Kubernetes
293 bites tagged Kubernetes — interview questions with model answers, and 60-second explainers.
How do you stop new Pods scheduling on a node?
Kubectl cordon marks the node unschedulable so no new Pods land, while existing Pods keep running; drain is the follow-up that also evicts them. node maintenance basics.
How do you pin a Pod to nodes with a given label?
The simplest tool is nodeSelector, a key-value map in the Pod spec requiring matching node labels; node affinity is the richer alternative for complex rules. basic node selection.
Requests vs limits for CPU and memory?
Requests guide scheduling and reservation, limits cap usage; exceeding a CPU limit throttles the container, while exceeding a memory limit triggers an OOMKill since memory is incompressible. resource management basics.
How do you resize a live PersistentVolume?
Edit the PVC's requested size upward; the StorageClass must set allowVolumeExpansion true and the CSI driver must support expansion, ideally online so no Pod restart is needed; shrinking is not allowed. online volume expansion.
How does a StatefulSet recover a Pod after node failure?
Node goes NotReady, Pod is marked for deletion, the same-ordinal Pod is recreated and reattaches its existing PVC from volumeClaimTemplates, preserving data; safety needs the old Pod confirmed… failure recovery for stateful workloads.
Why is a Pod with a PVC stuck Pending?
PVC may be unbound from missing StorageClass, no matching PV, mismatched access mode or size, zone or capacity limits, or WaitForFirstConsumer; diagnose with describe on Pod and PVC plus events. storage troubleshooting.
How does a StatefulSet give stable identity and storage?
Ordinal Pod names plus a headless Service yield stable per-Pod DNS; volumeClaimTemplates give each ordinal its own persistent PVC that follows it on reschedule. the mechanics behind StatefulSet guarantees.
What do PersistentVolume accessModes mean?
RWO mounts read-write by one node, ROX read-only by many nodes, RWX read-write by many nodes; block storage usually only supports RWO while shared filesystems enable RWX. access mode semantics.
What is a StorageClass and dynamic provisioning?
A StorageClass names a provisioner and parameters; a PVC referencing it triggers on-demand PV creation, so admins do not pre-create volumes. dynamic provisioning.
StatefulSet vs Deployment: what's the difference?
Deployments treat Pods as interchangeable; StatefulSets give stable ordinal names, stable per-Pod storage via volumeClaimTemplates, and ordered rollout. choosing the right workload controller.
What happens to volume data when a Pod is deleted?
EmptyDir is tied to the Pod and erased when the Pod is deleted; a PVC-backed PV with Retain keeps the data after the PVC is released for manual recovery. volume lifecycle awareness.
What are PersistentVolumes and PersistentVolumeClaims for?
A PV is a cluster storage resource the admin provisions; a PVC is a user's request for size and access mode; Kubernetes binds them, decoupling Pods from storage details. the storage abstraction split.
How do Sealed Secrets enable GitOps for secrets?
Kubeseal encrypts a Secret with the controller's public key into a SealedSecret CR safe for Git; only the in-cluster controller's private key can decrypt it into a real Secret. asymmetric-crypto GitOps pattern.
What do immutable ConfigMaps and Secrets solve?
Setting immutable true blocks data edits, preventing accidental updates and letting the kubelet skip watches, reducing API server load. knowledge of the immutable field.
How do you inject secrets from an external store at runtime?
Use a sidecar injector or CSI driver that authenticates via the Pod's ServiceAccount token, fetches secrets at runtime, and mounts them on tmpfs. external secret-management patterns.
How do you restrict a Pod's access to a Secret?
Pods read Secrets through their ServiceAccount and RBAC, scoped with resourceNames; mounted Secrets are governed by the Pod spec. how Pods get Secret access via identity.
How do you let Pods pull from a private registry?
Create a dockerconfigjson Secret with registry creds; reference it via imagePullSecrets on the Pod or ServiceAccount. knowledge of image-pull secrets.
Are base64-encoded Kubernetes Secrets actually secure?
Base64 is reversible, not a protection; default guards against accidental shoulder-surfing only; real defenses are encryption-at-rest, RBAC, audit. understanding that encoding is not encryption.
Configure a Kubernetes Horizontal Pod Autoscaler
HPA adjusts replica count toward a target CPU metric, needs the metrics server and pod resource requests, and scales a deployment between min and max. Kubernetes autoscaling mechanics.
Debug intermittent pod-to-pod connectivity
Scope the failure by path, rule out DNS, inspect kube-proxy iptables and conntrack, check the CNI, then verify cloud security groups and MTU. systematic network debugging. restarting pods with no hypothesis.
Isolate tenants in a shared Kubernetes cluster
Namespaces as the boundary, ResourceQuotas plus LimitRanges to cap compute, default-deny NetworkPolicies for traffic, and RBAC per namespace. layered multi-tenancy. treating a namespace alone as a hard security boundary.
Grant an EKS pod IAM access to S3
IRSA maps a service account to an IAM role via the cluster OIDC provider, and pods exchange a projected token for short-lived STS credentials. secure workload identity. hardcoding keys or sharing the node profile.
Running stateful apps with StatefulSets
Stateful apps need stable identity and storage; a StatefulSet gives stable names, ordered rollout, and per-Pod volumes. stateful workloads in Kubernetes. claiming a Deployment plus PVC solves it.
Exposing Kubernetes services to the internet
A Service gives stable access and LoadBalancer exposes one service, while Ingress adds L7 host and path routing with TLS for many services. Kubernetes networking layers. conflating the two, or one LB per service.
Get Kubernetes bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.