More in CI/CD & Automation — page 6
Discuss security implications of developer-defined PaC pipelines
It tests balancing CI/CD flexibility with defense-in-depth against secret exfiltration. Cover scoped build identities, branch policies, approval gates, and sandboxed fork builds. Red flag: shared service connections or unrestricted pipeline admin rights.
Standardize and update CI/CD across hundreds of microservices without per-repo edits
WHAT IT TESTS: Decoupling pipeline logic from service repos via centralized templates. ANSWER OUTLINE: Repos use a thin wrapper importing versioned shared-library templates; a control plane rolls out updates with canary validation.
Implement a manual approval gate for production deployment in pipeline-as-code
This tests embedding human governance in automated pipelines with auditability. A strong answer covers environment-scoped approvals, timeouts, RBAC, and immutable logs. Red flag: Ad-hoc manual deploys outside the pipeline or missing rollback plans.
How would you use PaC to introduce pipeline parallelism?
Tests splitting a sequential Jenkinsfile into independent Declarative parallel stages. Group tests and scans in a parallel block with stage-level agents, use matrix for cross-axis work, and version the Jenkinsfile.
How would you implement conditional logic in a pipeline?
WHAT IT TESTS: Declarative stage gating without shell hacks. ANSWER OUTLINE: Use if conditions with contexts like github.ref, separate trigger filters from runtime conditions, and add env rules. RED FLAG: Shell if statements in a job, not native conditionals.
How would you reuse pipeline steps across projects using PaC principles?
Tests DRY abstractions and coupling in CI/CD. Good answer: versioned reusable templates or libraries with parameterized inputs, consumed by composition. Red flag: raw copy-paste or one global pipeline forcing lockstep deployments.
How should you manage sensitive data in a committed pipeline file?
Tests that committed pipeline YAML must never store secrets. Answer: fetch at runtime via native secrets manager integrations; if needed, use masked, hidden, protected CI/CD variables; use typed CI/CD inputs for parameters.
Declarative vs scripted pipeline syntax: when to choose each?
This tests Jenkins Pipeline trade-off judgment. Contrast Declarative's opinionated blocks and guardrails with Scripted's raw Groovy flexibility; prefer Declarative for new projects unless complex flow control is needed.
What is Pipeline as Code and its benefits over GUI configuration?
Tests whether you treat delivery pipelines as versioned code. Strong answers define PaC as pipeline definitions in source control, citing branch automation, peer review, audit trails, and single source of truth.
How do you manage multi-arch container images under a single tag?
This tests image distribution and registry semantics. A strong answer covers manifest lists pointing to per-arch digests, Buildx as the builder driver, and the registry serving correct layer blobs.
Integrate artifact signing and vulnerability scanning into CI/CD
WHAT IT TESTS: Designing CI/CD gating with non-repudiable artifacts and automated trust. ANSWER OUTLINE: Build SBOMs, sign with ephemeral keys, scan registries, and enforce policy before deploy. RED FLAG: Signing after deploy or long-lived keys in CI.
Promote an artifact from staging to release without rebuilding it
Tests immutable artifact discipline. Answer: promote by copying the binary or retagging the image digest, never recompiling, because rebuilds introduce dependency drift and untested bits.
Explain proxy repositories in artifact managers and the problems they solve
Tests caching and supply-chain resilience in builds. Strong answers cover: local caching of upstream artifacts, shielding CI from external outages, and policy enforcement at the edge.
How do you version Docker images: Git SHA or SemVer?
Your grasp of immutable artifacts and traceability versus human-readable releases. Tag every build with Git SHA for immutability, then apply SemVer aliases only on promoted images. Treating floating tags like latest or v1 as safe production targets.
SNAPSHOT and RELEASE versions: differences and appropriate use
WHAT IT TESTS: Your grasp of artifact mutability and build reproducibility. ANSWER OUTLINE: SNAPSHOTs are mutable; RELEASEs are immutable and tagged. Use SNAPSHOTs on feature branches and RELEASEs for main.
How would you diagnose, report, and mitigate E2E flakiness at scale?
Tests metric-driven pipeline hygiene versus retry band-aids. Strong answers baseline flakiness rates, identify offenders via CI history, quarantine chronic flakes from presubmit, and fix root causes like concurrency.
Smoke test fails after canary deployment. Design the automated rollback.
Tests self-healing pipeline design: freeze canary traffic, auto-redeploy the last good release, verify rollback health, and keep failed pods for forensics. Red flag: requiring manual approval or in-place fixes instead of an atomic rollout swap.
How would you integrate SAST into CI without alert fatigue?
This tests embedding security into workflow without killing velocity. Run SAST per commit, suppress false positives via rulesets, gate on high-severity findings first and block merges only after calibration. A red flag is zero-tolerance blocking on day one.
How would you block merges when PR coverage drops 2%?
WHAT IT TESTS: Your ability to wire automated coverage gates into CI and version control. ANSWER OUTLINE: Upload coverage to Codecov, set a project status threshold of 2, and require the check in branch protection.
Difference between unit and integration tests and CI pipeline placement
WHAT IT TESTS: Grasp of the testing pyramid and CI gating. ANSWER OUTLINE: Unit tests isolate code and run fast in the build stage; integration tests verify real wiring later. Target 70 percent unit tests. RED FLAG: Claiming both run together or cost the same.