Kubernetes
293 bites tagged Kubernetes — interview questions with model answers, and 60-second explainers.
CRDs and the Operator pattern
CRDs add new API object types, an Operator pairs a CRD with a controller that runs a reconciliation loop encoding domain operational knowledge. extending Kubernetes declaratively.
Scheduler filtering and scoring phases
Filtering eliminates infeasible Nodes via resources, taints, and affinity, then scoring ranks the survivors to pick the best, after which the Pod is bound. how Pods get placed on Nodes.
Deployment versus StatefulSet
Deployments suit interchangeable stateless replicas, StatefulSets give stable identities, ordered rollout, and per-Pod persistent storage for stateful systems. choosing the right workload controller.
The Kubernetes reconciliation loop
A controller continuously observes actual state, compares to desired state in the spec, and acts to close the gap, level-triggered not edge-triggered. the declarative control loop pattern.
etcd as the cluster source of truth
Etcd is the consistent key-value store holding all cluster state, accessed only via the apiserver, and uses Raft needing a quorum. understanding the cluster state store.
What happens after kubectl apply
Apiserver validates and persists to etcd, scheduler binds the Pod to a Node, kubelet pulls the image and starts the container via the runtime, status flows back. the request-to-running flow across components.
Minimal objects to expose a stateless app
A Deployment to run and self-heal replicas plus a Service to give a stable endpoint, exposed externally via type LoadBalancer or NodePort, or an Ingress. mapping requirements to core objects.
Core control plane components
Api-server as the front door, etcd as state store, scheduler placing pods, and controller-manager running reconciliation loops, plus cloud-controller-manager. knowledge of cluster brain components.
Node, Pod, and Container relationship
A Node is a machine, a Pod is the smallest deployable unit wrapping one or more containers that share network and storage, and the Pod abstraction enables co-location and lifecycle management. the core scheduling unit hierarchy.
Reducing cross-region image pull costs
A per-region pull-through cache or geo-replicated registry serves pulls locally, cutting latency and egress, traded against consistency lag, storage cost, and cache management. registry topology for multi-region pulls.
Debugging ImagePullBackOff on a private registry
ImagePullSecrets reference a dockerconfigjson Secret on the pod or service account, kubelet uses it to authenticate, and you inspect events to isolate auth versus name versus network errors. registry auth and systematic debugging.
Why :latest is a production anti-pattern
Latest is mutable so pods run different code, rollbacks and pull policy break, and you should use immutable version tags or digests. deployment determinism and reproducibility.
Automate a canary release with a 1% 5xx error threshold
This tests wiring an SLO into an automated canary loop. A strong answer covers traffic splitting via a mesh or ingress, an analysis query to Prometheus for 5xx rate, and auto-promote or abort logic.
Explain GitOps and how an agent knows when to apply changes
Tests declarative infrastructure and pull-based reconciliation. A strong answer says Git is the source of truth and the agent polls or watches for drift, then applies diffs. Red flag: calling a push-based CI pipeline GitOps.
Describe the difference between a Deployment and a StatefulSet
Tests stateful pod identity versus stateless scaling. Outline: contrast Deployments' interchangeable replicas with StatefulSets' stable hostnames, per-pod PVCs, and ordered rollout; give a database example.
What is the difference between a Service and an Ingress?
This tests L4 versus L7 networking abstractions. A good answer says Services load-balance to Pods internally while Ingresses route external HTTP to Services via a controller, then gives a path-based scenario.
Propose an architectural solution for contended GPU training resources
Tests multi-tenant GPU scheduling design at scale. Great answers tier jobs by checkpointability, apply quota-based preemption, mix spot and on-demand instances, and use MIG or time-slicing to bin-pack. Red flag: buying GPUs without scheduling logic.
Design a multi-tenant ML platform with isolation, security, and cost attribution
Tests mapping tenancy to compute, network, and identity primitives. Strong answers compare hard vs soft isolation, use namespaces or node pools with network policies and IAM, and enforce chargeback via resource quotas and labels.
What trade-offs decide managed ML platforms versus open-source Kubernetes?
Weigh total cost plus hidden engineering headcount, lock-in vs flexibility, and audit feature gaps. Ops overhead vs speed for ML infra. Recommending open-source purely to cut cost while ignoring the 2-4 person tax.
Design multi-tenant GPU cluster scheduling and preemption policies
Tests ability to design fair GPU scheduling preventing starvation and noisy-neighbor issues. Answer: Kueue for fair-share, namespace quotas with MIG, priority classes with backoff.
Compare Airflow and Kubeflow for ML training pipelines
Tests orchestrator-to-workload fit. Strong answers contrast Airflow's data integration and Python DAGs with Kubeflow's K8s scaling, container reproducibility, and experiment tracking. Red flag: claiming one is always better without stage-specific reasoning.
Design training job submission to a shared Kubernetes cluster
Gateway with artifact caching; namespace quotas; GPU schedulers like Volcano; Prometheus metrics and cost attribution. Multi-tenant ML infrastructure with usability, fairness, observability.
Design on-demand containerized dev environments for data scientists
Tests multi-tenant notebook infrastructure design. Cover a Notebook Controller, curated Jupyter and VS Code images, namespace isolation with RBAC, resource quotas, and persistent storage. Red flag: a single shared VM without tenancy or idle shutdown.
Inference Health Checks: Traffic Gates, Not Heartbeats
An inference server's health check is a traffic gate, not a heartbeat. Kubernetes uses it to route requests only after the model is loaded. The footgun is probing the root path, which stays green even when the model has crashed or the GPU is wedged.
Get Kubernetes bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.