Pods & Multi Container Patterns
Can you explain the use cases for Init Containers vs Sidecar Containers?
Explain the different phases of a Pod's lifecycle (Pending, Running, Succeeded, Failed, Unknown). What triggers a transition to 'Failed'?
How do Init Containers differ from regular containers in a Pod, and what are the rules regarding their execution order and resource limits?
If a pod is in a CrashLoopBackOff state, what are the first three things you would check to diagnose the issue?
What are Ephemeral Containers and when would a developer use them?
What are native sidecar containers, and how do they differ from the traditional multi-container Pod pattern?
What is a sidecar container, and what are common use cases for it in a microservices environment?
What is the difference between initContainers and regular containers, and when would you use an initContainer?
Services Networking & Dns
Compare and contrast ClusterIP, NodePort, and LoadBalancer, and when would you use a Headless Service?
Explain the difference between Ingress and the newer Gateway API, and why the Gateway API was introduced.
Explain the Kubernetes networking model and why every Pod must be able to communicate with every other Pod without NAT.
How does a Kubernetes Service find its backend Pods? Explain the role of labels, selectors, and the Endpoints/EndpointSlice object.
How does CoreDNS facilitate service discovery within a cluster?
What are EndpointSlices, and why were they introduced to replace the older Endpoints object?
What is a headless Service and why would a stateful application like a database need one?
What is a NetworkPolicy and how does it differ from a standard firewall?
What is a NetworkPolicy, and how does it provide zero-trust security within a cluster?
What is an ExternalName Service, and when would you use it?
What is Service session affinity, and how does it change traffic routing to backend Pods?
What is the role of a CNI plugin, and why does Kubernetes offload networking logic to external providers like Calico or Flannel?
What is the role of kube-proxy, and what is the difference between iptables and IPVS modes in terms of performance?
Configuration Management & Extensibility
Compare Helm and Kustomize as configuration management tools. When would you prefer a template-based approach over an overlay-based approach?
Explain the operator pattern and how an operator differs from a standard controller.
How does Helm help with configuration drift, and what is the difference between a Helm chart and a release?
What is a Custom Resource Definition (CRD) and how does it extend the Kubernetes API?
What is Helm and how does it help manage the lifecycle of complex Kubernetes applications?
What is the API aggregation layer, and how does it differ from using CustomResourceDefinitions?
Scheduling Affinity & Resource Management
Explain how Taints and Tolerations work together to ensure pods are (or aren't) scheduled on specific nodes.
Explain taints and tolerations. How do they differ from node affinity?
Explain the concept of PriorityClass and how Pod preemption works.
How does Kubernetes determine the Quality of Service (QoS) class for a Pod (Guaranteed, Burstable, BestEffort), and how does this affect eviction priority?
How does the Horizontal Pod Autoscaler decide when to scale, what metrics does it look at, and where does it get them from?
What are pod anti-affinity rules and why are they important for high availability?
What are ResourceQuotas and LimitRanges, and how do they differ in constraining resource usage in a namespace?
What are Topology Spread Constraints and why are they used for High Availability?
What happens when a node runs out of memory (OOM) and how does Kubernetes decide which Pod to kill?
What is the Cluster Autoscaler, and how does it decide to add or remove nodes?
What is the difference between NodeAffinity and PodAntiAffinity?
What is the difference between required and preferred pod affinity/anti-affinity, and how strictly does the scheduler enforce each?
What is the difference between resource 'requests' and 'limits'? What happens to a Pod if it exceeds its CPU limit versus its Memory limit?
What is the role of the metrics-server, and how does it feed autoscaling decisions?
What is the VerticalPodAutoscaler, and how does it differ from the HorizontalPodAutoscaler?
When would you use Karpenter over the standard Cluster Autoscaler, and what are the conceptual differences in how they provision nodes?
Security & Access Control
Explain Kubernetes RBAC and the difference between a RoleBinding and a ClusterRoleBinding.
Explain the difference between a Role and a ClusterRole in RBAC.
What are admission controllers (mutating vs validating) and how do they help enforce organizational policy?
What are the Pod Security Standards (Privileged, Baseline, Restricted), and how do they map to enforcement levels?
What is a SecurityContext and what kind of restrictions can it enforce on a container?
What is a ServiceAccount and when should a developer create a custom one for their application?
What is the Pod Security Admission (PSA) and how does it replace Pod Security Policies?
Control Plane & Architecture
Explain the Controller Pattern or Reconciliation Loop and how Kubernetes moves from the current state to the desired state.
Explain the difference between level-triggered and edge-triggered notifications in the context of the K8s API.
Explain the Kubernetes control plane components and their specific responsibilities.
How does Kubernetes ensure high availability for its own control plane components, and what happens if the API server goes down?
How does the Control Plane communicate with Worker Nodes?
How does the kube-apiserver handle a request from kubectl? Walk through the authentication, authorization, and admission control stages.
How does the scheduler decide which node a Pod should land on? Explain the filtering and scoring phases.
How is leader election used among control-plane controllers to ensure only one active instance in an HA setup?
How would you back up and restore etcd, and why is this critical for disaster recovery?
What happens internally when you run kubectl apply -f? Trace the request from the CLI through the API server to the etcd store.
What is the difference between the kube-scheduler and the kubelet, and who is responsible for actually starting the container?
What is the role of etcd in a Kubernetes cluster, and why is it considered the single source of truth?
What is the role of the cloud-controller-manager, and why was cloud-specific logic separated out of the core controller manager?
What is the specific responsibility of the kube-scheduler versus the kube-controller-manager?
Lifecycle Termination & Node Maintenance
Explain the graceful shutdown process of a Pod, including the role of terminationGracePeriodSeconds and the preStop hook.
How does Kubernetes handle a node failure? Describe the process from the moment a node goes 'NotReady' to the rescheduling of its pods.
What are owner references, and how do they drive garbage collection of dependent objects?
What do cordon and drain do, and how are they used during node maintenance?
What is a finalizer in Kubernetes, and why might a Pod or Namespace get stuck in a Terminating state?
What is a Pod Disruption Budget, and why is it important for maintaining high availability during cluster maintenance or node drains?
What is the difference between foreground, background, and orphan cascading deletion?
Storage & Volumes
Explain the relationship between a PersistentVolume and a PersistentVolumeClaim, and how does a StorageClass enable dynamic provisioning?
How does a StatefulSet perform ordered rollouts, and what role do volumeClaimTemplates play in giving each replica its own storage?
What are the different access modes for a volume (RWO, RWX, ROX) and why do they matter?
What are the security risks of hostPath volumes, and why should they generally be avoided?
What is 'dynamic provisioning' in Kubernetes, and how do StorageClasses facilitate it?
What is a projected volume, and how does it combine multiple sources into a single mount?
What is an emptyDir volume, and what happens to its data when a container crashes versus when a Pod is deleted?
What is ephemeral storage in Kubernetes, and how are requests and limits applied to it?
What is the Container Storage Interface (CSI), and why did Kubernetes move away from in-tree volume plugins?
What is the difference between an emptyDir volume and a hostPath volume?
What is the difference between the Retain, Recycle, and Delete reclaim policies for a PersistentVolume?
What is the Downward API, and what kind of information can a Pod obtain about itself through it?
What is the volume binding mode, and why is WaitForFirstConsumer important for topology-aware provisioning?
Objects Labels & Configuration
How can you update a ConfigMap without restarting the Pod?
How do label selectors work, and what is the difference between equality-based and set-based selectors?
What is a kubeconfig, and how do contexts let you work with multiple clusters?
What is a Kubernetes Namespace, and what kinds of resources are namespaced versus cluster-scoped?
What is the anatomy of a Kubernetes object manifest: what do apiVersion, kind, metadata, spec, and status each represent?
What is the difference between a ConfigMap and a Secret, and are Secrets actually secure by default?
What is the difference between labels and annotations, and when would you use each?
What is the difference between mounting a ConfigMap as an environment variable vs. a volume, and what happens to the app when the ConfigMap is updated?
What is the difference between the spec and the status of an object, and who writes to each?
Why are Kubernetes Secrets not considered secure by default, and how can you improve secret security at the cluster level?
Health Probes & Deployment Strategies
How do you roll back a Deployment, and how does revision history make that possible?
How does a RollingUpdate strategy work, and how do maxSurge and maxUnavailable control the rollout?
How would you implement a canary or blue-green deployment using native Kubernetes primitives?
What are the tradeoffs of a RollingUpdate vs. a Recreate deployment strategy?
What does it mean to pause a rollout, and why might you do that mid-deployment?
What is the difference between liveness, readiness, and startup probes, and what happens if each one fails?
Why would you use a Startup probe in addition to a Liveness probe for a legacy application with a long boot time?
Workloads & Controllers
How does a DaemonSet differ from a ReplicaSet, and what are typical use cases for it?
In what scenario would you use a DaemonSet instead of a Deployment? Give an example related to infrastructure monitoring or logging.
What is a restartPolicy, and how do Always, OnFailure, and Never affect Pod behavior across workload types?
What is the difference between a Deployment and a StatefulSet, and when would you choose one over the other?
What is the difference between a Job and a CronJob, and how does Kubernetes handle Job failures?
What is the relationship between a Deployment and a ReplicaSet, and how does the Deployment use ReplicaSets to manage revisions?
Node Components & Container Runtime
How does image pull policy work, and what are the implications of Always vs IfNotPresent?
What are container runtimes like containerd and CRI-O, and how do they plug into a node?
What are static Pods, and how do they differ from Pods managed by the API server?
What is an OCI image, and how does Kubernetes rely on the OCI standard at a conceptual level?
What is the Container Runtime Interface (CRI), and why did Kubernetes deprecate and remove dockershim?
What is the purpose of the 'pause' container in a Pod, and how does it facilitate networking between multiple containers in that same Pod?
What is the role of the kubelet and how does it interact with the Container Runtime Interface (CRI)?
Why do multiple containers in the same Pod share a network namespace and can communicate over localhost?
Kubernetes Fundamentals
What are the conceptual differences between containers and virtual machines, and why does Kubernetes orchestrate containers?
What does 'self-healing' mean in Kubernetes, and which mechanisms provide it?
What is the difference between a Pod and a Container?
What is the difference between imperative and declarative kubectl usage, and why is declarative preferred?
When would you NOT use Kubernetes: what are the tradeoffs and situations where it's overkill?
Why does Kubernetes use Pods as the smallest deployable unit instead of individual containers?