More in Cloud Platforms — page 4
Serverless cold starts and how to mitigate them
WHAT IT TESTS: the serverless execution model. OUTLINE: a cold start is the latency to provision and initialize a fresh environment; mitigate with provisioned concurrency, smaller packages, and lighter runtimes. RED FLAG: calling every slow call cold.
Debug intermittent pod-to-pod connectivity
WHAT IT TESTS: systematic network debugging. OUTLINE: scope the failure by path, rule out DNS, inspect kube-proxy iptables and conntrack, check the CNI, then verify cloud security groups and MTU. RED FLAG: restarting pods with no hypothesis.
Isolate tenants in a shared Kubernetes cluster
WHAT IT TESTS: layered multi-tenancy. OUTLINE: namespaces as the boundary, ResourceQuotas plus LimitRanges to cap compute, default-deny NetworkPolicies for traffic, and RBAC per namespace. RED FLAG: treating a namespace alone as a hard security boundary.
Grant an EKS pod IAM access to S3
WHAT IT TESTS: secure workload identity. OUTLINE: IRSA maps a service account to an IAM role via the cluster OIDC provider, and pods exchange a projected token for short-lived STS credentials. RED FLAG: hardcoding keys or sharing the node profile.
Running stateful apps with StatefulSets
WHAT IT TESTS: stateful workloads in Kubernetes. OUTLINE: stateful apps need stable identity and storage; a StatefulSet gives stable names, ordered rollout, and per-Pod volumes. RED FLAG: claiming a Deployment plus PVC solves it.
Exposing Kubernetes services to the internet
WHAT IT TESTS: Kubernetes networking layers. OUTLINE: a Service gives stable access and LoadBalancer exposes one service, while Ingress adds L7 host and path routing with TLS for many services. RED FLAG: conflating the two, or one LB per service.
Multi-stage Docker builds
WHAT IT TESTS: separating build tooling from runtime. OUTLINE: a build stage compiles with the toolchain, the final stage uses a minimal base and copies only the artifact, cutting size and attack surface. RED FLAG: shipping compilers and source.
Kubernetes Deployment versus Pod
WHAT IT TESTS: Kubernetes controllers and self-healing. OUTLINE: a Pod is the smallest disposable unit, a Deployment maintains a desired replica count, self-heals, and rolls out updates. RED FLAG: bare Pods expected to be recreated after a crash.
Writing a Dockerfile for a web app
WHAT IT TESTS: core Dockerfile instructions and layering. OUTLINE: FROM a base, set WORKDIR, install dependencies before app code for cache reuse, EXPOSE the port, CMD the start command. RED FLAG: copying everything before installing deps, or root.
Migrating a stateful monolith to PaaS
WHAT IT TESTS: cloud-native refactoring strategy. OUTLINE: externalize state to backing services, make processes stateless and disposable, read config from the environment per Twelve-Factor. RED FLAG: a lift-and-shift that keeps local-disk state.
Cold starts in serverless environments
WHAT IT TESTS: serverless latency internals. OUTLINE: a cold start is the delay to provision a fresh instance and initialize the runtime; mitigate with provisioned concurrency and by shrinking init work. RED FLAG: blaming network or steady-state latency.
Offload long-running tasks from web requests
WHAT IT TESTS: async background-job architecture. OUTLINE: enqueue the job to a queue, return immediately, process with separate workers, report status out of band. RED FLAG: doing the work in the request thread or fire-and-forget threads.
CI/CD pipeline for a container PaaS
WHAT IT TESTS: the build-push-deploy pipeline. OUTLINE: run tests, build the image, push the tag to a registry, then deploy it to Cloud Run. The registry is the build-to-deploy handoff. RED FLAG: skipping the registry or rebuilding on the deploy host.
Securely supplying secrets to an app
WHAT IT TESTS: secrets management hygiene. OUTLINE: never hardcode credentials, inject them as environment variables or pull from a secrets manager, and rotate them. RED FLAG: committing the database URI to source control or baking it into the image.
Deploying to Heroku via Git
WHAT IT TESTS: the git-push PaaS deploy flow and build manifests. OUTLINE: push to the remote, a buildpack detects the language, builds a slug, and runs the Procfile process. RED FLAG: confusing what declares dependencies versus the start command.
Why not store uploads on local PaaS disk?
WHAT IT TESTS: statelessness and ephemeral storage. OUTLINE: PaaS instances are ephemeral and unshared, so local files vanish on restart and are invisible to peers; store uploads in object storage. RED FLAG: treating instance disk as durable or shared.
The cloud shared responsibility model
WHAT IT TESTS: the security boundary in PaaS. OUTLINE: the provider secures the cloud (hardware, OS, runtime), you secure what runs in it (code, data, config, access). RED FLAG: assuming the provider secures your code, data, or IAM.
CAP theorem and real database tradeoffs
WHAT IT TESTS: CAP as a partition-time choice. OUTLINE: during a partition you pick consistency or availability, CP systems reject requests, AP systems stay available but stale. RED FLAG: thinking you pick two of three at all times.
Design a global low-latency database
WHAT IT TESTS: multi-region database tradeoffs. OUTLINE: a distributed store with replicas near users, a tuned consistency level, accepting lag, conflicts, and cross-region cost. RED FLAG: promising low latency, strong consistency, and low cost together.
Add a second access pattern to a key-value store
WHAT IT TESTS: secondary indexing in NoSQL. OUTLINE: add a global secondary index on EmailAddress, weighing extra storage, write amplification, and eventual consistency. RED FLAG: a full scan with a filter, or assuming indexes are free.