk surface, complexity of merges, and how to handle hotfixes and long-lived feature branches.

EasyTechnical

46 practiced

List the essential documentation files that should accompany an infrastructure-as-code repository (for example README, architecture diagrams, variable explanations, onboarding guide, runbooks). For each file describe its purpose and the minimal content you would expect to see so a new SRE can safely make small changes.

HardSystem Design

45 practiced

Design a continuous delivery pipeline that performs progressive infrastructure deployments (canary/gradual rollout) and automatically rolls back if SLOs are violated. Describe components for metrics collection, a decision engine that evaluates rollout health, integration with Git (for marking changes and approvals), and safe primitives for reverting infrastructure state that may be partially applied across regions.

Sample Answer

**Clarify requirements & constraints**- Progressive rollout (canary/gradual), SLO-driven automatic rollback, multi-region partial state safe revert, Git integration for approvals.

**High-level architecture**- CI/CD Orchestrator: ArgoCD/Spinnaker for Kubernetes + Terraform Cloud for infra changes. Orchestrator applies staged manifests/infra plans.- Metrics Collection: Prometheus + OpenTelemetry exporters + Cloud provider metrics (CloudWatch/GCM). Push metrics into a metric store + long-term TSDB (Thanos).- Decision Engine (Policy Engine): A separate service (e.g., custom controller or Kayenta/Prometheus rules + a small controller) that: - evaluates SLO windows (latency/error-rate/availability) vs. thresholds and error budget consumption - computes statistical significance (e.g., Bayesian or sequential testing) across canary vs. baseline - emits a verdict: Continue / Pause / Rollback- Orchestration Workflow: Declarative pipeline that advances stages only when Decision Engine returns Continue; uses feature flags and traffic shifting (Istio/ALB weights) to move % traffic.

**Integration with Git**- GitOps model: every change is a PR; enforced signed commits/tags; branch protection requiring approvals and CI pass.- Pipeline annotates Git commit/PR with rollout metadata (canary id, regions, start time). On rollback, pipeline creates a signed tag marking rollback and links to original PR.

**Safe revert primitives across regions**- Use idempotent declarative state (K8s manifests, Terraform state locking). Implement compensating steps: declare desired state per region; if partially applied, pipeline performs region-by-region reconcile to previous stable tag.- Maintain immutable release artifacts (container images, Terraform plans) stored with signatures so you can reapply an exact known-good artifact.

**Failure & rollback behavior**- Decision Engine triggers automated rollback when SLO breach detected with confidence interval and sustained window (to avoid flapping).- Rollback workflow: stop traffic to canary, re-point traffic to baseline, apply previous artifact via GitOps reconciliation, verify health metrics, emit audit events.

**Observability & safety**- Alerting for human-in-the-loop when rollback fails; circuit breaker to halt multi-region propagation.- Store all metrics, decisions, events, and Git links in a centralized audit store (Elasticsearch/BigQuery).

This design ensures statistically-driven progressive rollouts, Git-linked approvals/audit trail, and safe, region-aware revert using immutable artifacts and idempotent reconciliation.

EasyTechnical

56 practiced

When opening a pull request that modifies infrastructure-as-code (for example Terraform modules or cloud resources), what artifacts and information should be included in the PR description? Consider items like the Terraform plan output, cost impact, affected environments, SLO implications, runbook updates, and test results. Provide a concise checklist you'd expect reviewers to validate.

Unlock Full Question Bank

Get access to hundreds of Version Control for Infrastructure Code interview questions and detailed answers.

Join thousands of developers preparing for their dream job.