Intermediate everything in Docker & Kubernetes
CNCF argues agents should propose system state, not receive production root
A CNCF Ambassador argues that agents should express changes as versioned system state and pass them through review, build and deployment controls instead of receiving unrestricted production root.
CNCF announces its 2026–2028 Ambassador cohort
CNCF accepted 58 new ambassadors for its 2026–2028 cohort, while 48 previous ambassadors stepped away.
ArgoCon previews the direction of Argo CD 4.0
CNCF previews ArgoCon North America 2026 and says the Argo community is beginning the visioning process for Argo CD 4.0. The event covers four distinct projects—Argo CD, Workflows, Rollouts, and Events—so learners can map each project to a delivery problem before treating the vision as a release.
Kubernetes 1.37 adds a native unused-PVC condition
Kubernetes 1.37 promotes PVC unused tracking to Beta, adding an Unused condition managed by the PVC protection controller.
Docker publishes Sandbox Kit Specification v3
Docker published an open-source Kit Specification v3 for packaging an agent’s runtime, tools, permissions, and network policy with its environment.
Docker introduces Cloud Sandboxes for long-running agents
Docker announced Cloud Sandboxes on 24 September: the same microVM isolation model as local Sandboxes, running on Docker-managed compute.
Alerting on under-replicated Deployments
Write an alerting rule comparing kube_state_metrics available vs desired replicas with for: 5m, Prometheus evaluates and fires to Alertmanager, which dedupes/routes/notifies.
PromQL for top 5 CPU-consuming pods
Apply rate() to the counter over 15m, sum by pod to combine containers, then wrap in topk(5); rate handles counter resets.
EFK centralized logging architecture
Fluentd runs as a DaemonSet collecting node container logs, parses and forwards to Elasticsearch for indexed storage, and Kibana queries and visualizes them.
Auto-discovering app pods for Prometheus scraping
Use kubernetes_sd_configs with role pod, relabel on pod annotations like prometheus.io/scrape to filter, and set path and port; with the Operator use a PodMonitor or ServiceMonitor.
Root and NET_ADMIN under Pod Security Standards
Set runAsUser 0 and capabilities add NET_ADMIN in the container securityContext; this is rejected by Restricted and Baseline, so the namespace must use the Privileged profile.
Write a frontend-to-backend NetworkPolicy
Set podSelector to app=backend, policyTypes Ingress, one ingress rule with from podSelector app=frontend and ports TCP 8080; the implicit deny handles the rest.
Namespace-scoped RBAC for a ServiceAccount
Create a Role in production granting create on deployments (apps group) and services (core group), then a RoleBinding tying that Role to the ServiceAccount.
Troubleshooting an RBAC forbidden error
Use kubectl auth can-i with --as impersonation to check the verb, inspect RoleBindings and ClusterRoleBindings, and read the role rules.
Taints and tolerations versus node affinity
Taints repel pods from nodes (reserve hardware), affinity attracts pods to nodes, and you combine both so only tolerating pods land AND only those pods seek the node.
Spreading replicas across availability zones
Use topologySpreadConstraints on topology.kubernetes.io/zone with a small maxSkew, choose DoNotSchedule or ScheduleAnyway, and confirm nodes carry zone labels.
Required vs preferred node affinity rules
Required is a mandatory filter, preferred is a weighted preference, and IgnoredDuringExecution means rules apply only at scheduling time.
What are the three Pod QoS classes?
Guaranteed when every container sets equal requests and limits for CPU and memory; Burstable when requests are set but not matching limits; BestEffort when none are set; lower classes are evicted first under…
How does a StatefulSet give stable identity and storage?
Ordinal Pod names plus a headless Service yield stable per-Pod DNS; volumeClaimTemplates give each ordinal its own persistent PVC that follows it on reschedule.
What do PersistentVolume accessModes mean?
RWO mounts read-write by one node, ROX read-only by many nodes, RWX read-write by many nodes; block storage usually only supports RWO while shared filesystems enable RWX.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles