Kubernetes
293 bites tagged Kubernetes — interview questions with model answers, and 60-second explainers.
Kubernetes Deployment versus Pod
A Pod is the smallest disposable unit, a Deployment maintains a desired replica count, self-heals, and rolls out updates. Kubernetes controllers and self-healing. bare Pods expected to be recreated after a crash.
Designing for portability across two clouds
Abstract via containers, Terraform, and open standards; avoid proprietary managed services. portability versus lock-in judgment. chasing portability for its own sake while ignoring the velocity and cost penalty it imposes.
Persistent Volume and Persistent Volume Claim
Kubernetes separates storage provisioning from consumption. A PersistentVolume is a cluster storage resource an admin or driver provisions; a PersistentVolumeClaim is a pod's request for storage.
How mounted ConfigMap updates propagate to pods
Kubelet refreshes mounted files within roughly a sync period via an atomic symlink swap, but the app must reload on its own; env-var injection never updates. ConfigMap volume update semantics.
Scaling on queue length with the HPA
Expose queue length through an external metrics adapter behind the metrics API, point the HPA at that external metric with a target per pod; KEDA packages this. external-metric autoscaling.
Impact of losing etcd quorum
Without quorum etcd goes read-only-ish and the API server cannot persist writes, so scheduling and changes stall, but kubelets keep running existing pods. control vs data plane separation.
Istio Gateway vs Kubernetes Ingress
Ingress is a simple built-in L7 entry abstraction; an Istio Gateway configures only ports and hosts at the edge while VirtualServices do routing, unlocking mesh features. edge traffic models.
Guardrails for GitOps sync outages
Pre-merge schema validation, dry-run, policy gates and review; post-merge progressive sync, health checks with automated rollback, and pruning controls. layered safeguards around GitOps.
Canary release with Istio traffic splitting
DestinationRule defines subsets by label, VirtualService routes weighted 90/10 to those subsets, then shift weights as the canary proves healthy. Istio traffic management.
What a service mesh solves
It adds traffic management, security via mTLS, and observability at the network layer through sidecars, beyond what plain Kubernetes offers. the purpose of a mesh.
Preventing split-brain in HA Operators
Run active-passive replicas, only the leader reconciles, election uses a Lease object renewed under a TTL. leader election in controllers. thinking all replicas reconcile in parallel or relying on optimistic locking alone.
Mutating vs Validating webhooks with an Operator
Mutating runs first to inject defaults or sidecars, validating runs after to reject bad specs, both keyed to your CRD. knowledge of the admission chain. confusing the ordering or roles.
Keeping operator .status accurate under failures
Status can lag or go stale during partitions and crashes; make reconcile idempotent, observe true state each loop, use conditions and observedGeneration, handle conflicts. status reliability under faults.
When to build an Operator vs a Helm chart
Charts handle install-time templating; operators add continuous day-two logic like failover, backups, and scaling for stateful apps. tool selection judgment. building an operator for a stateless app a chart would handle.
Adding a required field to a live CRD
Don't make it required immediately; add it optional with a default, introduce a new version with conversion, migrate existing objects, then tighten. CRD schema evolution.
Finalizers for clean external cleanup
A finalizer is a key blocking deletion; deletion sets deletionTimestamp, the operator does cleanup then removes the finalizer so the object is purged. pre-deletion hooks.
The reconciliation loop in an Operator
Reconcile compares desired spec to observed state and converges them, idempotently; triggered by resource changes, watched dependents, and periodic resync. the control-loop model.
Creating an instance of a custom resource
Write a manifest with apiVersion (group/version), kind, metadata.name, and a spec matching the CRD schema, then kubectl apply -f it. using a CRD. omitting the group in apiVersion or applying before the CRD is registered.
Core components of a Kubernetes Operator
A CRD defines the type, a controller watches instances via the API server and runs a reconcile loop, encoding operational knowledge to drive real state. operator architecture.
What is a Custom Resource Definition?
A CRD registers a new resource kind so the API server stores and serves it like built-ins; it lets you model domain concepts declaratively. extending the Kubernetes API. confusing the CRD with the controller that acts on it.
Argo CD App of Apps pattern
A parent Application whose manifests are themselves Application resources, so syncing one app declaratively manages many. scaling GitOps management. confusing it with ApplicationSet or with multi-source apps.
Managing secrets in a GitOps workflow
Never commit plaintext; encrypt with Sealed Secrets or SOPS, or reference an external store via External Secrets Operator. secrets in declarative pipelines. base64-encoding a Secret and calling it secure.
Helm upgrade and rollback workflow
Helm upgrade creates a new revision; helm history lists revisions; helm rollback reverts to a prior one; --atomic auto-rolls-back on failure. Helm release lifecycle. reinstalling or deleting the release instead.
Override Helm values at install time
Pass custom files with -f or --values, single keys with --set, and know precedence: defaults, then files, then --set. Helm values overriding. editing the chart templates directly instead of supplying values.
Get Kubernetes bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.