More in DevOps & Cloud — page 9
Troubleshooting an RBAC forbidden error
WHAT IT TESTS: Practical RBAC debugging. OUTLINE: use kubectl auth can-i with --as impersonation to check the verb, inspect RoleBindings and ClusterRoleBindings, and read the role rules.
First NetworkPolicy flips a pod to default-deny
WHAT IT TESTS: NetworkPolicy default behavior. OUTLINE: once any policy selects a pod for a direction, that direction becomes default-deny and only explicitly allowed traffic passes; unselected pods stay open.
Role versus ClusterRole in RBAC
WHAT IT TESTS: RBAC scope basics. OUTLINE: Role is namespaced, ClusterRole is cluster-wide and covers cluster-scoped resources, and you grant either via a RoleBinding (namespaced) or ClusterRoleBinding (cluster-wide) to a subject.
Topology spread constraints versus pod anti-affinity
WHAT IT TESTS: Proportional spread versus binary repulsion. OUTLINE: spread constraints balance pod counts per domain bounded by maxSkew, anti-affinity is all-or-nothing co-location avoidance, and maxSkew caps the difference between fullest and emptiest…
tolerationSeconds and graceful eviction on NoExecute
WHAT IT TESTS: NoExecute eviction timing. OUTLINE: tolerationSeconds is how long a tolerating pod may stay after the taint applies; once it elapses eviction starts, then terminationGracePeriodSeconds governs the SIGTERM-to-SIGKILL window.
Pinning exclusive CPU cores to a pod
WHAT IT TESTS: Achieving CPU pinning. OUTLINE: set kubelet CPU Manager policy to static, make the pod Guaranteed QoS with integer CPU limits equal to requests, so it gets exclusive dedicated cores.
Taints and tolerations versus node affinity
WHAT IT TESTS: Knowing repulsion versus attraction. OUTLINE: taints repel pods from nodes (reserve hardware), affinity attracts pods to nodes, and you combine both so only tolerating pods land AND only those pods seek the node.
Spreading replicas across availability zones
WHAT IT TESTS: Designing zone-resilient placement. OUTLINE: use topologySpreadConstraints on topology.kubernetes.io/zone with a small maxSkew, choose DoNotSchedule or ScheduleAnyway, and confirm nodes carry zone labels.
Required vs preferred node affinity rules
WHAT IT TESTS: Understanding hard vs soft scheduling constraints. OUTLINE: required is a mandatory filter, preferred is a weighted preference, and IgnoredDuringExecution means rules apply only at scheduling time.
What are the three Pod QoS classes?
WHAT IT TESTS: QoS and eviction priority. OUTLINE: Guaranteed when every container sets equal requests and limits for CPU and memory; Burstable when requests are set but not matching limits; BestEffort when none are set; lower classes are evicted first under…
How do you stop new Pods scheduling on a node?
WHAT IT TESTS: node maintenance basics. OUTLINE: kubectl cordon marks the node unschedulable so no new Pods land, while existing Pods keep running; drain is the follow-up that also evicts them.
How do you pin a Pod to nodes with a given label?
WHAT IT TESTS: basic node selection. OUTLINE: the simplest tool is nodeSelector, a key-value map in the Pod spec requiring matching node labels; node affinity is the richer alternative for complex rules.
Requests vs limits for CPU and memory?
WHAT IT TESTS: resource management basics. OUTLINE: requests guide scheduling and reservation, limits cap usage; exceeding a CPU limit throttles the container, while exceeding a memory limit triggers an OOMKill since memory is incompressible.
How do you resize a live PersistentVolume?
WHAT IT TESTS: online volume expansion. OUTLINE: edit the PVC's requested size upward; the StorageClass must set allowVolumeExpansion true and the CSI driver must support expansion, ideally online so no Pod restart is needed; shrinking is not allowed.
How does a StatefulSet recover a Pod after node failure?
WHAT IT TESTS: failure recovery for stateful workloads. OUTLINE: node goes NotReady, Pod is marked for deletion, the same-ordinal Pod is recreated and reattaches its existing PVC from volumeClaimTemplates, preserving data; safety needs the old Pod confirmed…
Why is a Pod with a PVC stuck Pending?
WHAT IT TESTS: storage troubleshooting. OUTLINE: PVC may be unbound from missing StorageClass, no matching PV, mismatched access mode or size, zone or capacity limits, or WaitForFirstConsumer; diagnose with describe on Pod and PVC plus events.
How does a StatefulSet give stable identity and storage?
WHAT IT TESTS: the mechanics behind StatefulSet guarantees. OUTLINE: ordinal Pod names plus a headless Service yield stable per-Pod DNS; volumeClaimTemplates give each ordinal its own persistent PVC that follows it on reschedule.
What do PersistentVolume accessModes mean?
WHAT IT TESTS: access mode semantics. OUTLINE: RWO mounts read-write by one node, ROX read-only by many nodes, RWX read-write by many nodes; block storage usually only supports RWO while shared filesystems enable RWX.
What is a StorageClass and dynamic provisioning?
WHAT IT TESTS: dynamic provisioning. OUTLINE: a StorageClass names a provisioner and parameters; a PVC referencing it triggers on-demand PV creation, so admins do not pre-create volumes.
StatefulSet vs Deployment: what's the difference?
WHAT IT TESTS: choosing the right workload controller. OUTLINE: Deployments treat Pods as interchangeable; StatefulSets give stable ordinal names, stable per-Pod storage via volumeClaimTemplates, and ordered rollout.