What are the three Pod QoS classes?
WHAT IT TESTS: QoS and eviction priority. OUTLINE: Guaranteed when every container sets equal requests and limits for CPU and memory; Burstable when requests are set but not matching limits; BestEffort when none are set; lower classes are evicted first under…
How do you stop new Pods scheduling on a node?
WHAT IT TESTS: node maintenance basics. OUTLINE: kubectl cordon marks the node unschedulable so no new Pods land, while existing Pods keep running; drain is the follow-up that also evicts them.
How do you pin a Pod to nodes with a given label?
WHAT IT TESTS: basic node selection. OUTLINE: the simplest tool is nodeSelector, a key-value map in the Pod spec requiring matching node labels; node affinity is the richer alternative for complex rules.
Requests vs limits for CPU and memory?
WHAT IT TESTS: resource management basics. OUTLINE: requests guide scheduling and reservation, limits cap usage; exceeding a CPU limit throttles the container, while exceeding a memory limit triggers an OOMKill since memory is incompressible.
How do you resize a live PersistentVolume?
WHAT IT TESTS: online volume expansion. OUTLINE: edit the PVC's requested size upward; the StorageClass must set allowVolumeExpansion true and the CSI driver must support expansion, ideally online so no Pod restart is needed; shrinking is not allowed.
How does a StatefulSet recover a Pod after node failure?
WHAT IT TESTS: failure recovery for stateful workloads. OUTLINE: node goes NotReady, Pod is marked for deletion, the same-ordinal Pod is recreated and reattaches its existing PVC from volumeClaimTemplates, preserving data; safety needs the old Pod confirmed…
Why is a Pod with a PVC stuck Pending?
WHAT IT TESTS: storage troubleshooting. OUTLINE: PVC may be unbound from missing StorageClass, no matching PV, mismatched access mode or size, zone or capacity limits, or WaitForFirstConsumer; diagnose with describe on Pod and PVC plus events.
How does a StatefulSet give stable identity and storage?
WHAT IT TESTS: the mechanics behind StatefulSet guarantees. OUTLINE: ordinal Pod names plus a headless Service yield stable per-Pod DNS; volumeClaimTemplates give each ordinal its own persistent PVC that follows it on reschedule.
What do PersistentVolume accessModes mean?
WHAT IT TESTS: access mode semantics. OUTLINE: RWO mounts read-write by one node, ROX read-only by many nodes, RWX read-write by many nodes; block storage usually only supports RWO while shared filesystems enable RWX.
What is a StorageClass and dynamic provisioning?
WHAT IT TESTS: dynamic provisioning. OUTLINE: a StorageClass names a provisioner and parameters; a PVC referencing it triggers on-demand PV creation, so admins do not pre-create volumes.
StatefulSet vs Deployment: what's the difference?
WHAT IT TESTS: choosing the right workload controller. OUTLINE: Deployments treat Pods as interchangeable; StatefulSets give stable ordinal names, stable per-Pod storage via volumeClaimTemplates, and ordered rollout.
Bind mounts vs named volumes for persisting Docker data?
WHAT IT TESTS: Docker storage options. OUTLINE: persist data outside the writable container layer via a bind mount (a host path you control) or a named volume (Docker-managed under its data dir, portable and the recommended default).
What happens to volume data when a Pod is deleted?
WHAT IT TESTS: volume lifecycle awareness. OUTLINE: emptyDir is tied to the Pod and erased when the Pod is deleted; a PVC-backed PV with Retain keeps the data after the PVC is released for manual recovery.
What are PersistentVolumes and PersistentVolumeClaims for?
WHAT IT TESTS: the storage abstraction split. OUTLINE: a PV is a cluster storage resource the admin provisions; a PVC is a user's request for size and access mode; Kubernetes binds them, decoupling Pods from storage details.
How do Sealed Secrets enable GitOps for secrets?
WHAT IT TESTS: asymmetric-crypto GitOps pattern. OUTLINE: kubeseal encrypts a Secret with the controller's public key into a SealedSecret CR safe for Git; only the in-cluster controller's private key can decrypt it into a real Secret.
What do immutable ConfigMaps and Secrets solve?
WHAT IT TESTS: knowledge of the immutable field. OUTLINE: setting immutable true blocks data edits, preventing accidental updates and letting the kubelet skip watches, reducing API server load.
How do you inject secrets from an external store at runtime?
WHAT IT TESTS: external secret-management patterns. OUTLINE: use a sidecar injector or CSI driver that authenticates via the Pod's ServiceAccount token, fetches secrets at runtime, and mounts them on tmpfs.
How do you restrict a Pod's access to a Secret?
WHAT IT TESTS: how Pods get Secret access via identity. OUTLINE: Pods read Secrets through their ServiceAccount and RBAC, scoped with resourceNames; mounted Secrets are governed by the Pod spec.
How do you let Pods pull from a private registry?
WHAT IT TESTS: knowledge of image-pull secrets. OUTLINE: create a dockerconfigjson Secret with registry creds; reference it via imagePullSecrets on the Pod or ServiceAccount.
Are base64-encoded Kubernetes Secrets actually secure?
WHAT IT TESTS: understanding that encoding is not encryption. OUTLINE: base64 is reversible, not a protection; default guards against accidental shoulder-surfing only; real defenses are encryption-at-rest, RBAC, audit.