Interview questions in DevOps & Cloud, page 26
Mutating vs Validating webhooks with an Operator
Mutating runs first to inject defaults or sidecars, validating runs after to reject bad specs, both keyed to your CRD.
What is a build artifact? Give Java, JS, and C++ examples.
Define artifacts as compiled outputs; list JAR/WAR for Java, webpack bundle for JS, and binary/.so for C++; note immutability.
Safeguards for automated remediation runbooks
Add rate limits and circuit breakers on restarts, escalate to humans after N attempts, log all actions, and check for cascading failure before acting.
High availability versus fault tolerance
HA minimizes downtime via redundancy and failover; fault tolerance survives failure with zero interruption.
Preventing split-brain in HA Operators
Run active-passive replicas, only the leader reconciles, election uses a Lease object renewed under a TTL.
Design a selective build strategy for a large monorepo
Tests monorepo dependency graph reasoning. Good answers model a DAG, compute reverse deps of the changed library, rebuild only affected targets via Bazel or Nx, and cache remotely. Red flag: directory triggers, full rebuilds, or testing the library alone.
Automating actions on error budget burn
Use multi-window burn-rate alerts; on fast burn, auto-trigger actions like halting deploys, rolling back, or scaling, with escalating tiers.
Blue/green versus canary deployments
Blue/green flips all traffic between two full environments; canary shifts a small slice gradually while watching metrics.
What a service mesh solves
It adds traffic management, security via mTLS, and observability at the network layer through sidecars, beyond what plain Kubernetes offers.
What is an artifact repository and why not just a shared filesystem?
Tests your grasp of immutability, metadata, and access control for build artifacts. A strong answer covers versioning, checksums, RBAC, and API retrieval that NFS lacks. Red flag: saying a shared filesystem is simpler and therefore enough for production.
Managing a risky release with feature flags
Deploy code dark behind an off flag, enable for internal then small percentage, monitor metrics, ramp gradually, then remove the flag.
Diagnosing slow auto-scaled PaaS workloads
Application metrics like request latency, throughput, and DB query time; infrastructure metrics like CPU, memory, and scaling lag.
The sidecar proxy pattern in a mesh
A proxy container shares the pod, all in/out traffic is redirected through it, so policy and telemetry apply without code changes.
How would you create and distribute reusable IaC components at scale?
This tests platform engineering governance at scale. A strong answer proposes a versioned module registry, policy-as-code guardrails, automated validation pipelines, and self-service documentation.
Designing a feature flagging service
Control plane (UI, store, targeting), SDKs that cache flags locally for zero-latency evaluation, streaming/CDN delivery for near-real-time updates, and stale-flag lifecycle tooling.
Migrating a stateful monolith to the cloud
Assess and inventory, pick a migration pattern like rehost or replatform, handle data migration and cutover, mitigate downtime and data-loss risk.
Canary release with Istio traffic splitting
DestinationRule defines subsets by label, VirtualService routes weighted 90/10 to those subsets, then shift weights as the canary proves healthy.
Design short-lived dynamic database credentials and their security benefits
This tests automated least-privilege credential lifecycle design. A strong answer covers a secrets broker with database plugins, short TTL leases tied to workload identity, and automatic revocation. Red flag: manual rotation or long-lived CI variables.
Capacity planning for distributed stateful systems
Account for replication and cross-region network, IOPS and disk throughput, connection limits, partition/shard balance, and N+1 region failover headroom; validate with load and chaos…
How a service mesh enables automatic mTLS
The control plane issues short-lived workload certificates, sidecars present them, both sides verify identity and encrypt the channel.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles