All bites
The whole library, newest first. Filter by what you are here for, or pick a topic if you already know.
4330 bites
Page 98
Dynamically generate CI/CD pipelines
A detection step scans for marker files and maps them to reusable stage templates assembled at runtime; trade off convention/DRY against reduced transparency and harder debugging.
What is IaC and its CI/CD benefits over manual provisioning?
Cover descriptive models, idempotency, and on-demand environments for repeatable CI/CD.
Explain the difference between declarative and imperative IaC.
Contrast Terraform with Bash or Ansible; note drift detection, idempotency, and state trade-offs.
Describe the Terraform workflow from code to live
This tests Terraform workflows beyond local commands. A strong answer covers: version-controlled code, terraform plan for speculative validation, then terraform apply via remote runs with policies. Red flag: only local apply without reviews or remote state.
How do you manage secrets within IaC configurations?
This tests secret injection and the security-complexity tradeoff in IaC. A strong answer contrasts a cloud secret manager with encrypted files or env vars, covering rotation and blast radius. A red flag is plaintext secrets in Git or state files.
Explain Terraform state, why managing it is critical, and team best practices
Tests if you know state maps config to real resources and tracks metadata. Strong answers cover remote backends with locking and encryption, never Git. Red flag: local state or ignoring that state files contain secrets.
Design a CI/CD pipeline for ephemeral feature branch environments
This tests dynamic infrastructure lifecycle modeling in CI/CD. A strong answer covers branch-triggered provisioning, dynamic naming, automatic cleanup via stop jobs, and cost controls. Red flag: proposing manual teardown or static environments per branch.
Define configuration drift in IaC. How do you detect and remediate it?
This tests state divergence between declared and live infrastructure. A strong answer defines drift as deviation from the IaC source of truth, proposes automated scanning for detection, and recommends reconciliation or redeployment.
Infrastructure apply fails midway. What is the state and your immediate steps?
This tests partial-state reasoning and safe recovery. A strong answer halts automation, inspects state for blast radius, then chooses idempotent roll-forward or rollback with canary validation.
Compare Terraform and Ansible: when to use each and both together
This tests whether you distinguish provisioning from config management. Strong answers define Terraform for immutable infra and Ansible for mutable state, contrast day 0 versus day 1-2 work, and cover Terraform for VMs and Ansible for setup.
How do you manage environment-specific connection strings and why is hardcoding bad?
Tests config separation and secrets hygiene. Outline: inject via environment variables or a secret store, keep per-environment configs credential-free, and prefer managed identities.
Why avoid committing secrets to Git, and secure local alternatives?
This tests basic secret hygiene and environment isolation. A strong answer notes Git history is immutable and distributed, so secrets persist in forks forever, and proposes environment variables or gitignored dotenv files.
What is Twelve-Factor's config recommendation for CI/CD and scalability?
Tests Factor III and CI/CD scaling implications. Strong answer: config lives in env vars, never in code, so one build promotes across stages and new instances start with correct context immediately. Red flag: config files checked into version control.
Describe secure secret injection into Kubernetes containers during CI/CD
Tests production secret injection hygiene in Kubernetes CI/CD. Strong answers: external secret store at deploy time, volume mounts over env vars, etcd encryption, RBAC least privilege, and rotation.
How does your app authenticate with secrets management and solve secret zero?
This tests platform trust chains and the bootstrap credential problem. A strong answer names IAM, Kubernetes, or AppRole auth, explains platform attestation, and uses short-lived tokens.
Compare GitOps and Kustomize vs Ansible for environment configs
Tests declarative vs imperative trade-offs. Contrast GitOps drift detection with Ansible's imperative flexibility. Note Kustomize overlays for K8s vs Ansible's broader reach.
Prevent developer access to production secrets while preserving debuggability
Use dynamic short-lived credentials, break-glass with dual-control audit, and structured telemetry or synthetic transactions for debugging.
How do you securely manage and inject Helm secrets in CI/CD?
Tests secret lifecycle trade-offs in GitOps. Strong answers compare SOPS-encrypted values in Git, direct Vault injection for dynamic secrets, and External Secrets Operator to decouple secrets from charts.
Walk me through a production-ready Dockerfile for a web app
Tests multi-stage builds, layer caching, and security hardening. A strong answer covers a pinned slim FROM, multi-stage separation of build and runtime, ordered COPY for cache, and a non-root USER.
What is the difference between a Service and an Ingress?
This tests L4 versus L7 networking abstractions. A good answer says Services load-balance to Pods internally while Ingresses route external HTTP to Services via a controller, then gives a path-based scenario.