Search
Find a bite, explore a topic or look for a role.
Results for “Kubernetes”
Bites 384
Zero-downtime blue-green deploys on Kubernetes
Run blue and green deployments, switch a Service or ingress selector to the new color after readiness probes pass, drain old pods gracefully, and handle backward-compatible DB migrations.
Managing secrets for containerized Node.js on Kubernetes
Use Kubernetes Secrets or an external vault, mount as files not env, encrypt at rest, rotate.
Are base64-encoded Kubernetes Secrets actually secure?
Base64 is reversible, not a protection; default guards against accidental shoulder-surfing only; real defenses are encryption-at-rest, RBAC, audit.
Configure a Kubernetes Horizontal Pod Autoscaler
HPA adjusts replica count toward a target CPU metric, needs the metrics server and pod resource requests, and scales a deployment between min and max.
Isolate tenants in a shared Kubernetes cluster
Namespaces as the boundary, ResourceQuotas plus LimitRanges to cap compute, default-deny NetworkPolicies for traffic, and RBAC per namespace.
Exposing Kubernetes services to the internet
A Service gives stable access and LoadBalancer exposes one service, while Ingress adds L7 host and path routing with TLS for many services.
Kubernetes Deployment versus Pod
A Pod is the smallest disposable unit, a Deployment maintains a desired replica count, self-heals, and rolls out updates.
Istio Gateway vs Kubernetes Ingress
Ingress is a simple built-in L7 entry abstraction; an Istio Gateway configures only ports and hosts at the edge while VirtualServices do routing, unlocking mesh features.
Core components of a Kubernetes Operator
A CRD defines the type, a controller watches instances via the API server and runs a reconcile loop, encoding operational knowledge to drive real state.
Why Kubernetes Services exist
Pod IPs are ephemeral and change on reschedule; a Service gives a stable virtual IP and DNS name plus load balancing across healthy Pods via label selectors.
The Kubernetes reconciliation loop
A controller continuously observes actual state, compares to desired state in the spec, and acts to close the gap, level-triggered not edge-triggered.
What trade-offs decide managed ML platforms versus open-source Kubernetes?
Weigh total cost plus hidden engineering headcount, lock-in vs flexibility, and audit feature gaps.
Design training job submission to a shared Kubernetes cluster
Gateway with artifact caching; namespace quotas; GPU schedulers like Volcano; Prometheus metrics and cost attribution.
OLM: Kubernetes' App Store for Operators
OLM is the app store for Kubernetes Operators: it installs, updates, and resolves dependencies declaratively. Use it when managing third-party or custom Operators across clusters.
Design a secure multi-tenant CI/CD runner on Kubernetes
Apply namespaces, NetworkPolicies, Pod Security Standards; cap resources with ResourceQuotas and LimitRanges; schedule to dedicated or sandboxed nodes.
How would you use GitOps to manage Kubernetes cluster lifecycles?
This tests cluster lifecycle GitOps, not just app delivery. A strong answer uses Flux plus Cluster API on a hub cluster, stores cluster definitions in Git, and rolls upgrades via MachineDeployments.
How would you use a Kubernetes Admission Controller as CI/CD security gate?
Tests pre-deployment enforcement via admission webhooks. Strong answers: ValidatingAdmissionWebhooks blocking bad manifests, Pod Security Standards restricted profiles, and OPA/Gatekeeper for image signatures. Red flag: confusing with RBAC or runtime scanning.
Design a zero-downtime Kubernetes Deployment strategy for a stateless microservice
Set RollingUpdate with maxSurge 1 and maxUnavailable 0; use readiness probes to gate traffic; set terminationGracePeriodSeconds and preStop to drain requests.
How do you diagnose and fix a Kubernetes OOMKilled application?
Tests cgroup enforcement versus scheduling. A strong answer verifies OOMKilled, compares limits to usage, then rightsizes requests to baseline and limits with headroom. Red flag: confusing requests with caps or blindly raising limits.
Compare Kubernetes Secrets versus environment variables for Pod credentials
Tests Kubernetes credential threat model across etcd and Git. Plain env vars leak into manifests and process lists; Secrets enable RBAC but are base64 by default and visible to nodes and authorized readers. Red flag: claiming Secrets are encrypted by default.