Interview questions in DevOps & Cloud, page 12
ClusterIP vs NodePort vs LoadBalancer
ClusterIP for internal-only access; NodePort opens a port on every node for basic external reach; LoadBalancer provisions a cloud load balancer for production external traffic.
Why avoid committing secrets to Git, and secure local alternatives?
This tests basic secret hygiene and environment isolation. A strong answer notes Git history is immutable and distributed, so secrets persist in forks forever, and proposes environment variables or gitignored dotenv files.
Primary goal and sections of a post-mortem
Goal is organizational learning and prevention, not blame; include summary, timeline, impact, root cause, action items.
Securely supplying secrets to an app
Never hardcode credentials, inject them as environment variables or pull from a secrets manager, and rotate them.
Cross-namespace Service DNS resolution
CoreDNS gives each Service a name; cross-namespace you must qualify it as my-service.B.svc.cluster.local (or my-service.B).
What is Twelve-Factor's config recommendation for CI/CD and scalability?
Tests Factor III and CI/CD scaling implications. Strong answer: config lives in env vars, never in code, so one build promotes across stages and new instances start with correct context immediately. Red flag: config files checked into version control.
Designing a SEV1-SEV4 severity matrix
Tie levels to user impact, scope, and SLO burn with concrete thresholds; map each to response and escalation.
CI/CD pipeline for a container PaaS
Run tests, build the image, push the tag to a registry, then deploy it to Cloud Run. The registry is the build-to-deploy handoff.
Ingress for host and path routing
Use an Ingress with an Ingress controller for layer-7 host/path routing behind one external IP, instead of one cloud LoadBalancer per service.
Describe secure secret injection into Kubernetes containers during CI/CD
Tests production secret injection hygiene in Kubernetes CI/CD. Strong answers: external secret store at deploy time, volume mounts over env vars, etcd encryption, RBAC least privilege, and rotation.
Fast rollback versus targeted fix in an incident
Weigh time-to-recovery and blast radius against rollback side effects; prefer restoring service fast, gated by data like deploy diff and migration risk.
Offload long-running tasks from web requests
Enqueue the job to a queue, return immediately, process with separate workers, report status out of band.
Headless Services and direct Pod DNS
Set clusterIP: None so no virtual IP or proxy load balancing; DNS returns individual Pod IPs (A records). Primary use: StatefulSets needing stable per-Pod addressing.
How does your app authenticate with secrets management and solve secret zero?
This tests platform trust chains and the bootstrap credential problem. A strong answer names IAM, Kubernetes, or AppRole auth, explains platform attestation, and uses short-lived tokens.
Conducting a blameless post-mortem in practice
Focus on systems not individuals, assume good intent, use neutral language and facilitation, end with owned action items.
Cold starts in serverless environments
A cold start is the delay to provision a fresh instance and initialize the runtime; mitigate with provisioned concurrency and by shrinking init work.
Debugging Service connectivity between Pods
Kubectl get endpoints to check the Service has Pod IPs (selector match); kubectl describe service to verify selector and ports; exec into the frontend to curl the Service DNS name.
Compare GitOps and Kustomize vs Ansible for environment configs
Tests declarative vs imperative trade-offs. Contrast GitOps drift detection with Ansible's imperative flexibility. Note Kustomize overlays for K8s vs Ansible's broader reach.
Technical investments to reduce MTTR
Cut detection, diagnosis, and recovery time via observability, runbooks/automation, fast rollback, and resilient architecture.
Migrating a stateful monolith to PaaS
Externalize state to backing services, make processes stateless and disposable, read config from the environment per Twelve-Factor.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles