More in DevOps & Cloud — page 18
Mesh control plane vs data plane availability
WHAT IT TESTS: mesh plane separation and failure modes. OUTLINE: the control plane configures and distributes policy; the data plane is the sidecars carrying traffic with cached config, so a brief control-plane outage keeps existing traffic flowing but…
How mounted ConfigMap updates propagate to pods
WHAT IT TESTS: ConfigMap volume update semantics. OUTLINE: kubelet refreshes mounted files within roughly a sync period via an atomic symlink swap, but the app must reload on its own; env-var injection never updates.
Image signing with Cosign vs trusting a digest
WHAT IT TESTS: integrity vs authenticity. OUTLINE: a digest proves content has not changed but not who produced it; Cosign cryptographically signs the digest so a verified key proves provenance, and policies enforce it at admission.
Docker layers and build cache efficiency
WHAT IT TESTS: layer/union FS and caching. OUTLINE: each instruction makes a content-addressed read-only layer stacked by a union FS; shared layers are pushed/pulled once, and ordering the Dockerfile so volatile steps come last maximizes cache reuse.
Scaling on queue length with the HPA
WHAT IT TESTS: external-metric autoscaling. OUTLINE: expose queue length through an external metrics adapter behind the metrics API, point the HPA at that external metric with a target per pod; KEDA packages this.
Impact of losing etcd quorum
WHAT IT TESTS: control vs data plane separation. OUTLINE: without quorum etcd goes read-only-ish and the API server cannot persist writes, so scheduling and changes stall, but kubelets keep running existing pods.
Container registries: public vs private
WHAT IT TESTS: image distribution and governance. OUTLINE: a registry stores and serves versioned image layers by digest; public registries are open and rate-limited, private ones add access control, scanning, signing and network isolation.
What makes a process a container to the kernel
WHAT IT TESTS: container internals beyond the basics. OUTLINE: namespaces isolate and cgroups limit, but also capabilities, seccomp filters, mount/pivot_root for the rootfs, and SELinux/AppArmor labels.
Istio Gateway vs Kubernetes Ingress
WHAT IT TESTS: edge traffic models. OUTLINE: Ingress is a simple built-in L7 entry abstraction; an Istio Gateway configures only ports and hosts at the edge while VirtualServices do routing, unlocking mesh features.
Guardrails for GitOps sync outages
WHAT IT TESTS: layered safeguards around GitOps. OUTLINE: pre-merge schema validation, dry-run, policy gates and review; post-merge progressive sync, health checks with automated rollback, and pruning controls.
Method-aware authorization with Istio policy
WHAT IT TESTS: identity- and method-scoped authz. OUTLINE: an ALLOW policy on user-service granting frontend's principal POST plus the users path, another granting all principals GET; deny is implicit once any ALLOW exists.
Diagnosing latency with distributed tracing
WHAT IT TESTS: using traces to localize a bottleneck. OUTLINE: follow the trace ID across spans, compare per-span durations to find the slow hop, distinguish service time from network and queueing.
Retries and circuit breaking in a mesh
WHAT IT TESTS: resilience patterns at the proxy. OUTLINE: configure bounded retries with timeouts for transient errors, and a circuit breaker via outlier detection plus connection-pool limits to shed load from a failing dependency.
How a service mesh enables automatic mTLS
WHAT IT TESTS: identity and the data-plane handshake. OUTLINE: the control plane issues short-lived workload certificates, sidecars present them, both sides verify identity and encrypt the channel.
Canary release with Istio traffic splitting
WHAT IT TESTS: Istio traffic management. OUTLINE: DestinationRule defines subsets by label, VirtualService routes weighted 90/10 to those subsets, then shift weights as the canary proves healthy.
The sidecar proxy pattern in a mesh
WHAT IT TESTS: how meshes intercept traffic transparently. OUTLINE: a proxy container shares the pod, all in/out traffic is redirected through it, so policy and telemetry apply without code changes.
What a service mesh solves
WHAT IT TESTS: the purpose of a mesh. OUTLINE: it adds traffic management, security via mTLS, and observability at the network layer through sidecars, beyond what plain Kubernetes offers.
Preventing split-brain in HA Operators
WHAT IT TESTS: leader election in controllers. OUTLINE: run active-passive replicas, only the leader reconciles, election uses a Lease object renewed under a TTL. RED FLAG: thinking all replicas reconcile in parallel or relying on optimistic locking alone.
Mutating vs Validating webhooks with an Operator
WHAT IT TESTS: knowledge of the admission chain. OUTLINE: mutating runs first to inject defaults or sidecars, validating runs after to reject bad specs, both keyed to your CRD. RED FLAG: confusing the ordering or roles.
Keeping operator .status accurate under failures
WHAT IT TESTS: status reliability under faults. OUTLINE: status can lag or go stale during partitions and crashes; make reconcile idempotent, observe true state each loop, use conditions and observedGeneration, handle conflicts.