←

# kubernetes

// [58] real interview questions. Answers and sources live in the practice app.

practice this topic
  1. You deploy a pod and it goes into CrashLoopBackOff. What does that status mean and how do you debug it?(mid)
  2. A pod you created is stuck in Pending state. What are the possible reasons and how do you find the actual one?(mid)
  3. A pod shows the status ErrImagePull (or ImagePullBackOff). What does it mean and how do you resolve it?(junior)
  4. When would you NOT use Kubernetes? Give concrete cases where adopting it is the wrong call.(senior)
  5. Walk through what happens, component by component, from the moment you run `kubectl run` (or apply a Pod manifest) until the container is running.(mid)
  6. A container in your cluster keeps getting OOMKilled. What is happening and how do you prevent memory issues like this cluster-wide?(mid)
  7. What QoS classes does Kubernetes assign to pods, and why do they matter when a node comes under memory pressure?(senior)
  8. Explain liveness and readiness probes. What can go wrong if you configure a liveness probe badly?(mid)
  9. How does a failing readiness probe affect a Service that selects the pod?(mid)
  10. What exactly happens when you delete a pod? Why does graceful termination matter for zero-downtime deploys?(mid)
  11. Differentiate between Deployments, StatefulSets, and DaemonSets. When do you pick each?(mid)
  12. You start a rolling update and halfway through the new pods are failing. What does Kubernetes do, and what do you do? What would you configure beforehand to make this safe?(senior)
  13. What Service types exist in Kubernetes and when do you use each?(junior)
  14. How does a Service actually route traffic to pods? Explain the roles of labels, Endpoints, and kube-proxy.(mid)
  15. An application behind a Service suddenly became unreachable. Walk through how you troubleshoot it end to end.(senior)
  16. What is an Ingress, what is an Ingress Controller, and why do you need both?(mid)
  17. How does DNS-based service discovery work inside a Kubernetes cluster?(mid)
  18. By default, can any pod talk to any other pod in the cluster? How do NetworkPolicies change that, and what's a common gotcha?(mid)
  19. Multiple teams share one cluster. How do you keep them from stepping on each other and from consuming all cluster resources?(mid)
  20. What happens to running pods if the kubelet stops on a worker node?(senior)
  21. Why does Kubernetes use etcd instead of a SQL or document database? What guarantees does it rely on?(senior)
  22. Are Kubernetes Secrets actually secure by default? How do you handle secrets properly, including in Git?(senior)
  23. Explain RBAC in Kubernetes: Role vs ClusterRole, RoleBinding, and what ServiceAccounts are for.(mid)
  24. A ReplicaSet maintains 3 replicas. What happens if you delete one of its pods directly with `kubectl delete pod`? And if you remove the matched label from a pod?(junior)
  25. If ReplicaSets already keep the right number of pods running, why do you use a Deployment instead of creating ReplicaSets directly?(junior)
  26. Explain PersistentVolume, PersistentVolumeClaim, and StorageClass. How does dynamic provisioning work?(mid)
  27. When is it legitimate to run multiple containers in one pod, and why is one container per pod still the norm?(junior)
  28. A CronJob runs every minute with concurrencyPolicy: Allow and sometimes its jobs hang or fail. What goes wrong over time and how do you fix it?(senior)
  29. How does the Horizontal Pod Autoscaler work, and what must be true for it to function?(mid)
  30. You manage several Kubernetes clusters. How do you switch between them with kubectl, and where is that configuration stored?(junior)
  31. ConfigMap vs Secret: what's the difference and how do you get their values into a running container?(mid)
  32. What is a Kubernetes Operator, and when do you need one instead of a plain Deployment plus Helm chart?(senior)
  33. You suspect a pod is having issues but have no specifics. Describe your generic first-five-minutes debugging workflow.(mid)
  34. What is a pod, and why is it the smallest deployable unit in Kubernetes rather than the container?(junior)
  35. You add a taint to a node to keep general workloads off it, but a critical DaemonSet pod stops getting scheduled there too. What happened, and how do you fix it while keeping the taint?(senior)
  36. Contrast nodeSelector, node affinity, and pod (anti-)affinity. When would you reach for `preferred` over `required` scheduling rules?(senior)
  37. You need to patch the OS on a worker node without disrupting the apps on it. Walk through the drain/cordon workflow and the failure mode a PodDisruptionBudget prevents.(senior)
  38. Explain how a validating vs mutating admission webhook fits into request handling, and the operational risk of a webhook that's down.(senior)
  39. Your app must not start until a database migration has run and a config file exists. How do you guarantee that ordering in a pod, and how is it different from a sidecar?(mid)
  40. What is a headless Service, and why do StatefulSets require one?(mid)
  41. A node's disk fills up and pods on it start getting evicted, some with status 'Evicted' piling up. What's the mechanism, and how do you prevent it recurring?(senior)
  42. What are static pods, how do they differ from normal pods, and where do you actually find the control-plane's own static pods?(mid)
  43. Labels vs annotations: they're both key-value metadata on objects, so when do you use which, and what breaks if you confuse them?(mid)
  44. Helm gives you templating and releases — but where does it fall short, and what do you actually gain over `kubectl apply -f`?(mid)
  45. Your cluster is on version 1.28 and you need to upgrade. In what order do you upgrade components, and why can't you skip minor versions?(senior)
  46. How would you run a blue-green or canary release in Kubernetes using native primitives, and what's the honest limitation of doing it with plain Deployments?(senior)
  47. etcd on your cluster gets corrupted or you lose quorum. What's the blast radius, and how do you recover?(senior)
  48. HPA scales pods; who scales the nodes? Explain Cluster Autoscaler and one way it interacts badly with the HPA.(senior)
  49. Can you run HPA and VPA on the same workload? What's the conflict, and when do you use VPA?(senior)
  50. A pod is misbehaving but its image is distroless — no shell, no debugging tools. How do you inspect it live without rebuilding the image?(senior)
  51. What is a securityContext, and which settings would you set to harden a pod that shouldn't need root?(senior)
  52. You try to delete a namespace and it hangs in Terminating for a long time. What's usually causing this, and how do you resolve it safely?(senior)
  53. kube-proxy can run in iptables or IPVS mode. Why does the choice matter at scale, and what's replacing kube-proxy entirely?(senior)
  54. You set a memory request of 128Mi and a limit of 512Mi on every pod to be safe. What's the downside of that gap, and how does the request affect scheduling vs the limit?(mid)
  55. A pod's ServiceAccount token is broader than it needs to be. Describe a realistic privilege-escalation path in a cluster and the RBAC settings that shut it down (defensive).(senior)
  56. A Job you run for a batch task keeps creating new pods after failures and never stops. How do Jobs handle retries, and which fields control completion and failure?(mid)
  57. Explain PriorityClass and preemption. What surprising outage can misusing pod priority cause?(senior)
  58. After deploying a default-deny NetworkPolicy in a namespace, pods can no longer resolve DNS and all outbound calls fail. What did you forget?(mid)