Kubernetes
293 bites tagged Kubernetes — interview questions with model answers, and 60-second explainers.
What is the basic principle of GitOps?
Git holds desired state; a controller continuously reconciles the cluster to match it; benefits are auditability, rollback, and drift correction. declarative continuous delivery. describing push-based scripts as GitOps.
What is a Helm chart?
A chart is a templated, versioned bundle of manifests with a values file; it solves config duplication and reuse across environments. Kubernetes packaging basics. calling Helm a CI/CD or GitOps tool itself.
Diagnose a Prometheus cardinality explosion
Find offenders via TSDB stats and topk count by __name__, identify unbounded labels, then drop or aggregate them with relabeling. operating Prometheus at scale. just scaling memory without fixing label design.
Two ways to consume a ConfigMap in a Pod
Inject keys as environment variables (good for a few simple settings), or mount the ConfigMap as a volume of files (good for config files and live updates). ConfigMap consumption patterns.
ConfigMap vs Secret
ConfigMaps hold non-sensitive plain config; Secrets hold sensitive data, base64-encoded and treated specially (RBAC, optional encryption at rest). Config-versus-sensitive-data separation.
Ingress resource vs Ingress controller
The Ingress resource is declarative routing rules; the controller is the running proxy (NGINX, etc.) that reads them and serves traffic. Separating config from the engine.
Restricting Pod ingress with a NetworkPolicy
Create a NetworkPolicy with podSelector app=frontend, policyTypes Ingress, and one ingress from-rule matching podSelector role=api-gateway; requires a CNI that enforces policies. NetworkPolicy ingress control.
kube-proxy and iptables vs IPVS modes
Kube-proxy watches Services/endpoints and programs node rules so ClusterIP traffic is DNAT'd to a backend Pod; iptables uses sequential rule chains, IPVS uses a hash table with real… How Service virtual IPs actually route.
Debugging Service connectivity between Pods
Kubectl get endpoints to check the Service has Pod IPs (selector match); kubectl describe service to verify selector and ports; exec into the frontend to curl the Service DNS name. Systematic Service debugging.
Headless Services and direct Pod DNS
Set clusterIP: None so no virtual IP or proxy load balancing; DNS returns individual Pod IPs (A records). Primary use: StatefulSets needing stable per-Pod addressing. Understanding headless Services.
Ingress for host and path routing
Use an Ingress with an Ingress controller for layer-7 host/path routing behind one external IP, instead of one cloud LoadBalancer per service. Knowing when to use Ingress.
Cross-namespace Service DNS resolution
CoreDNS gives each Service a name; cross-namespace you must qualify it as my-service.B.svc.cluster.local (or my-service.B). Knowledge of cluster DNS naming.
ClusterIP vs NodePort vs LoadBalancer
ClusterIP for internal-only access; NodePort opens a port on every node for basic external reach; LoadBalancer provisions a cloud load balancer for production external traffic. Service type selection.
Why Kubernetes Services exist
Pod IPs are ephemeral and change on reschedule; a Service gives a stable virtual IP and DNS name plus load balancing across healthy Pods via label selectors. Grasp of Pod IP instability.
Spreading Pods one-per-node for availability
Use required podAntiAffinity with topologyKey kubernetes.io/hostname matching the Deployment's own pod labels, so the scheduler refuses to co-locate two Pods on a node. Pod anti-affinity knowledge.
Stalled rollouts and progressDeadlineSeconds
With maxUnavailable respected, the rollout pauses partway and old Pods keep serving; progressDeadlineSeconds marks the Deployment as failed after no progress for that window. Understanding stalled rollouts.
Tuning maxSurge and maxUnavailable
MaxSurge allows Pods above desired; maxUnavailable allows Pods below desired during update. For zero downtime and speed, set maxUnavailable 0 and maxSurge high (e.g. 100%). Rollout strategy tuning.
Sharing ephemeral cache between containers in a Pod
Use an emptyDir volume defined in the Pod spec and mounted into each container at the cache path; it is created with the Pod and deleted when the Pod is removed. Choosing the right ephemeral volume.
Liveness vs readiness probes
Liveness restarts a stuck container; readiness gates traffic by controlling Service endpoint membership. Readiness-only fits an app that pauses to reload a large cache but is still healthy. Understanding probe semantics.
Rolling back a bad Deployment
Kubectl rollout undo deployment/NAME reverts to the prior revision by scaling the old ReplicaSet back up and the bad one down. Knowledge of Deployment rollback mechanics.
How a Deployment rolling update works
New image creates a new ReplicaSet; Deployment scales it up while scaling the old one down per maxSurge/maxUnavailable; old ReplicaSet is retained at zero for rollback. Understanding of the Deployment-ReplicaSet relationship.
Debugging a Pod in CrashLoopBackOff
Kubectl describe pod for events, restarts, and last state; kubectl logs (with --previous) for the crashed container's output. Practical Pod debugging instinct.
Create a Deployment with 3 replicas via kubectl
Kubectl create deployment webapp --image=my-app:1.0, then kubectl scale to 3 replicas, or use --replicas if supported. Basic kubectl Deployment fluency.
Deployment, ReplicaSet, and Pod hierarchy
A Deployment manages ReplicaSets, each ReplicaSet keeps a set of identical Pods, and Deployments add rolling updates, rollback, and self-healing. the ownership chain and rollout mechanics.
Get Kubernetes bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.