CI/CD &amp; Automation

How would you use PaC to introduce pipeline parallelism?

Tests splitting a sequential Jenkinsfile into independent Declarative parallel stages. Group tests and scans in a parallel block with stage-level agents, use matrix for cross-axis work, and version the Jenkinsfile.

Implement a manual approval gate for production deployment in pipeline-as-code

This tests embedding human governance in automated pipelines with auditability. A strong answer covers environment-scoped approvals, timeouts, RBAC, and immutable logs. Red flag: Ad-hoc manual deploys outside the pipeline or missing rollback plans.

Standardize and update CI/CD across hundreds of microservices without per-repo edits

Repos use a thin wrapper importing versioned shared-library templates; a control plane rolls out updates with canary validation.

Discuss security implications of developer-defined PaC pipelines

It tests balancing CI/CD flexibility with defense-in-depth against secret exfiltration. Cover scoped build identities, branch policies, approval gates, and sandboxed fork builds. Red flag: shared service connections or unrestricted pipeline admin rights.

Dynamically generate CI/CD pipelines

A detection step scans for marker files and maps them to reusable stage templates assembled at runtime; trade off convention/DRY against reduced transparency and harder debugging.

What is IaC and its CI/CD benefits over manual provisioning?

Cover descriptive models, idempotency, and on-demand environments for repeatable CI/CD.

Explain the difference between declarative and imperative IaC.

Contrast Terraform with Bash or Ansible; note drift detection, idempotency, and state trade-offs.

Describe the Terraform workflow from code to live

This tests Terraform workflows beyond local commands. A strong answer covers: version-controlled code, terraform plan for speculative validation, then terraform apply via remote runs with policies. Red flag: only local apply without reviews or remote state.

How do you manage secrets within IaC configurations?

This tests secret injection and the security-complexity tradeoff in IaC. A strong answer contrasts a cloud secret manager with encrypted files or env vars, covering rotation and blast radius. A red flag is plaintext secrets in Git or state files.

Explain Terraform state, why managing it is critical, and team best practices

Tests if you know state maps config to real resources and tracks metadata. Strong answers cover remote backends with locking and encryption, never Git. Red flag: local state or ignoring that state files contain secrets.

Design a CI/CD pipeline for ephemeral feature branch environments

This tests dynamic infrastructure lifecycle modeling in CI/CD. A strong answer covers branch-triggered provisioning, dynamic naming, automatic cleanup via stop jobs, and cost controls. Red flag: proposing manual teardown or static environments per branch.

Define configuration drift in IaC. How do you detect and remediate it?

This tests state divergence between declared and live infrastructure. A strong answer defines drift as deviation from the IaC source of truth, proposes automated scanning for detection, and recommends reconciliation or redeployment.

Infrastructure apply fails midway. What is the state and your immediate steps?

This tests partial-state reasoning and safe recovery. A strong answer halts automation, inspects state for blast radius, then chooses idempotent roll-forward or rollback with canary validation.

advanced3 min read

Compare Terraform and Ansible: when to use each and both together

This tests whether you distinguish provisioning from config management. Strong answers define Terraform for immutable infra and Ansible for mutable state, contrast day 0 versus day 1-2 work, and cover Terraform for VMs and Ansible for setup.

How do you manage environment-specific connection strings and why is hardcoding bad?

Tests config separation and secrets hygiene. Outline: inject via environment variables or a secret store, keep per-environment configs credential-free, and prefer managed identities.

Why avoid committing secrets to Git, and secure local alternatives?

This tests basic secret hygiene and environment isolation. A strong answer notes Git history is immutable and distributed, so secrets persist in forks forever, and proposes environment variables or gitignored dotenv files.

What is Twelve-Factor's config recommendation for CI/CD and scalability?

Tests Factor III and CI/CD scaling implications. Strong answer: config lives in env vars, never in code, so one build promotes across stages and new instances start with correct context immediately. Red flag: config files checked into version control.

Describe secure secret injection into Kubernetes containers during CI/CD

Tests production secret injection hygiene in Kubernetes CI/CD. Strong answers: external secret store at deploy time, volume mounts over env vars, etcd encryption, RBAC least privilege, and rotation.

How does your app authenticate with secrets management and solve secret zero?

This tests platform trust chains and the bootstrap credential problem. A strong answer names IAM, Kubernetes, or AppRole auth, explains platform attestation, and uses short-lived tokens.