Intermediate everything in Docker & Kubernetes, page 3
When to build an Operator vs a Helm chart
Charts handle install-time templating; operators add continuous day-two logic like failover, backups, and scaling for stateful apps.
Adding a required field to a live CRD
Don't make it required immediately; add it optional with a default, introduce a new version with conversion, migrate existing objects, then tighten.
Finalizers for clean external cleanup
A finalizer is a key blocking deletion; deletion sets deletionTimestamp, the operator does cleanup then removes the finalizer so the object is purged.
The reconciliation loop in an Operator
Reconcile compares desired spec to observed state and converges them, idempotently; triggered by resource changes, watched dependents, and periodic resync.
Argo CD App of Apps pattern
A parent Application whose manifests are themselves Application resources, so syncing one app declaratively manages many.
Managing secrets in a GitOps workflow
Never commit plaintext; encrypt with Sealed Secrets or SOPS, or reference an external store via External Secrets Operator.
How GitOps controllers detect drift and sync
The controller renders desired manifests from Git, diffs them against live cluster objects, marks OutOfSync, then a sync applies the diff to converge.
Helm upgrade and rollback workflow
Helm upgrade creates a new revision; helm history lists revisions; helm rollback reverts to a prior one; --atomic auto-rolls-back on failure.
What is distributed tracing in microservices?
A trace is a tree of spans tied by trace and span IDs, propagated via headers like W3C traceparent.
Debugging Service connectivity between Pods
Kubectl get endpoints to check the Service has Pod IPs (selector match); kubectl describe service to verify selector and ports; exec into the frontend to curl the Service DNS name.
Headless Services and direct Pod DNS
Set clusterIP: None so no virtual IP or proxy load balancing; DNS returns individual Pod IPs (A records). Primary use: StatefulSets needing stable per-Pod addressing.
Ingress for host and path routing
Use an Ingress with an Ingress controller for layer-7 host/path routing behind one external IP, instead of one cloud LoadBalancer per service.
Cross-namespace Service DNS resolution
CoreDNS gives each Service a name; cross-namespace you must qualify it as my-service.B.svc.cluster.local (or my-service.B).
Sharing ephemeral cache between containers in a Pod
Use an emptyDir volume defined in the Pod spec and mounted into each container at the cache path; it is created with the Pod and deleted when the Pod is removed.
Liveness vs readiness probes
Liveness restarts a stuck container; readiness gates traffic by controlling Service endpoint membership. Readiness-only fits an app that pauses to reload a large cache but is still healthy.
Rolling back a bad Deployment
Kubectl rollout undo deployment/NAME reverts to the prior revision by scaling the old ReplicaSet back up and the bad one down.
How a Deployment rolling update works
New image creates a new ReplicaSet; Deployment scales it up while scaling the old one down per maxSurge/maxUnavailable; old ReplicaSet is retained at zero for rollback.
Deployment versus StatefulSet
Deployments suit interchangeable stateless replicas, StatefulSets give stable identities, ordered rollout, and per-Pod persistent storage for stateful systems.
The Kubernetes reconciliation loop
A controller continuously observes actual state, compares to desired state in the spec, and acts to close the gap, level-triggered not edge-triggered.
etcd as the cluster source of truth
Etcd is the consistent key-value store holding all cluster state, accessed only via the apiserver, and uses Raft needing a quorum.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles