Docker &amp; Kubernetes

What are the three Pod QoS classes?

Guaranteed when every container sets equal requests and limits for CPU and memory; Burstable when requests are set but not matching limits; BestEffort when none are set; lower classes are evicted first under…

How do you stop new Pods scheduling on a node?

Kubectl cordon marks the node unschedulable so no new Pods land, while existing Pods keep running; drain is the follow-up that also evicts them.

How do you pin a Pod to nodes with a given label?

The simplest tool is nodeSelector, a key-value map in the Pod spec requiring matching node labels; node affinity is the richer alternative for complex rules.

Requests vs limits for CPU and memory?

Requests guide scheduling and reservation, limits cap usage; exceeding a CPU limit throttles the container, while exceeding a memory limit triggers an OOMKill since memory is incompressible.

How do you resize a live PersistentVolume?

Edit the PVC's requested size upward; the StorageClass must set allowVolumeExpansion true and the CSI driver must support expansion, ideally online so no Pod restart is needed; shrinking is not allowed.

How does a StatefulSet recover a Pod after node failure?

Node goes NotReady, Pod is marked for deletion, the same-ordinal Pod is recreated and reattaches its existing PVC from volumeClaimTemplates, preserving data; safety needs the old Pod confirmed…

Why is a Pod with a PVC stuck Pending?

PVC may be unbound from missing StorageClass, no matching PV, mismatched access mode or size, zone or capacity limits, or WaitForFirstConsumer; diagnose with describe on Pod and PVC plus events.

How does a StatefulSet give stable identity and storage?

Ordinal Pod names plus a headless Service yield stable per-Pod DNS; volumeClaimTemplates give each ordinal its own persistent PVC that follows it on reschedule.

What do PersistentVolume accessModes mean?

RWO mounts read-write by one node, ROX read-only by many nodes, RWX read-write by many nodes; block storage usually only supports RWO while shared filesystems enable RWX.

What is a StorageClass and dynamic provisioning?

A StorageClass names a provisioner and parameters; a PVC referencing it triggers on-demand PV creation, so admins do not pre-create volumes.

StatefulSet vs Deployment: what's the difference?

Deployments treat Pods as interchangeable; StatefulSets give stable ordinal names, stable per-Pod storage via volumeClaimTemplates, and ordered rollout.

Bind mounts vs named volumes for persisting Docker data?

Persist data outside the writable container layer via a bind mount (a host path you control) or a named volume (Docker-managed under its data dir, portable and the recommended default).

What happens to volume data when a Pod is deleted?

EmptyDir is tied to the Pod and erased when the Pod is deleted; a PVC-backed PV with Retain keeps the data after the PVC is released for manual recovery.

What are PersistentVolumes and PersistentVolumeClaims for?

A PV is a cluster storage resource the admin provisions; a PVC is a user's request for size and access mode; Kubernetes binds them, decoupling Pods from storage details.

How do Sealed Secrets enable GitOps for secrets?

Kubeseal encrypts a Secret with the controller's public key into a SealedSecret CR safe for Git; only the in-cluster controller's private key can decrypt it into a real Secret.

What do immutable ConfigMaps and Secrets solve?

Setting immutable true blocks data edits, preventing accidental updates and letting the kubelet skip watches, reducing API server load.

How do you inject secrets from an external store at runtime?

Use a sidecar injector or CSI driver that authenticates via the Pod's ServiceAccount token, fetches secrets at runtime, and mounts them on tmpfs.

How do you restrict a Pod's access to a Secret?

Pods read Secrets through their ServiceAccount and RBAC, scoped with resourceNames; mounted Secrets are governed by the Pod spec.

How do you let Pods pull from a private registry?

Create a dockerconfigjson Secret with registry creds; reference it via imagePullSecrets on the Pod or ServiceAccount.