☁️ DevOps &amp; Cloud

Running stateful apps with StatefulSets

Stateful apps need stable identity and storage; a StatefulSet gives stable names, ordered rollout, and per-Pod volumes.

Describe the difference between a Deployment and a StatefulSet

Tests stateful pod identity versus stateless scaling. Outline: contrast Deployments' interchangeable replicas with StatefulSets' stable hostnames, per-pod PVCs, and ordered rollout; give a database example.

Why 'human error' is not a root cause

Human error is a starting symptom; ask why the system allowed it, find missing guardrails.

How do you let Pods pull from a private registry?

Create a dockerconfigjson Secret with registry creds; reference it via imagePullSecrets on the Pod or ServiceAccount.

Grant an EKS pod IAM access to S3

IRSA maps a service account to an IAM role via the cluster OIDC provider, and pods exchange a projected token for short-lived STS credentials.

How ensure Kubernetes pulls correct new image and why avoid :latest?

Tests immutable tagging and Kubernetes image pull behavior. Strong answers demand unique tags like git SHA, explicit deployment spec updates, and explain :latest's reproducibility failures across nodes.

Resolving post-mortem disagreement with data

Anchor the debate in the timeline, deploy events, traces, and metrics; correlate cause and onset; allow multiple contributing factors.

How do you restrict a Pod's access to a Secret?

Pods read Secrets through their ServiceAccount and RBAC, scoped with resourceNames; mounted Secrets are governed by the Pod spec.

Isolate tenants in a shared Kubernetes cluster

Namespaces as the boundary, ResourceQuotas plus LimitRanges to cap compute, default-deny NetworkPolicies for traffic, and RBAC per namespace.

Explain the concept of a sidecar container in Kubernetes

Tests Pod multi-container patterns. A strong answer defines sidecars as co-located helpers sharing network and storage, cites service mesh or log forwarding, and argues for reuse and separate lifecycles. Red flag: calling it another Pod or legacy workaround.

Proximate cause versus root cause

Proximate cause is the immediate trigger, root cause is the systemic condition that allowed it; fix the root to prevent recurrence.

How do you inject secrets from an external store at runtime?

Use a sidecar injector or CSI driver that authenticates via the Pod's ServiceAccount token, fetches secrets at runtime, and mounts them on tmpfs.

Debug intermittent pod-to-pod connectivity

Scope the failure by path, rule out DNS, inspect kube-proxy iptables and conntrack, check the CNI, then verify cloud security groups and MTU.

advanced2 min read

Compare Kubernetes Secrets versus environment variables for Pod credentials

Tests Kubernetes credential threat model across etcd and Git. Plain env vars leak into manifests and process lists; Secrets enable RBAC but are base64 by default and visible to nodes and authorized readers. Red flag: claiming Secrets are encrypted by default.

Fixing an unmanaged post-mortem action backlog

Generate fewer, higher-leverage items targeting systemic risk; assign owners and dates; integrate into normal planning with explicit prioritization.

What do immutable ConfigMaps and Secrets solve?

Setting immutable true blocks data edits, preventing accidental updates and letting the kubelet skip watches, reducing API server load.

easy1 min read

Serverless cold starts and how to mitigate them

A cold start is the latency to provision and initialize a fresh environment; mitigate with provisioned concurrency, smaller packages, and lighter runtimes.

advanced2 min read

How do you diagnose and fix a Kubernetes OOMKilled application?

Tests cgroup enforcement versus scheduling. A strong answer verifies OOMKilled, compares limits to usage, then rightsizes requests to baseline and limits with headroom. Red flag: confusing requests with caps or blindly raising limits.

Measuring post-incident review effectiveness

Track action-item completion and age, repeat-incident rate, time-to-publish, and MTTR trend.