Interview questions in DevOps & Cloud, page 23
Override Helm values at install time
Pass custom files with -f or --values, single keys with --set, and know precedence: defaults, then files, then --set.
Design a secure multi-tenant CI/CD runner on Kubernetes
Apply namespaces, NetworkPolicies, Pod Security Standards; cap resources with ResourceQuotas and LimitRanges; schedule to dedicated or sandboxed nodes.
Defining SLIs and an SLO for an auth service?
Pick user-centric SLIs like login availability and latency, measure good over valid events at the right boundary, then set an achievable SLO with a window.
Lift-and-shift versus replatforming migration
Rehosting moves apps unchanged for speed and low risk; replatforming makes targeted optimizations for cloud benefits; explain the speed-versus-value trade-off.
Helm upgrade and rollback workflow
Helm upgrade creates a new revision; helm history lists revisions; helm rollback reverts to a prior one; --atomic auto-rolls-back on failure.
How would you architect deployment capabilities for multiple disparate environments?
This tests platform design for secure multi-environment orchestration. A strong answer proposes a declarative control plane, environment-local agents with short-lived credentials, and templating for consistency.
What is an error budget and how is it used?
The budget is the allowed unreliability (100 percent minus the SLO); track its burn, ship freely when budget remains, and freeze risky changes to focus on reliability when exhausted.
Design a highly available web application
Redundant stateless instances across multiple zones behind a load balancer with health checks, auto-scaling, and a replicated multi-AZ datastore.
How GitOps controllers detect drift and sync
The controller renders desired manifests from Git, diffs them against live cluster objects, marks OutOfSync, then a sync applies the diff to converge.
How would you modify CI/CD to generate and sign SLSA provenance?
Tests SLSA Build Track L1-L3 architecture. Outline: emit in-toto provenance with builder ID and resolved deps from ephemeral runners; sign via DSSE with Sigstore; publish attestations to registry. Red flag: confusing SBOMs or image signatures with provenance.
A team keeps blowing its error budget. First steps?
Analyze where the budget is burning via SLIs and postmortems, validate the SLO and SLIs are sound, then partner blamelessly on the top fixes.
Explain the Strangler Fig pattern
A facade routes traffic, new services gradually replace legacy features one slice at a time, and the old system is retired when fully strangled.
Managing secrets in a GitOps workflow
Never commit plaintext; encrypt with Sealed Secrets or SOPS, or reference an external store via External Secrets Operator.
Design a dynamic, risk-based quality gate system
Tests if you can move CI/CD from binary pass/fail to contextual risk scoring. Strong answers define criticality tiers, weight signals by severity and blast radius, and emit GO/CAUTION/STOP states.
Embedded vs consulting SRE engagement models
Embedded SREs sit inside one team for deep impact but limited reach; consulting SREs advise many teams broadly but shallowly.
Managed services versus self-hosting trade-offs
Managed services cut operational burden and speed delivery but cost more and limit control; self-hosting offers full control and tuning at the price of patching, scaling, and reliability work.
Argo CD App of Apps pattern
A parent Application whose manifests are themselves Application resources, so syncing one app declaratively manages many.
Compare monorepo and polyrepo strategies in CI/CD
Tests repo structure impact on builds, dependencies, and pipeline triggers. Contrast monorepo atomicity with polyrepo autonomy; cover monorepo change-detection versus polyrepo versioning and contract tests.
Conducting a Production Readiness Review
Assess monitoring and alerting, capacity and load testing, failure modes and dependencies, on-call and runbooks, and rollback or release safety.
Technical challenges of a multi-cloud strategy
Data consistency and egress costs across providers, cross-cloud networking and latency, and federating disparate IAM systems, plus operational and tooling overhead.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles