Interview questions in DevOps & Cloud, page 9
The Kubernetes reconciliation loop
A controller continuously observes actual state, compares to desired state in the spec, and acts to close the gap, level-triggered not edge-triggered.
How would you use PaC to introduce pipeline parallelism?
Tests splitting a sequential Jenkinsfile into independent Declarative parallel stages. Group tests and scans in a parallel block with stage-level agents, use matrix for cross-axis work, and version the Jenkinsfile.
Correlating logs, metrics, and traces
Propagate a trace and span ID through context, stamp it on logs and metric exemplars, then pivot metric to trace to logs.
Dynamic database credential rotation for microservices
A secrets manager issues short-lived per-service credentials, services authenticate by workload identity and fetch or refresh secrets without restart, leases expire and rotate automatically.
Deployment versus StatefulSet
Deployments suit interchangeable stateless replicas, StatefulSets give stable identities, ordered rollout, and per-Pod persistent storage for stateful systems.
Implement a manual approval gate for production deployment in pipeline-as-code
This tests embedding human governance in automated pipelines with auditability. A strong answer covers environment-scoped approvals, timeouts, RBAC, and immutable logs. Red flag: Ad-hoc manual deploys outside the pipeline or missing rollback plans.
Designing a cache health dashboard
Hit ratio, latency, memory and evictions, connections and saturation, with stat panels for current state and time-series for trends.
Centralized logging and threat detection across accounts
Organization-wide trails ship logs to a locked-down central security account, store in immutable append-only storage, and aggregate threat detection findings centrally with least-privilege…
Scheduler filtering and scoring phases
Filtering eliminates infeasible Nodes via resources, taints, and affinity, then scoring ranks the survivors to pick the best, after which the Pod is bound.
Standardize and update CI/CD across hundreds of microservices without per-repo edits
Repos use a thin wrapper importing versioned shared-library templates; a control plane rolls out updates with canary validation.
Scaling Prometheus for HA and volume
Shard scraping, add long-term object storage and global query via Thanos/Cortex/VictoriaMetrics, run redundant replicas for HA, with dedupe.
Architecting for HIPAA or PCI DSS compliance
Isolate sensitive data in restricted networks and accounts, encrypt at rest and in transit with managed keys, enforce least-privilege access, and keep immutable audit logs.
CRDs and the Operator pattern
CRDs add new API object types, an Operator pairs a CRD with a controller that runs a reconciliation loop encoding domain operational knowledge.
Discuss security implications of developer-defined PaC pipelines
It tests balancing CI/CD flexibility with defense-in-depth against secret exfiltration. Cover scoped build identities, branch policies, approval gates, and sandboxed fork builds. Red flag: shared service connections or unrestricted pipeline admin rights.
Writing SLIs in PromQL
Availability is good requests over total using rate and non-5xx counters; latency uses histogram_quantile over rate of buckets summed by le.
Choosing relational vs NoSQL managed databases
Choose relational for complex relationships, joins, flexible queries, and strong transactions; choose NoSQL for known access patterns needing massive horizontal scale.
Dynamically generate CI/CD pipelines
A detection step scans for marker files and maps them to reusable stage templates assembled at runtime; trade off convention/DRY against reduced transparency and harder debugging.
Deployment, ReplicaSet, and Pod hierarchy
A Deployment manages ReplicaSets, each ReplicaSet keeps a set of identical Pods, and Deployments add rolling updates, rollback, and self-healing.
Loki versus Elasticsearch for logs
Loki indexes only labels and stores raw log chunks, cheap but needs label-scoped brute-force search; Elasticsearch full-text indexes content, fast arbitrary search but costly to store…
Read replicas in managed relational databases
A read replica is an async copy of the primary that serves read-only queries, offloading the primary and scaling read-heavy workloads; expect replication lag.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles