Intermediate everything in DevOps & Cloud, page 10
When hybrid cloud beats public or private
Give a scenario like regulated data plus bursty compute; keep sensitive data and legacy systems on-prem, run scalable or customer-facing workloads in public cloud.
Scalability vs elasticity in the cloud
Scalability is the ability to handle more load by adding capacity; elasticity is automatically adding AND removing capacity in real time to match demand.
IaaS vs PaaS for first cloud migration
IaaS (lift-and-shift) gives control with high ops overhead; PaaS lowers ops but may need refactoring; for a monolith with limited expertise, IaaS lift-and-shift is the lower-risk first step.
Publish/Subscribe Pattern
Publish/subscribe decouples senders from receivers: publishers emit messages to a topic without knowing who consumes them, and subscribers receive messages from topics they care about.
Persistent Volume and Persistent Volume Claim
Kubernetes separates storage provisioning from consumption. A PersistentVolume is a cluster storage resource an admin or driver provisions; a PersistentVolumeClaim is a pod's request for storage.
Mesh control plane vs data plane availability
The control plane configures and distributes policy; the data plane is the sidecars carrying traffic with cached config, so a brief control-plane outage keeps existing traffic flowing but…
How mounted ConfigMap updates propagate to pods
Kubelet refreshes mounted files within roughly a sync period via an atomic symlink swap, but the app must reload on its own; env-var injection never updates.
Image signing with Cosign vs trusting a digest
A digest proves content has not changed but not who produced it; Cosign cryptographically signs the digest so a verified key proves provenance, and policies enforce it at admission.
Docker layers and build cache efficiency
Each instruction makes a content-addressed read-only layer stacked by a union FS; shared layers are pushed/pulled once, and ordering the Dockerfile so volatile steps come last maximizes cache reuse.
Scaling on queue length with the HPA
Expose queue length through an external metrics adapter behind the metrics API, point the HPA at that external metric with a target per pod; KEDA packages this.
Impact of losing etcd quorum
Without quorum etcd goes read-only-ish and the API server cannot persist writes, so scheduling and changes stall, but kubelets keep running existing pods.
Container registries: public vs private
A registry stores and serves versioned image layers by digest; public registries are open and rate-limited, private ones add access control, scanning, signing and network isolation.
What makes a process a container to the kernel
Namespaces isolate and cgroups limit, but also capabilities, seccomp filters, mount/pivot_root for the rootfs, and SELinux/AppArmor labels.
Istio Gateway vs Kubernetes Ingress
Ingress is a simple built-in L7 entry abstraction; an Istio Gateway configures only ports and hosts at the edge while VirtualServices do routing, unlocking mesh features.
Guardrails for GitOps sync outages
Pre-merge schema validation, dry-run, policy gates and review; post-merge progressive sync, health checks with automated rollback, and pruning controls.
Retries and circuit breaking in a mesh
Configure bounded retries with timeouts for transient errors, and a circuit breaker via outlier detection plus connection-pool limits to shed load from a failing dependency.
How a service mesh enables automatic mTLS
The control plane issues short-lived workload certificates, sidecars present them, both sides verify identity and encrypt the channel.
Canary release with Istio traffic splitting
DestinationRule defines subsets by label, VirtualService routes weighted 90/10 to those subsets, then shift weights as the canary proves healthy.
When to build an Operator vs a Helm chart
Charts handle install-time templating; operators add continuous day-two logic like failover, backups, and scaling for stateful apps.
Adding a required field to a live CRD
Don't make it required immediately; add it optional with a default, introduce a new version with conversion, migrate existing objects, then tighten.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles