Intermediate everything in DevOps & Cloud, page 6
Root and NET_ADMIN under Pod Security Standards
Set runAsUser 0 and capabilities add NET_ADMIN in the container securityContext; this is rejected by Restricted and Baseline, so the namespace must use the Privileged profile.
Write a frontend-to-backend NetworkPolicy
Set podSelector to app=backend, policyTypes Ingress, one ingress rule with from podSelector app=frontend and ports TCP 8080; the implicit deny handles the rest.
Namespace-scoped RBAC for a ServiceAccount
Create a Role in production granting create on deployments (apps group) and services (core group), then a RoleBinding tying that Role to the ServiceAccount.
Troubleshooting an RBAC forbidden error
Use kubectl auth can-i with --as impersonation to check the verb, inspect RoleBindings and ClusterRoleBindings, and read the role rules.
Taints and tolerations versus node affinity
Taints repel pods from nodes (reserve hardware), affinity attracts pods to nodes, and you combine both so only tolerating pods land AND only those pods seek the node.
Spreading replicas across availability zones
Use topologySpreadConstraints on topology.kubernetes.io/zone with a small maxSkew, choose DoNotSchedule or ScheduleAnyway, and confirm nodes carry zone labels.
Required vs preferred node affinity rules
Required is a mandatory filter, preferred is a weighted preference, and IgnoredDuringExecution means rules apply only at scheduling time.
What are the three Pod QoS classes?
Guaranteed when every container sets equal requests and limits for CPU and memory; Burstable when requests are set but not matching limits; BestEffort when none are set; lower classes are evicted first under…
How does a StatefulSet give stable identity and storage?
Ordinal Pod names plus a headless Service yield stable per-Pod DNS; volumeClaimTemplates give each ordinal its own persistent PVC that follows it on reschedule.
What do PersistentVolume accessModes mean?
RWO mounts read-write by one node, ROX read-only by many nodes, RWX read-write by many nodes; block storage usually only supports RWO while shared filesystems enable RWX.
What is a StorageClass and dynamic provisioning?
A StorageClass names a provisioner and parameters; a PVC referencing it triggers on-demand PV creation, so admins do not pre-create volumes.
StatefulSet vs Deployment: what's the difference?
Deployments treat Pods as interchangeable; StatefulSets give stable ordinal names, stable per-Pod storage via volumeClaimTemplates, and ordered rollout.
How do you restrict a Pod's access to a Secret?
Pods read Secrets through their ServiceAccount and RBAC, scoped with resourceNames; mounted Secrets are governed by the Pod spec.
How do you let Pods pull from a private registry?
Create a dockerconfigjson Secret with registry creds; reference it via imagePullSecrets on the Pod or ServiceAccount.
Are base64-encoded Kubernetes Secrets actually secure?
Base64 is reversible, not a protection; default guards against accidental shoulder-surfing only; real defenses are encryption-at-rest, RBAC, audit.
Bind mounts versus named volumes
A bind mount maps a host path into the container (great for live source in dev); a named volume is Docker-managed storage decoupled from the host layout (ideal for database data).
Compose image directive versus build directive
Image pulls a prebuilt image from a registry; build builds from a local Dockerfile and context; use build for your own custom application code.
Manage startup order and readiness in Compose
Depends_on only orders start, not readiness; add a healthcheck to the DB and use depends_on with condition: service_healthy so the web app waits until the DB passes its health check.
Docker Compose default networking
Compose creates one default user-defined bridge network for the project; all services join it and reach each other by service name via embedded DNS, isolated from other projects.
What is a dangling image and how to prune it
A dangling image is an untagged layer (<none>:<none>) orphaned when a tag moves to a rebuilt image; list with docker images -f dangling=true, remove with docker image prune.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles