Advanced everything in Docker & Kubernetes, page 2
Keeping operator .status accurate under failures
Status can lag or go stale during partitions and crashes; make reconcile idempotent, observe true state each loop, use conditions and observedGeneration, handle conflicts.
Helm migration hooks under GitOps
Use a pre-upgrade hook Job with weights and delete policy; the challenge is GitOps tools render statically and reconcile, conflicting with Helm's imperative hook lifecycle.
GitOps repo layout for environment promotion
Shared base plus per-env overlays via Kustomize or value files, promotion by PR moving a pinned version forward, separating app source from config repos.
Head-based vs tail-based trace sampling
Head decides up front (cheap, may miss rare errors); tail decides after the trace completes (catches errors and slow traces but needs buffering).
Diagnose a Prometheus cardinality explosion
Find offenders via TSDB stats and topk count by __name__, identify unbounded labels, then drop or aggregate them with relabeling.
Ingress resource vs Ingress controller
The Ingress resource is declarative routing rules; the controller is the running proxy (NGINX, etc.) that reads them and serves traffic.
Restricting Pod ingress with a NetworkPolicy
Create a NetworkPolicy with podSelector app=frontend, policyTypes Ingress, and one ingress from-rule matching podSelector role=api-gateway; requires a CNI that enforces policies.
kube-proxy and iptables vs IPVS modes
Kube-proxy watches Services/endpoints and programs node rules so ClusterIP traffic is DNAT'd to a backend Pod; iptables uses sequential rule chains, IPVS uses a hash table with real…
Spreading Pods one-per-node for availability
Use required podAntiAffinity with topologyKey kubernetes.io/hostname matching the Deployment's own pod labels, so the scheduler refuses to co-locate two Pods on a node.
Stalled rollouts and progressDeadlineSeconds
With maxUnavailable respected, the rollout pauses partway and old Pods keep serving; progressDeadlineSeconds marks the Deployment as failed after no progress for that window.
Tuning maxSurge and maxUnavailable
MaxSurge allows Pods above desired; maxUnavailable allows Pods below desired during update. For zero downtime and speed, set maxUnavailable 0 and maxSurge high (e.g. 100%).
CRDs and the Operator pattern
CRDs add new API object types, an Operator pairs a CRD with a controller that runs a reconciliation loop encoding domain operational knowledge.
Scheduler filtering and scoring phases
Filtering eliminates infeasible Nodes via resources, taints, and affinity, then scoring ranks the survivors to pick the best, after which the Pod is bound.
Reducing cross-region image pull costs
A per-region pull-through cache or geo-replicated registry serves pulls locally, cutting latency and egress, traded against consistency lag, storage cost, and cache management.
Vulnerability scanning as a deploy gate
Scan with Trivy or Clair, fail the build on high or critical severity above threshold, and enforce again at admission with signing and registry policies.
Docker Compose profiles for optional services
Profiles tag services so they stay off by default, activate via --profile or COMPOSE_PROFILES, and unprofiled services always run.
Optimizing Dockerfile layer caching
Order instructions least-to-most volatile, copy dependency manifests and install before copying source, and understand any changed layer busts all later layers.
Structuring Compose files across environments
A base compose.yaml plus override files, the default override auto-merge, and explicit -f flags or extends per environment.
EndpointSlice: Splitting the Monolithic Endpoints List
EndpointSlice shards a service's pod backends into smaller chunks instead of one massive list. This keeps kube-proxy and DNS fast when services scale to thousands of pods. Do not edit them by hand; the controller owns them and will overwrite your changes.
Pod QoS Classes: Guaranteed, Burstable, BestEffort
Kubernetes QoS classes are eviction priorities, not performance guarantees. Under node pressure, the kubelet kills BestEffort pods first, then Burstable, then Guaranteed. Omitting limits does not grant infinite headroom; it makes your pod die first.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles