Advanced everything in DevOps & Cloud, page 3
Launching a risky feature with no error budget left
Bring burn history, what consumed the budget, blast radius, and rollback safety; offer mitigations like flags and canaries.
Setting SLOs across a dependency chain
Serial dependencies multiply, so each backend needs a tighter SLO than the target; mitigate with redundancy, caching, and graceful degradation.
Symptom-based vs cause-based alerting
Symptom alerts fire on user-visible impact, cause alerts on internal conditions; page on symptoms to cut noise and catch unforeseen failures.
Head-based vs tail-based trace sampling
Head-based decides at trace start cheaply but blindly; tail-based waits for the full trace to keep errors and slow requests.
What is high-cardinality data in Prometheus?
Cardinality is the count of unique label combinations; each is a separate series; explosion blows up memory and query cost.
Error budget policy across dependent microservices?
Set per-service SLOs but anchor on user-facing journey SLOs, budget for dependency error via the multiplication of availabilities, attribute downstream-caused failures correctly, and use…
SRE vs traditional ops on a recurring alert?
Traditional ops repeatedly handles the alert manually and scales by adding people; SRE treats it as a bug, automates or eliminates the root cause, and scales sublinearly.
Risky launch with a near-empty error budget?
Contain blast radius via canary and feature flags, use progressive rollout tied to budget burn, negotiate explicit risk acceptance, add fast rollback.
Multi-tenant isolation with a monitoring exception
Apply default-deny ingress per tenant namespace, allow same-namespace traffic, then add an ingress rule permitting the monitoring namespace via namespaceSelector on the metrics port.
Binding a ClusterRole with a RoleBinding
A RoleBinding referencing a ClusterRole grants those rules only within the binding's namespace; reuse built-in roles like view per-team without duplicating definitions.
Topology spread constraints versus pod anti-affinity
Spread constraints balance pod counts per domain bounded by maxSkew, anti-affinity is all-or-nothing co-location avoidance, and maxSkew caps the difference between fullest and emptiest…
tolerationSeconds and graceful eviction on NoExecute
TolerationSeconds is how long a tolerating pod may stay after the taint applies; once it elapses eviction starts, then terminationGracePeriodSeconds governs the SIGTERM-to-SIGKILL window.
Pinning exclusive CPU cores to a pod
Set kubelet CPU Manager policy to static, make the pod Guaranteed QoS with integer CPU limits equal to requests, so it gets exclusive dedicated cores.
How do you resize a live PersistentVolume?
Edit the PVC's requested size upward; the StorageClass must set allowVolumeExpansion true and the CSI driver must support expansion, ideally online so no Pod restart is needed; shrinking is not allowed.
How does a StatefulSet recover a Pod after node failure?
Node goes NotReady, Pod is marked for deletion, the same-ordinal Pod is recreated and reattaches its existing PVC from volumeClaimTemplates, preserving data; safety needs the old Pod confirmed…
Why is a Pod with a PVC stuck Pending?
PVC may be unbound from missing StorageClass, no matching PV, mismatched access mode or size, zone or capacity limits, or WaitForFirstConsumer; diagnose with describe on Pod and PVC plus events.
How do Sealed Secrets enable GitOps for secrets?
Kubeseal encrypts a Secret with the controller's public key into a SealedSecret CR safe for Git; only the in-cluster controller's private key can decrypt it into a real Secret.
What do immutable ConfigMaps and Secrets solve?
Setting immutable true blocks data edits, preventing accidental updates and letting the kubelet skip watches, reducing API server load.
How do you inject secrets from an external store at runtime?
Use a sidecar injector or CSI driver that authenticates via the Pod's ServiceAccount token, fetches secrets at runtime, and mounts them on tmpfs.
Distroless images: benefits and trade-offs
Distroless ships only the app and runtime deps, no shell or package manager; smaller and a smaller attack surface than Alpine; trade-off is harder debugging with no shell.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles