Intermediate interview questions in DevOps & Cloud, page 6
Conducting a blameless post-mortem in practice
Focus on systems not individuals, assume good intent, use neutral language and facilitation, end with owned action items.
Debugging Service connectivity between Pods
Kubectl get endpoints to check the Service has Pod IPs (selector match); kubectl describe service to verify selector and ports; exec into the frontend to curl the Service DNS name.
Compare GitOps and Kustomize vs Ansible for environment configs
Tests declarative vs imperative trade-offs. Contrast GitOps drift detection with Ansible's imperative flexibility. Note Kustomize overlays for K8s vs Ansible's broader reach.
Multi-stage Docker builds
A build stage compiles with the toolchain, the final stage uses a minimal base and copies only the artifact, cutting size and attack surface.
Exposing Kubernetes services to the internet
A Service gives stable access and LoadBalancer exposes one service, while Ingress adds L7 host and path routing with TLS for many services.
What are liveness and readiness probes, and what happens when each fails?
This tests whether you know the distinct kubelet actions for each probe failure. A strong answer: liveness failure restarts the container; readiness failure removes the Pod from Service endpoints and stops traffic.
Are base64-encoded Kubernetes Secrets actually secure?
Base64 is reversible, not a protection; default guards against accidental shoulder-surfing only; real defenses are encryption-at-rest, RBAC, audit.
Running stateful apps with StatefulSets
Stateful apps need stable identity and storage; a StatefulSet gives stable names, ordered rollout, and per-Pod volumes.
Describe the difference between a Deployment and a StatefulSet
Tests stateful pod identity versus stateless scaling. Outline: contrast Deployments' interchangeable replicas with StatefulSets' stable hostnames, per-pod PVCs, and ordered rollout; give a database example.
Why 'human error' is not a root cause
Human error is a starting symptom; ask why the system allowed it, find missing guardrails.
How do you let Pods pull from a private registry?
Create a dockerconfigjson Secret with registry creds; reference it via imagePullSecrets on the Pod or ServiceAccount.
How ensure Kubernetes pulls correct new image and why avoid :latest?
Tests immutable tagging and Kubernetes image pull behavior. Strong answers demand unique tags like git SHA, explicit deployment spec updates, and explain :latest's reproducibility failures across nodes.
Resolving post-mortem disagreement with data
Anchor the debate in the timeline, deploy events, traces, and metrics; correlate cause and onset; allow multiple contributing factors.
How do you restrict a Pod's access to a Secret?
Pods read Secrets through their ServiceAccount and RBAC, scoped with resourceNames; mounted Secrets are governed by the Pod spec.
Explain the concept of a sidecar container in Kubernetes
Tests Pod multi-container patterns. A strong answer defines sidecars as co-located helpers sharing network and storage, cites service mesh or log forwarding, and argues for reuse and separate lifecycles. Red flag: calling it another Pod or legacy workaround.
Proximate cause versus root cause
Proximate cause is the immediate trigger, root cause is the systemic condition that allowed it; fix the root to prevent recurrence.
State machines versus long-running functions
State machines externalize state, pause for human input without running compute, give built-in retries and audit history, and bill per transition.
Idempotency in event-driven systems
Idempotency means repeated processing yields the same end state; it matters because messages get redelivered; achieve it with idempotency keys and conditional writes.
Distributed tracing for serverless apps
Propagate a trace context through every hop, instrument with OpenTelemetry or X-Ray, capture spans including the database, and correlate traces with structured logs.
StatefulSet vs Deployment: what's the difference?
Deployments treat Pods as interchangeable; StatefulSets give stable ordinal names, stable per-Pod storage via volumeClaimTemplates, and ordered rollout.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles