Kubernetes Fundamentals
Why does Kubernetes use Pods as the smallest deployable unit instead of individual containers?
What is the difference between a Pod and a Container?
What are the conceptual differences between containers and virtual machines, and why does Kubernetes orchestrate containers?
What does 'self-healing' mean in Kubernetes, and which mechanisms provide it?
What is the difference between imperative and declarative kubectl usage, and why is declarative preferred?
When would you NOT use Kubernetes: what are the tradeoffs and situations where it's overkill?
Control Plane & Architecture
What is the role of etcd in a Kubernetes cluster, and why is it considered the single source of truth?
What is the specific responsibility of the kube-scheduler versus the kube-controller-manager?
Explain the Controller Pattern or Reconciliation Loop and how Kubernetes moves from the current state to the desired state.
What happens internally when you run kubectl apply -f? Trace the request from the CLI through the API server to the etcd store.
Explain the Kubernetes control plane components and their specific responsibilities.
What is the difference between the kube-scheduler and the kubelet, and who is responsible for actually starting the container?
How does the Control Plane communicate with Worker Nodes?
Explain the difference between level-triggered and edge-triggered notifications in the context of the K8s API.
How does Kubernetes ensure high availability for its own control plane components, and what happens if the API server goes down?
How does the scheduler decide which node a Pod should land on? Explain the filtering and scoring phases.
How does the kube-apiserver handle a request from kubectl? Walk through the authentication, authorization, and admission control stages.
What is the role of the cloud-controller-manager, and why was cloud-specific logic separated out of the core controller manager?
How is leader election used among control-plane controllers to ensure only one active instance in an HA setup?
How would you back up and restore etcd, and why is this critical for disaster recovery?
Node Components & Container Runtime
How does image pull policy work, and what are the implications of Always vs IfNotPresent?
What is the Container Runtime Interface (CRI), and why did Kubernetes deprecate and remove dockershim?
What are container runtimes like containerd and CRI-O, and how do they plug into a node?
Why do multiple containers in the same Pod share a network namespace and can communicate over localhost?
What is an OCI image, and how does Kubernetes rely on the OCI standard at a conceptual level?
What is the purpose of the 'pause' container in a Pod, and how does it facilitate networking between multiple containers in that same Pod?
What is the role of the kubelet and how does it interact with the Container Runtime Interface (CRI)?
What are static Pods, and how do they differ from Pods managed by the API server?
Workloads & Controllers
In what scenario would you use a DaemonSet instead of a Deployment? Give an example related to infrastructure monitoring or logging.
How does a DaemonSet differ from a ReplicaSet, and what are typical use cases for it?
What is a restartPolicy, and how do Always, OnFailure, and Never affect Pod behavior across workload types?
What is the difference between a Deployment and a StatefulSet, and when would you choose one over the other?
What is the difference between a Job and a CronJob, and how does Kubernetes handle Job failures?
What is the relationship between a Deployment and a ReplicaSet, and how does the Deployment use ReplicaSets to manage revisions?
Pods & Multi Container Patterns
Explain the different phases of a Pod's lifecycle (Pending, Running, Succeeded, Failed, Unknown). What triggers a transition to 'Failed'?
What is the difference between initContainers and regular containers, and when would you use an initContainer?
What is a sidecar container, and what are common use cases for it in a microservices environment?
If a pod is in a CrashLoopBackOff state, what are the first three things you would check to diagnose the issue?
What are native sidecar containers, and how do they differ from the traditional multi-container Pod pattern?
How do Init Containers differ from regular containers in a Pod, and what are the rules regarding their execution order and resource limits?
Can you explain the use cases for Init Containers vs Sidecar Containers?
What are Ephemeral Containers and when would a developer use them?
Objects Labels & Configuration
What is a Kubernetes Namespace, and what kinds of resources are namespaced versus cluster-scoped?
What is the anatomy of a Kubernetes object manifest: what do apiVersion, kind, metadata, spec, and status each represent?
What is a kubeconfig, and how do contexts let you work with multiple clusters?
What is the difference between labels and annotations, and when would you use each?
What is the difference between a ConfigMap and a Secret, and are Secrets actually secure by default?
What is the difference between mounting a ConfigMap as an environment variable vs. a volume, and what happens to the app when the ConfigMap is updated?
Why are Kubernetes Secrets not considered secure by default, and how can you improve secret security at the cluster level?
How can you update a ConfigMap without restarting the Pod?
What is the difference between the spec and the status of an object, and who writes to each?
How do label selectors work, and what is the difference between equality-based and set-based selectors?
Services Networking & Dns
Compare and contrast ClusterIP, NodePort, and LoadBalancer, and when would you use a Headless Service?
What is the role of kube-proxy, and what is the difference between iptables and IPVS modes in terms of performance?
How does CoreDNS facilitate service discovery within a cluster?
What is a NetworkPolicy, and how does it provide zero-trust security within a cluster?
What is a headless Service and why would a stateful application like a database need one?
What is the role of a CNI plugin, and why does Kubernetes offload networking logic to external providers like Calico or Flannel?
How does a Kubernetes Service find its backend Pods? Explain the role of labels, selectors, and the Endpoints/EndpointSlice object.
What is a NetworkPolicy and how does it differ from a standard firewall?
What is an ExternalName Service, and when would you use it?
