More in CI/CD & Automation — page 5
Compare Kubernetes Secrets versus environment variables for Pod credentials
Tests Kubernetes credential threat model across etcd and Git. Plain env vars leak into manifests and process lists; Secrets enable RBAC but are base64 by default and visible to nodes and authorized readers. Red flag: claiming Secrets are encrypted by default.
Explain the concept of a sidecar container in Kubernetes
Tests Pod multi-container patterns. A strong answer defines sidecars as co-located helpers sharing network and storage, cites service mesh or log forwarding, and argues for reuse and separate lifecycles. Red flag: calling it another Pod or legacy workaround.
How ensure Kubernetes pulls correct new image and why avoid :latest?
Tests immutable tagging and Kubernetes image pull behavior. Strong answers demand unique tags like git SHA, explicit deployment spec updates, and explain :latest's reproducibility failures across nodes.
What are liveness and readiness probes, and what happens when each fails?
This tests whether you know the distinct kubelet actions for each probe failure. A strong answer: liveness failure restarts the container; readiness failure removes the Pod from Service endpoints and stops traffic.
Walk me through a production-ready Dockerfile for a web app
Tests multi-stage builds, layer caching, and security hardening. A strong answer covers a pinned slim FROM, multi-stage separation of build and runtime, ordered COPY for cache, and a non-root USER.
How do you securely manage and inject Helm secrets in CI/CD?
Tests secret lifecycle trade-offs in GitOps. Strong answers compare SOPS-encrypted values in Git, direct Vault injection for dynamic secrets, and External Secrets Operator to decouple secrets from charts.
Prevent developer access to production secrets while preserving debuggability
WHAT IT TESTS: Architecture keeping production plaintext secrets invisible to developers. ANSWER OUTLINE: Use dynamic short-lived credentials, break-glass with dual-control audit, and structured telemetry or synthetic transactions for debugging.
Compare GitOps and Kustomize vs Ansible for environment configs
Tests declarative vs imperative trade-offs. Contrast GitOps drift detection with Ansible's imperative flexibility. Note Kustomize overlays for K8s vs Ansible's broader reach.
How does your app authenticate with secrets management and solve secret zero?
This tests platform trust chains and the bootstrap credential problem. A strong answer names IAM, Kubernetes, or AppRole auth, explains platform attestation, and uses short-lived tokens.
Describe secure secret injection into Kubernetes containers during CI/CD
Tests production secret injection hygiene in Kubernetes CI/CD. Strong answers: external secret store at deploy time, volume mounts over env vars, etcd encryption, RBAC least privilege, and rotation.
What is Twelve-Factor's config recommendation for CI/CD and scalability?
Tests Factor III and CI/CD scaling implications. Strong answer: config lives in env vars, never in code, so one build promotes across stages and new instances start with correct context immediately. Red flag: config files checked into version control.
Why avoid committing secrets to Git, and secure local alternatives?
This tests basic secret hygiene and environment isolation. A strong answer notes Git history is immutable and distributed, so secrets persist in forks forever, and proposes environment variables or gitignored dotenv files.
How do you manage environment-specific connection strings and why is hardcoding bad?
Tests config separation and secrets hygiene. Outline: inject via environment variables or a secret store, keep per-environment configs credential-free, and prefer managed identities.
Infrastructure apply fails midway. What is the state and your immediate steps?
This tests partial-state reasoning and safe recovery. A strong answer halts automation, inspects state for blast radius, then chooses idempotent roll-forward or rollback with canary validation.
Define configuration drift in IaC. How do you detect and remediate it?
This tests state divergence between declared and live infrastructure. A strong answer defines drift as deviation from the IaC source of truth, proposes automated scanning for detection, and recommends reconciliation or redeployment.
Design a CI/CD pipeline for ephemeral feature branch environments
This tests dynamic infrastructure lifecycle modeling in CI/CD. A strong answer covers branch-triggered provisioning, dynamic naming, automatic cleanup via stop jobs, and cost controls. Red flag: proposing manual teardown or static environments per branch.
Explain Terraform state, why managing it is critical, and team best practices
Tests if you know state maps config to real resources and tracks metadata. Strong answers cover remote backends with locking and encryption, never Git. Red flag: local state or ignoring that state files contain secrets.
How do you manage secrets within IaC configurations?
This tests secret injection and the security-complexity tradeoff in IaC. A strong answer contrasts a cloud secret manager with encrypted files or env vars, covering rotation and blast radius. A red flag is plaintext secrets in Git or state files.
Describe the Terraform workflow from code to live
This tests Terraform workflows beyond local commands. A strong answer covers: version-controlled code, terraform plan for speculative validation, then terraform apply via remote runs with policies. Red flag: only local apply without reviews or remote state.
Explain the difference between declarative and imperative IaC.
TESTS: Grasp of desired-state reconciliation versus ordered command execution. OUTLINE: Contrast Terraform with Bash or Ansible; note drift detection, idempotency, and state trade-offs. RED FLAG: Calling one universally better or conflating tool categories.