Kubernetes
293 bites tagged Kubernetes — interview questions with model answers, and 60-second explainers.
Describe secure secret injection into Kubernetes containers during CI/CD
Tests production secret injection hygiene in Kubernetes CI/CD. Strong answers: external secret store at deploy time, volume mounts over env vars, etcd encryption, RBAC least privilege, and rotation.
Chaos Mesh: Orchestrated Failure for Resilient Systems
Chaos Mesh is a disaster-as-a-service for Kubernetes. It lets you inject failures like network latency or pod kills to test system resilience. Use it to find weaknesses before they impact users, but be warned: its job is to break things, so scope experiments…
Hybrid Cloud MLOps: Train Anywhere, Deploy Everywhere
Treat your ML infrastructure like your applications—a consistent platform that runs anywhere, avoiding siloed stacks for data science and app dev. Use it to train on cloud GPUs but deploy on-prem for low latency, ensuring dev/prod parity across environments.
Argo Workflows: Run Complex Jobs on Kubernetes
Think of Argo Workflows as a script runner for Kubernetes, where each command is a container. It runs multi-step jobs like CI/CD or ML pipelines. The footgun is treating it like a full CI server; it's just an engine and lacks features like Git polling.
Load Balancing for Model Serving
A load balancer is a traffic cop for your AI model's API, directing requests to multiple model copies to prevent overload. It's essential for production systems to ensure high availability. The footgun is forgetting health checks, causing failed requests.
Kubeflow: MLOps on Kubernetes
Kubeflow brings the declarative, container-based world of Kubernetes to the entire ML lifecycle. It provides tools for building portable and scalable ML workflows, from development to production serving.
Kubebuilder: Build Kubernetes APIs the Canonical Way
Kubebuilder is a framework for scaffolding custom Kubernetes APIs, letting you define your own resources like `MyWebApp`. Use it to extend Kubernetes with declarative APIs, making your app a first-class citizen.
OPA Gatekeeper: Enforce Kubernetes Policies as Code
OPA Gatekeeper is a Kubernetes admission controller using OPA to enforce policies on resources. Use it to mandate labels or block insecure images. The footgun is thinking it's just OPA; Gatekeeper adds K8s-native CRDs, auditing, and mutation capabilities.
Pod Topology Spread: Spreading Pods for High Availability
Pod Topology Spread Constraints prevent putting all your pods in one basket. They instruct the scheduler to distribute a service's pods evenly across nodes or zones, improving availability. The main footgun is that it's a soft preference by default.
CSI Volume Cloning: `cp` for Kubernetes Volumes
Think of volume cloning as `cp` for your Kubernetes data. It creates a new, independent volume pre-populated with data from an existing one, offloading the copy operation to your storage provider.
Kubernetes Secrets: Encrypting Data at Rest
By default, Kubernetes Secrets are only base64-encoded, not encrypted. Encryption at rest makes the API server encrypt Secret data before saving to etcd, protecting against compromised backups.
Kubernetes Gateway API: The Successor to Ingress
The Gateway API replaces Kubernetes Ingress with a role-oriented model, separating infrastructure from application routing. Use it when different teams need to manage their own traffic rules.
kube-apiserver: The Front Door to Your Kubernetes Cluster
The kube-apiserver is the front door to your Kubernetes control plane. All requests to query or modify the cluster's state must pass through it, from `kubectl` commands to automated controller actions. The footgun is bypassing it to modify `etcd` directly.
Kubernetes' Declarative Model: Desired vs. Actual State
The declarative model is like telling Kubernetes your destination, not giving it turn-by-turn directions. You define the desired state in a file, and Kubernetes works to make it a reality. This enables self-healing and GitOps.
Private Container Registry: Own Your Image Pipeline
A private container registry is your own personal Docker Hub, giving you full control over image storage and access. It's crucial for secure, in-house CI/CD pipelines.
Egress Gateway: Control Your Mesh's Outbound Traffic
An Egress Gateway is a monitored exit door for all outbound traffic from your service mesh. Use it to enforce security on external calls, like restricting domains or originating mTLS.
Service Mesh Authorization: A Bouncer for Your Microservices
A service mesh authorization policy is a bouncer for your microservices. It moves access control from your app to the mesh, checking service identity and request details like HTTP method and path. Use it for fine-grained, Zero Trust security.
Content-Based Routing: Directing Traffic by Request Details
Content-based routing is a smart traffic cop for your services. It inspects request headers or URIs to direct traffic, enabling canary releases or A/B tests. The footgun is rule order: a broad rule placed first can shadow specific rules below it.
Traffic Splitting: Route Live Traffic Between Service Versions
Traffic splitting directs percentages of live user traffic to different versions of a service. It's key for canary releases, letting you test new code on a small user group before a full rollout.
Mutual TLS (mTLS): When Services Need to Trust Each Other
mTLS is a two-way ID check for services. Both parties exchange certificates to prove their identity before communicating. Service meshes like Istio use it to secure traffic between microservices.
SPIFFE: Cryptographic Identity for Services
SPIFFE gives every service a cryptographic passport instead of a static secret. It's used in zero-trust networks for services to authenticate each other, like in a Kubernetes service mesh.
Service Mesh Ingress: The Doorkeeper for Your Mesh
A Service Mesh Ingress Gateway is the dedicated entry point for external traffic into your mesh. It lets you apply advanced routing, security, and observability policies at the boundary, like TLS termination or traffic splitting.
The Sidecar Pattern: Your App's Helper Container
The Sidecar pattern attaches a helper container to your main application, like a sidecar on a motorcycle. It handles peripheral tasks like logging or networking, letting you add features without changing the app's code.
Control Plane vs. Data Plane: The Brain and the Brawn
Think of a system as having a brain and a body. The Control Plane is the brain, making decisions and setting rules. The Data Plane is the body, executing those rules on actual data or traffic, like in a service mesh's network of proxies.
Get Kubernetes bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.