Intermediate interview questions in Docker & Kubernetes, page 3
Write a frontend-to-backend NetworkPolicy
Set podSelector to app=backend, policyTypes Ingress, one ingress rule with from podSelector app=frontend and ports TCP 8080; the implicit deny handles the rest.
Root and NET_ADMIN under Pod Security Standards
Set runAsUser 0 and capabilities add NET_ADMIN in the container securityContext; this is rejected by Restricted and Baseline, so the namespace must use the Privileged profile.
Auto-discovering app pods for Prometheus scraping
Use kubernetes_sd_configs with role pod, relabel on pod annotations like prometheus.io/scrape to filter, and set path and port; with the Operator use a PodMonitor or ServiceMonitor.
EFK centralized logging architecture
Fluentd runs as a DaemonSet collecting node container logs, parses and forwards to Elasticsearch for indexed storage, and Kibana queries and visualizes them.
PromQL for top 5 CPU-consuming pods
Apply rate() to the counter over 15m, sum by pod to combine containers, then wrap in topk(5); rate handles counter resets.
Alerting on under-replicated Deployments
Write an alerting rule comparing kube_state_metrics available vs desired replicas with for: 5m, Prometheus evaluates and fires to Alertmanager, which dedupes/routes/notifies.
What is distributed tracing in microservices?
A trace is a tree of spans tied by trace and span IDs, propagated via headers like W3C traceparent.
Helm upgrade and rollback workflow
Helm upgrade creates a new revision; helm history lists revisions; helm rollback reverts to a prior one; --atomic auto-rolls-back on failure.
How GitOps controllers detect drift and sync
The controller renders desired manifests from Git, diffs them against live cluster objects, marks OutOfSync, then a sync applies the diff to converge.
Managing secrets in a GitOps workflow
Never commit plaintext; encrypt with Sealed Secrets or SOPS, or reference an external store via External Secrets Operator.
Argo CD App of Apps pattern
A parent Application whose manifests are themselves Application resources, so syncing one app declaratively manages many.
The reconciliation loop in an Operator
Reconcile compares desired spec to observed state and converges them, idempotently; triggered by resource changes, watched dependents, and periodic resync.
Finalizers for clean external cleanup
A finalizer is a key blocking deletion; deletion sets deletionTimestamp, the operator does cleanup then removes the finalizer so the object is purged.
Adding a required field to a live CRD
Don't make it required immediately; add it optional with a default, introduce a new version with conversion, migrate existing objects, then tighten.
When to build an Operator vs a Helm chart
Charts handle install-time templating; operators add continuous day-two logic like failover, backups, and scaling for stateful apps.
Canary release with Istio traffic splitting
DestinationRule defines subsets by label, VirtualService routes weighted 90/10 to those subsets, then shift weights as the canary proves healthy.
How a service mesh enables automatic mTLS
The control plane issues short-lived workload certificates, sidecars present them, both sides verify identity and encrypt the channel.
Retries and circuit breaking in a mesh
Configure bounded retries with timeouts for transient errors, and a circuit breaker via outlier detection plus connection-pool limits to shed load from a failing dependency.
Guardrails for GitOps sync outages
Pre-merge schema validation, dry-run, policy gates and review; post-merge progressive sync, health checks with automated rollback, and pruning controls.
Istio Gateway vs Kubernetes Ingress
Ingress is a simple built-in L7 entry abstraction; an Istio Gateway configures only ports and hosts at the edge while VirtualServices do routing, unlocking mesh features.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles