Advanced everything in DevOps & Cloud, page 3
Pinning exclusive CPU cores to a pod
Set kubelet CPU Manager policy to static, make the pod Guaranteed QoS with integer CPU limits equal to requests, so it gets exclusive dedicated cores.
How do you resize a live PersistentVolume?
Edit the PVC's requested size upward; the StorageClass must set allowVolumeExpansion true and the CSI driver must support expansion, ideally online so no Pod restart is needed; shrinking is not allowed.
How does a StatefulSet recover a Pod after node failure?
Node goes NotReady, Pod is marked for deletion, the same-ordinal Pod is recreated and reattaches its existing PVC from volumeClaimTemplates, preserving data; safety needs the old Pod confirmed…
Why is a Pod with a PVC stuck Pending?
PVC may be unbound from missing StorageClass, no matching PV, mismatched access mode or size, zone or capacity limits, or WaitForFirstConsumer; diagnose with describe on Pod and PVC plus events.
How do Sealed Secrets enable GitOps for secrets?
Kubeseal encrypts a Secret with the controller's public key into a SealedSecret CR safe for Git; only the in-cluster controller's private key can decrypt it into a real Secret.
What do immutable ConfigMaps and Secrets solve?
Setting immutable true blocks data edits, preventing accidental updates and letting the kubelet skip watches, reducing API server load.
How do you inject secrets from an external store at runtime?
Use a sidecar injector or CSI driver that authenticates via the Pod's ServiceAccount token, fetches secrets at runtime, and mounts them on tmpfs.
Distroless images: benefits and trade-offs
Distroless ships only the app and runtime deps, no shell or package manager; smaller and a smaller attack surface than Alpine; trade-off is harder debugging with no shell.
Pass build-time secrets securely with BuildKit
Use BuildKit RUN --mount=type=secret (or type=ssh) so the secret is mounted only during that step and never written to a layer; pass it with --secret at build time.
Run a container as a non-root user
Create a dedicated group and user, chown app files to them, then USER to drop privileges before the process runs.
Trace a container process's syscalls from the host
Find the host PID via docker inspect or ps, then strace -p that PID from the host, since the container shares the host kernel.
What is the OCI and why do its specs matter?
OCI defines vendor-neutral specs for image format and runtime so any compliant tool interoperates; runc implements the runtime spec; this prevents lock-in.
Migrate an OLTP database with minimal downtime
Take an initial bulk load, then use change data capture to replicate ongoing changes until source and target are in sync, validate, then cut over during a brief window with a rollback plan.
Design an enterprise cloud landing zone
Multi-account or subscription structure, centralized identity and SSO, network topology like hub-and-spoke, guardrails via policy and SCPs, and centralized logging.
Technical challenges of a multi-cloud strategy
Data consistency and egress costs across providers, cross-cloud networking and latency, and federating disparate IAM systems, plus operational and tooling overhead.
Design petabyte-scale distributed training
Object storage with columnar formats, distributed preprocessing, a data-parallel framework with efficient sharded loading, and managed orchestration.
Design auto drift detection and retraining
Capture inputs and predictions, compute data and concept drift metrics on a schedule, alert on threshold breach, and trigger a retraining and redeploy pipeline.
Schema evolution without rewriting history
Use a table format with metadata-level evolution, add a new column rather than mutating the old, and reconcile types at read time; avoid rewriting petabytes.
The small files problem in data lakes
Too many tiny files inflate metadata and per-file overhead, slowing queries; caused by streaming micro-batches and over-partitioning; fix with compaction and table formats like Iceberg, Delta, or Hudi.
Resilient stateful batch on Spot Instances
Externalize state and checkpoint to durable storage, react to interruption and rebalance notices to drain gracefully, diversify instance pools.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles