Intermediate everything in DevOps & Cloud, page 5
Baggage in Distributed Tracing
Baggage is key-value context propagated alongside a trace across service boundaries, so downstream services can read values set upstream. It enables cross-cutting context like tenant id, but it travels in headers on every hop, so overuse adds latency and leak…
Auto-Instrumentation
Auto-instrumentation automatically adds telemetry to an application without manual code changes, by hooking into libraries, frameworks, or the runtime. It gives broad baseline observability fast, but produces generic spans that often need manual…
Metrics in Observability
Metrics are numeric measurements aggregated over time, like counters, gauges, and histograms. They are cheap to store and fast to query, making them ideal for dashboards and alerting, but their pre-aggregation discards per-event detail needed for deep…
Observability vs Monitoring
Monitoring watches predefined metrics and alerts on known failure modes you anticipated. Observability is the property of being able to ask new questions about a system's internal state from its outputs, letting you debug unknown failures you never predicted…
Alerting on under-replicated Deployments
Write an alerting rule comparing kube_state_metrics available vs desired replicas with for: 5m, Prometheus evaluates and fires to Alertmanager, which dedupes/routes/notifies.
PromQL for top 5 CPU-consuming pods
Apply rate() to the counter over 15m, sum by pod to combine containers, then wrap in topk(5); rate handles counter resets.
EFK centralized logging architecture
Fluentd runs as a DaemonSet collecting node container logs, parses and forwards to Elasticsearch for indexed storage, and Kibana queries and visualizes them.
Auto-discovering app pods for Prometheus scraping
Use kubernetes_sd_configs with role pod, relabel on pod annotations like prometheus.io/scrape to filter, and set path and port; with the Operator use a PodMonitor or ServiceMonitor.
Root and NET_ADMIN under Pod Security Standards
Set runAsUser 0 and capabilities add NET_ADMIN in the container securityContext; this is rejected by Restricted and Baseline, so the namespace must use the Privileged profile.
Write a frontend-to-backend NetworkPolicy
Set podSelector to app=backend, policyTypes Ingress, one ingress rule with from podSelector app=frontend and ports TCP 8080; the implicit deny handles the rest.
Namespace-scoped RBAC for a ServiceAccount
Create a Role in production granting create on deployments (apps group) and services (core group), then a RoleBinding tying that Role to the ServiceAccount.
Troubleshooting an RBAC forbidden error
Use kubectl auth can-i with --as impersonation to check the verb, inspect RoleBindings and ClusterRoleBindings, and read the role rules.
Taints and tolerations versus node affinity
Taints repel pods from nodes (reserve hardware), affinity attracts pods to nodes, and you combine both so only tolerating pods land AND only those pods seek the node.
Spreading replicas across availability zones
Use topologySpreadConstraints on topology.kubernetes.io/zone with a small maxSkew, choose DoNotSchedule or ScheduleAnyway, and confirm nodes carry zone labels.
Required vs preferred node affinity rules
Required is a mandatory filter, preferred is a weighted preference, and IgnoredDuringExecution means rules apply only at scheduling time.
What are the three Pod QoS classes?
Guaranteed when every container sets equal requests and limits for CPU and memory; Burstable when requests are set but not matching limits; BestEffort when none are set; lower classes are evicted first under…
How does a StatefulSet give stable identity and storage?
Ordinal Pod names plus a headless Service yield stable per-Pod DNS; volumeClaimTemplates give each ordinal its own persistent PVC that follows it on reschedule.
What do PersistentVolume accessModes mean?
RWO mounts read-write by one node, ROX read-only by many nodes, RWX read-write by many nodes; block storage usually only supports RWO while shared filesystems enable RWX.
What is a StorageClass and dynamic provisioning?
A StorageClass names a provisioner and parameters; a PVC referencing it triggers on-demand PV creation, so admins do not pre-create volumes.
StatefulSet vs Deployment: what's the difference?
Deployments treat Pods as interchangeable; StatefulSets give stable ordinal names, stable per-Pod storage via volumeClaimTemplates, and ordered rollout.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles