Interview questions in DevOps & Cloud, page 13
kube-proxy and iptables vs IPVS modes
Kube-proxy watches Services/endpoints and programs node rules so ClusterIP traffic is DNAT'd to a backend Pod; iptables uses sequential rule chains, IPVS uses a hash table with real…
Prevent developer access to production secrets while preserving debuggability
Use dynamic short-lived credentials, break-glass with dual-control audit, and structured telemetry or synthetic transactions for debugging.
Architecting a single source of truth for incidents
One curated view overlaying golden metrics, deploy/change events, and active alerts on a shared timeline, fed by standardized telemetry.
Writing a Dockerfile for a web app
FROM a base, set WORKDIR, install dependencies before app code for cache reuse, EXPOSE the port, CMD the start command.
Restricting Pod ingress with a NetworkPolicy
Create a NetworkPolicy with podSelector app=frontend, policyTypes Ingress, and one ingress from-rule matching podSelector role=api-gateway; requires a CNI that enforces policies.
How do you securely manage and inject Helm secrets in CI/CD?
Tests secret lifecycle trade-offs in GitOps. Strong answers compare SOPS-encrypted values in Git, direct Vault injection for dynamic secrets, and External Secrets Operator to decouple secrets from charts.
Designing a safe chaos engineering exercise
Form a hypothesis, define steady state and blast radius, inject failure, observe response, with abort and rollback safeguards.
Kubernetes Deployment versus Pod
A Pod is the smallest disposable unit, a Deployment maintains a desired replica count, self-heals, and rolls out updates.
Ingress resource vs Ingress controller
The Ingress resource is declarative routing rules; the controller is the running proxy (NGINX, etc.) that reads them and serves traffic.
Walk me through a production-ready Dockerfile for a web app
Tests multi-stage builds, layer caching, and security hardening. A strong answer covers a pinned slim FROM, multi-stage separation of build and runtime, ordered COPY for cache, and a non-root USER.
Essential sections of a post-mortem
Summary, impact, timeline, root cause, lessons, and owned action items, each with a clear purpose.
Multi-stage Docker builds
A build stage compiles with the toolchain, the final stage uses a minimal base and copies only the artifact, cutting size and attack surface.
ConfigMap vs Secret
ConfigMaps hold non-sensitive plain config; Secrets hold sensitive data, base64-encoded and treated specially (RBAC, optional encryption at rest).
What is the difference between a Service and an Ingress?
This tests L4 versus L7 networking abstractions. A good answer says Services load-balance to Pods internally while Ingresses route external HTTP to Services via a controller, then gives a path-based scenario.
The 5 Whys root cause technique
Repeatedly ask why to move from symptom to systemic cause, stop at an actionable systemic fix.
Exposing Kubernetes services to the internet
A Service gives stable access and LoadBalancer exposes one service, while Ingress adds L7 host and path routing with TLS for many services.
Two ways to consume a ConfigMap in a Pod
Inject keys as environment variables (good for a few simple settings), or mount the ConfigMap as a volume of files (good for config files and live updates).
What are liveness and readiness probes, and what happens when each fails?
This tests whether you know the distinct kubelet actions for each probe failure. A strong answer: liveness failure restarts the container; readiness failure removes the Pod from Service endpoints and stops traffic.
Why blameless culture matters for reviews
Blame causes people to hide facts, so reviews miss systemic causes; blamelessness surfaces honest detail.
Are base64-encoded Kubernetes Secrets actually secure?
Base64 is reversible, not a protection; default guards against accidental shoulder-surfing only; real defenses are encryption-at-rest, RBAC, audit.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles