Cicd
52 bites tagged Cicd — interview questions with model answers, and 60-second explainers.
Describe secure secret injection into Kubernetes containers during CI/CD
Tests production secret injection hygiene in Kubernetes CI/CD. Strong answers: external secret store at deploy time, volume mounts over env vars, etcd encryption, RBAC least privilege, and rotation.
What is Twelve-Factor's config recommendation for CI/CD and scalability?
Tests Factor III and CI/CD scaling implications. Strong answer: config lives in env vars, never in code, so one build promotes across stages and new instances start with correct context immediately. Red flag: config files checked into version control.
Design a CI/CD pipeline for ephemeral feature branch environments
This tests dynamic infrastructure lifecycle modeling in CI/CD. A strong answer covers branch-triggered provisioning, dynamic naming, automatic cleanup via stop jobs, and cost controls. Red flag: proposing manual teardown or static environments per branch.
Describe the Terraform workflow from code to live
This tests Terraform workflows beyond local commands. A strong answer covers: version-controlled code, terraform plan for speculative validation, then terraform apply via remote runs with policies. Red flag: only local apply without reviews or remote state.
How would you use PaC to introduce pipeline parallelism?
Tests splitting a sequential Jenkinsfile into independent Declarative parallel stages. Group tests and scans in a parallel block with stage-level agents, use matrix for cross-axis work, and version the Jenkinsfile.
Declarative vs scripted pipeline syntax: when to choose each?
This tests Jenkins Pipeline trade-off judgment. Contrast Declarative's opinionated blocks and guardrails with Scripted's raw Groovy flexibility; prefer Declarative for new projects unless complex flow control is needed.
How do you manage multi-arch container images under a single tag?
This tests image distribution and registry semantics. A strong answer covers manifest lists pointing to per-arch digests, Buildx as the builder driver, and the registry serving correct layer blobs.
How do you version Docker images: Git SHA or SemVer?
Your grasp of immutable artifacts and traceability versus human-readable releases. Tag every build with Git SHA for immutability, then apply SemVer aliases only on promoted images. Treating floating tags like latest or v1 as safe production targets.
How would you integrate SAST into CI without alert fatigue?
This tests embedding security into workflow without killing velocity. Run SAST per commit, suppress false positives via rulesets, gate on high-severity findings first and block merges only after calibration. A red flag is zero-tolerance blocking on day one.
Container Image Security Scanning
A container image is a frozen filesystem; scanning unpacks layers to flag known CVEs before deployment. Run it in CI/CD after every build and continuously in production registries. Scanning only at build time misses new CVEs in running images.
Vault: Centralized Secrets with Dynamic Leasing
Vault is a secrets firewall: it centralizes credentials and issues short-lived leases instead of static keys. Use it when apps need DB passwords not hardcoded. The footgun is using Vault without audit logs, leaving secrets unmonitored.
Git Tags: Immutable Milestones for Release History
A Git tag is a permanent bookmark on a commit, usually marking releases like v2.0. Annotated tags store author, date, and GPG signatures to anchor deploy pipelines.
Continuous Delivery: Ship Reliably, Anytime
Continuous Delivery (CD) makes software releases a boring, routine event. Your codebase is always in a deployable state, allowing you to ship small, incremental updates reliably and at any time. The footgun is confusing it with Continuous Deployment.
Release Candidate: The Final Dress Rehearsal
A Release Candidate (RC) is the final dress rehearsal before a software launch—a version believed to be stable enough to ship. It's used for final validation to catch show-stopping bugs.
Secrets Management: Beyond Environment Variables
Treat secrets like cattle, not pets: they should be temporary and replaceable. Use a central vault to dynamically inject credentials into apps at runtime, especially in CI/CD and containerized environments.
Lead Time for Changes: From Commit to Production
Lead Time for Changes measures the time from a developer's commit to that code running in production. It's a core DORA metric for assessing DevOps velocity. The key footgun is confusing it with 'Lead Time,' which tracks from idea to delivery.
ML Model Registry: A Version Control System for Models
A model registry is like Git for machine learning models: a central hub to version, store, and manage them. It's crucial for MLOps, letting teams track which version is in production, compare performance, and roll back. The footgun is using it as just storage.
Kustomize: Template-Free Kubernetes Configs
Kustomize manages environment-specific Kubernetes configs by layering patches on a base YAML, avoiding complex templating. Use it to tweak deployments for dev, staging, or prod. The footgun: the `kubectl` version can lag, causing unexpected behavior.
The Vulnerability Management Lifecycle: A Continuous Loop
Think of vulnerability management not as a one-off task, but a continuous cycle of finding, prioritizing, fixing, and verifying security weaknesses. This process is crucial for securing any system by systematically reducing its attack surface.
Helm: The Package Manager for Kubernetes
Helm is the package manager for Kubernetes. It uses a packaging format called Charts to define, install, and upgrade applications, making it the standard way to manage software on a K8s cluster. It is a Cloud Native Computing Foundation (CNCF) project.
Kubernetes Deployment: Declarative App Updates
A Kubernetes Deployment is your app's blueprint. You declare the desired state—like '3 replicas of image v2'—and Kubernetes makes it happen. It's the standard for stateless apps like APIs. The footgun: don't manage Pods directly; manage the Deployment.
Kubernetes Sealed Secrets: Git-Friendly Secret Management
Sealed Secrets let you safely commit encrypted Kubernetes secrets to a public Git repo. A one-way lockbox: anyone can add a secret, but only the target cluster can unlock it. Essential for GitOps, but remember: a Sealed Secret is tied to its cluster.
AWS Secrets Manager: Stop Hardcoding Credentials
AWS Secrets Manager is a digital vault for your app's credentials. Instead of hardcoding API keys or database passwords, your app fetches them at runtime. It's used for storing sensitive data securely, with built-in rotation and auditing.
Ansible: Automating Infrastructure with Playbooks
Ansible is like a recipe book for your servers. You write simple "playbooks" describing a desired state, and Ansible makes it happen over SSH without installing agents. It's ideal for configuration management, app deployment, and orchestrating workflows.
Get Cicd bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.