Advanced everything in DevOps & Cloud, page 5
Stable egress IPs for multi-region outbound traffic
Route outbound traffic through NAT gateways with allocated static IPs, or centralize egress so all regions exit through a fixed small IP set you can whitelist.
Site-to-Site VPN vs dedicated interconnect
VPN is quick, cheap, encrypted over public internet with variable latency; Direct Connect or ExpressRoute is a private dedicated link with consistent low latency, high bandwidth, longer lead time and…
Block storage availability across AZ failure
Block volumes are AZ-bound, so use snapshots, synchronous replication, or app-level replication, trading cost for lower RTO/RPO.
Object store vs NFS consistency models
S3 gives strong read-after-write per object with no partial updates; NFS offers close-to-open with shared mutable files.
Maximizing object-store throughput for small files
Spread keys across prefixes for partition parallelism, batch small files, parallelize and use multipart uploads.
Cost-effective fault-tolerant batch processing
Spot fleets across types, a durable work queue, idempotent checkpointed tasks, retries.
Optimizing low-latency VM-to-VM networking
Cluster placement groups, enhanced networking and SR-IOV, larger instances for more bandwidth.
Hybrid cloud bursting from a VMware footprint
Evaluate VMware Cloud on AWS, Azure Arc, Outposts; address connectivity, identity, and data gravity.
Designing for portability across two clouds
Abstract via containers, Terraform, and open standards; avoid proprietary managed services.
Dynamically generate CI/CD pipelines
A detection step scans for marker files and maps them to reusable stage templates assembled at runtime; trade off convention/DRY against reduced transparency and harder debugging.
Method-aware authorization with Istio policy
An ALLOW policy on user-service granting frontend's principal POST plus the users path, another granting all principals GET; deny is implicit once any ALLOW exists.
Diagnosing latency with distributed tracing
Follow the trace ID across spans, compare per-span durations to find the slow hop, distinguish service time from network and queueing.
Preventing split-brain in HA Operators
Run active-passive replicas, only the leader reconciles, election uses a Lease object renewed under a TTL.
Mutating vs Validating webhooks with an Operator
Mutating runs first to inject defaults or sidecars, validating runs after to reject bad specs, both keyed to your CRD.
Keeping operator .status accurate under failures
Status can lag or go stale during partitions and crashes; make reconcile idempotent, observe true state each loop, use conditions and observedGeneration, handle conflicts.
Helm migration hooks under GitOps
Use a pre-upgrade hook Job with weights and delete policy; the challenge is GitOps tools render statically and reconcile, conflicting with Helm's imperative hook lifecycle.
GitOps repo layout for environment promotion
Shared base plus per-env overlays via Kustomize or value files, promotion by PR moving a pinned version forward, separating app source from config repos.
Head-based vs tail-based trace sampling
Head decides up front (cheap, may miss rare errors); tail decides after the trace completes (catches errors and slow traces but needs buffering).
Diagnose a Prometheus cardinality explosion
Find offenders via TSDB stats and topk count by __name__, identify unbounded labels, then drop or aggregate them with relabeling.
Ingress resource vs Ingress controller
The Ingress resource is declarative routing rules; the controller is the running proxy (NGINX, etc.) that reads them and serves traffic.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles