Search
Find a bite, explore a topic or look for a role.
Results for “Kubernetes”
Bites 386
Kubernetes 1.37 adds a native unused-PVC condition
Kubernetes 1.37 promotes PVC unused tracking to Beta, adding an Unused condition managed by the PVC protection controller.
Zero-downtime blue-green deploys on Kubernetes
Run blue and green deployments, switch a Service or ingress selector to the new color after readiness probes pass, drain old pods gracefully, and handle backward-compatible DB migrations.
Managing secrets for containerized Node.js on Kubernetes
Use Kubernetes Secrets or an external vault, mount as files not env, encrypt at rest, rotate.
Are base64-encoded Kubernetes Secrets actually secure?
Base64 is reversible, not a protection; default guards against accidental shoulder-surfing only; real defenses are encryption-at-rest, RBAC, audit.
Configure a Kubernetes Horizontal Pod Autoscaler
HPA adjusts replica count toward a target CPU metric, needs the metrics server and pod resource requests, and scales a deployment between min and max.
Isolate tenants in a shared Kubernetes cluster
Namespaces as the boundary, ResourceQuotas plus LimitRanges to cap compute, default-deny NetworkPolicies for traffic, and RBAC per namespace.
Exposing Kubernetes services to the internet
A Service gives stable access and LoadBalancer exposes one service, while Ingress adds L7 host and path routing with TLS for many services.
Kubernetes Deployment versus Pod
A Pod is the smallest disposable unit, a Deployment maintains a desired replica count, self-heals, and rolls out updates.
Istio Gateway vs Kubernetes Ingress
Ingress is a simple built-in L7 entry abstraction; an Istio Gateway configures only ports and hosts at the edge while VirtualServices do routing, unlocking mesh features.
Core components of a Kubernetes Operator
A CRD defines the type, a controller watches instances via the API server and runs a reconcile loop, encoding operational knowledge to drive real state.
Why Kubernetes Services exist
Pod IPs are ephemeral and change on reschedule; a Service gives a stable virtual IP and DNS name plus load balancing across healthy Pods via label selectors.
The Kubernetes reconciliation loop
A controller continuously observes actual state, compares to desired state in the spec, and acts to close the gap, level-triggered not edge-triggered.
What trade-offs decide managed ML platforms versus open-source Kubernetes?
Weigh total cost plus hidden engineering headcount, lock-in vs flexibility, and audit feature gaps.
Design training job submission to a shared Kubernetes cluster
Gateway with artifact caching; namespace quotas; GPU schedulers like Volcano; Prometheus metrics and cost attribution.
OLM: Kubernetes' App Store for Operators
OLM is the app store for Kubernetes Operators: it installs, updates, and resolves dependencies declaratively. Use it when managing third-party or custom Operators across clusters.
Design a secure multi-tenant CI/CD runner on Kubernetes
Apply namespaces, NetworkPolicies, Pod Security Standards; cap resources with ResourceQuotas and LimitRanges; schedule to dedicated or sandboxed nodes.
How would you use GitOps to manage Kubernetes cluster lifecycles?
This tests cluster lifecycle GitOps, not just app delivery. A strong answer uses Flux plus Cluster API on a hub cluster, stores cluster definitions in Git, and rolls upgrades via MachineDeployments.
How would you use a Kubernetes Admission Controller as CI/CD security gate?
Tests pre-deployment enforcement via admission webhooks. Strong answers: ValidatingAdmissionWebhooks blocking bad manifests, Pod Security Standards restricted profiles, and OPA/Gatekeeper for image signatures. Red flag: confusing with RBAC or runtime scanning.
Design a zero-downtime Kubernetes Deployment strategy for a stateless microservice
Set RollingUpdate with maxSurge 1 and maxUnavailable 0; use readiness probes to gate traffic; set terminationGracePeriodSeconds and preStop to drain requests.
How do you diagnose and fix a Kubernetes OOMKilled application?
Tests cgroup enforcement versus scheduling. A strong answer verifies OOMKilled, compares limits to usage, then rightsizes requests to baseline and limits with headroom. Red flag: confusing requests with caps or blindly raising limits.