What is Service session affinity, and how does it change traffic routing to backend Pods?
Explain the difference between Ingress and the newer Gateway API, and why the Gateway API was introduced.
Explain the Kubernetes networking model and why every Pod must be able to communicate with every other Pod without NAT.
What are EndpointSlices, and why were they introduced to replace the older Endpoints object?
Scheduling Affinity & Resource Management
What is the difference between resource 'requests' and 'limits'? What happens to a Pod if it exceeds its CPU limit versus its Memory limit?
How does Kubernetes determine the Quality of Service (QoS) class for a Pod (Guaranteed, Burstable, BestEffort), and how does this affect eviction priority?
What are pod anti-affinity rules and why are they important for high availability?
Explain how Taints and Tolerations work together to ensure pods are (or aren't) scheduled on specific nodes.
How does the Horizontal Pod Autoscaler decide when to scale, what metrics does it look at, and where does it get them from?
Explain taints and tolerations. How do they differ from node affinity?
What is the difference between NodeAffinity and PodAntiAffinity?
What is the difference between required and preferred pod affinity/anti-affinity, and how strictly does the scheduler enforce each?
What are ResourceQuotas and LimitRanges, and how do they differ in constraining resource usage in a namespace?
What is the VerticalPodAutoscaler, and how does it differ from the HorizontalPodAutoscaler?
What is the role of the metrics-server, and how does it feed autoscaling decisions?
What is the Cluster Autoscaler, and how does it decide to add or remove nodes?
What happens when a node runs out of memory (OOM) and how does Kubernetes decide which Pod to kill?
Explain the concept of PriorityClass and how Pod preemption works.
What are Topology Spread Constraints and why are they used for High Availability?
When would you use Karpenter over the standard Cluster Autoscaler, and what are the conceptual differences in how they provision nodes?
Storage & Volumes
What is an emptyDir volume, and what happens to its data when a container crashes versus when a Pod is deleted?
What is the difference between an emptyDir volume and a hostPath volume?
Explain the relationship between a PersistentVolume and a PersistentVolumeClaim, and how does a StorageClass enable dynamic provisioning?
What is 'dynamic provisioning' in Kubernetes, and how do StorageClasses facilitate it?
What are the different access modes for a volume (RWO, RWX, ROX) and why do they matter?
What is the difference between the Retain, Recycle, and Delete reclaim policies for a PersistentVolume?
What is the Downward API, and what kind of information can a Pod obtain about itself through it?
What is ephemeral storage in Kubernetes, and how are requests and limits applied to it?
What is the Container Storage Interface (CSI), and why did Kubernetes move away from in-tree volume plugins?
What is a projected volume, and how does it combine multiple sources into a single mount?
What is the volume binding mode, and why is WaitForFirstConsumer important for topology-aware provisioning?
What are the security risks of hostPath volumes, and why should they generally be avoided?
How does a StatefulSet perform ordered rollouts, and what role do volumeClaimTemplates play in giving each replica its own storage?
Security & Access Control
Explain the difference between a Role and a ClusterRole in RBAC.
Explain Kubernetes RBAC and the difference between a RoleBinding and a ClusterRoleBinding.
What is a ServiceAccount and when should a developer create a custom one for their application?
What is a SecurityContext and what kind of restrictions can it enforce on a container?
What are the Pod Security Standards (Privileged, Baseline, Restricted), and how do they map to enforcement levels?
What are admission controllers (mutating vs validating) and how do they help enforce organizational policy?
What is the Pod Security Admission (PSA) and how does it replace Pod Security Policies?
Lifecycle Termination & Node Maintenance
What is a Pod Disruption Budget, and why is it important for maintaining high availability during cluster maintenance or node drains?
What are owner references, and how do they drive garbage collection of dependent objects?
What do cordon and drain do, and how are they used during node maintenance?
Explain the graceful shutdown process of a Pod, including the role of terminationGracePeriodSeconds and the preStop hook.
What is a finalizer in Kubernetes, and why might a Pod or Namespace get stuck in a Terminating state?
How does Kubernetes handle a node failure? Describe the process from the moment a node goes 'NotReady' to the rescheduling of its pods.
What is the difference between foreground, background, and orphan cascading deletion?
Health Probes & Deployment Strategies
What is the difference between liveness, readiness, and startup probes, and what happens if each one fails?
How does a RollingUpdate strategy work, and how do maxSurge and maxUnavailable control the rollout?
What are the tradeoffs of a RollingUpdate vs. a Recreate deployment strategy?
Why would you use a Startup probe in addition to a Liveness probe for a legacy application with a long boot time?
How do you roll back a Deployment, and how does revision history make that possible?
What does it mean to pause a rollout, and why might you do that mid-deployment?
How would you implement a canary or blue-green deployment using native Kubernetes primitives?
Configuration Management & Extensibility
What is a Custom Resource Definition (CRD) and how does it extend the Kubernetes API?
Compare Helm and Kustomize as configuration management tools. When would you prefer a template-based approach over an overlay-based approach?
What is Helm and how does it help manage the lifecycle of complex Kubernetes applications?
How does Helm help with configuration drift, and what is the difference between a Helm chart and a release?
Explain the operator pattern and how an operator differs from a standard controller.
What is the API aggregation layer, and how does it differ from using CustomResourceDefinitions?