Easy everything in DevOps & Cloud, page 6
Two ways to consume a ConfigMap in a Pod
Inject keys as environment variables (good for a few simple settings), or mount the ConfigMap as a volume of files (good for config files and live updates).
ConfigMap vs Secret
ConfigMaps hold non-sensitive plain config; Secrets hold sensitive data, base64-encoded and treated specially (RBAC, optional encryption at rest).
ClusterIP vs NodePort vs LoadBalancer
ClusterIP for internal-only access; NodePort opens a port on every node for basic external reach; LoadBalancer provisions a cloud load balancer for production external traffic.
Why Kubernetes Services exist
Pod IPs are ephemeral and change on reschedule; a Service gives a stable virtual IP and DNS name plus load balancing across healthy Pods via label selectors.
Debugging a Pod in CrashLoopBackOff
Kubectl describe pod for events, restarts, and last state; kubectl logs (with --previous) for the crashed container's output.
Create a Deployment with 3 replicas via kubectl
Kubectl create deployment webapp --image=my-app:1.0, then kubectl scale to 3 replicas, or use --replicas if supported.
Deployment, ReplicaSet, and Pod hierarchy
A Deployment manages ReplicaSets, each ReplicaSet keeps a set of identical Pods, and Deployments add rolling updates, rollback, and self-healing.
Minimal objects to expose a stateless app
A Deployment to run and self-heal replicas plus a Service to give a stable endpoint, exposed externally via type LoadBalancer or NodePort, or an Ingress.
Core control plane components
Api-server as the front door, etcd as state store, scheduler placing pods, and controller-manager running reconciliation loops, plus cloud-controller-manager.
Node, Pod, and Container relationship
A Node is a machine, a Pod is the smallest deployable unit wrapping one or more containers that share network and storage, and the Pod abstraction enables co-location and lifecycle management.
Why :latest is a production anti-pattern
Latest is mutable so pods run different code, rollbacks and pull policy break, and you should use immutable version tags or digests.
Tag and push an image to a private registry
Authenticate with docker login, retag the image to include the registry host and repo path, then docker push that full reference.
Explain GitOps and how an agent knows when to apply changes
Tests declarative infrastructure and pull-based reconciliation. A strong answer says Git is the source of truth and the agent polls or watches for drift, then applies diffs. Red flag: calling a push-based CI pipeline GitOps.
What is SAST and which CI/CD stage integrates it best?
Define SAST as source-code scanning; run it in the test stage on every commit; note early detection is cheapest.
What is the difference between a Service and an Ingress?
This tests L4 versus L7 networking abstractions. A good answer says Services load-balance to Pods internally while Ingresses route external HTTP to Services via a controller, then gives a path-based scenario.
What is IaC and its CI/CD benefits over manual provisioning?
Cover descriptive models, idempotency, and on-demand environments for repeatable CI/CD.
How do Docker images and containers differ and relate?
This tests your grasp of the immutable template versus mutable runtime boundary. A good answer: an image is a read-only layered template with code and dependencies; a container is a runnable instance with a writable layer on top.
ConfigMap decouples config from container images
A ConfigMap is a key-value store that injects configuration into pods without rebuilding the image. Use it for feature flags, database hostnames, or any non-secret settings. Editing one does not restart existing pods, so stale config is the common footgun.
How does shared responsibility shift between IaaS and SaaS?
Tests your understanding of security ownership across cloud stacks. Strong answer: in IaaS you own OS, apps, and network controls; in SaaS you only own data, identities, endpoints, and accounts while the provider manages the rest.
Explain the difference between IaaS, PaaS, and SaaS with examples
This tests your grasp of cloud abstraction layers and shared responsibility. A strong answer maps IaaS to raw infrastructure like EC2, PaaS to managed runtimes like Heroku, and SaaS to end-user apps like Gmail.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles