Kubernetes Interview Questions: Basic to Advanced

1What problems does a container orchestrator solve that plain Docker on a VM does not?Basicconceptual30 minIn writing
2Walk me through the parts of a Kubernetes cluster: what runs on a control-plane node versus a worker node?Basicconceptual35 minIn writing
3What does it mean that Kubernetes is declarative, and how do controllers turn desired state into actual state?Basicconceptual35 minIn writing
4What are apiVersion, kind, metadata, spec, and status in a manifest, and who writes each one?Basicpractical40 minIn writing
5Which kubectl commands do you actually use day to day, and what is the difference between apply, create, and edit?Basicpractical40 minIn writing
6How do namespaces, labels, and selectors organise a cluster, and where do people misuse them?Basicpractical35 minIn writing
7Your team runs twelve services with Docker Compose on three VMs. Make the case for or against moving to Kubernetes.Scenarioscenario25 minIn writing
8Check your understanding of cluster anatomy, the declarative model, and basic kubectl.Basicconceptual15 minIn writing

9What does the kube-apiserver actually do on every request, from authentication through admission to persistence?Intermediateconceptual45 minIn writing
10Why is etcd the only stateful component of the control plane, and what breaks when it loses quorum?Advancedconceptual45 minIn writing
11How does the scheduler pick a node for a Pod, and what happens in the filtering versus scoring phases?Intermediateconceptual45 minIn writing
12What is a reconciliation loop, and how do the controllers in kube-controller-manager use watches instead of polling?Intermediateconceptual40 minIn writing
13Walk through exactly what happens inside the cluster after a developer runs `kubectl apply -f deployment.yaml`.Advanceddesign5 min
14How do validating and mutating admission webhooks work, and when would you add a CRD plus operator instead?Advanceddesign50 minIn writing
15The API server is responding slowly and etcd disk latency is spiking. Explain what you check and in what order.Scenariodesign25 minIn writing
16Check your understanding of the API server, etcd, the scheduler, and reconciliation loops.Intermediateconceptual15 minIn writing

17What is a Pod in Kubernetes, and why does Kubernetes schedule Pods instead of individual containers?Basicconceptual5 min
18Walk through the phases a Pod passes through from Pending to Succeeded or Failed, and what each phase tells you.Basicconceptual35 minIn writing
19When do you reach for an init container versus a native sidecar container, and how does startup ordering differ?Intermediatepractical40 minIn writing
20How do restartPolicy and the exponential CrashLoopBackOff timer interact for a container that keeps dying?Intermediateconceptual35 minIn writing
21What exactly happens between a delete call and the container being killed, and how do preStop hooks and terminationGracePeriodSeconds fit in?Advancedpractical45 minIn writing
22What are static Pods and ephemeral debug containers, and when is each one the right tool?Advancedpractical40 minIn writing
23A service drops in-flight requests on every deploy. Explain how the Pod termination sequence causes that and how you fix it.Scenarioscenario25 minIn writing
24Check your understanding of Pod phases, init containers, restarts, and graceful termination.Basicconceptual15 minIn writing

25How do a Deployment, a ReplicaSet, and a Pod relate to each other during a rollout?Basicconceptual40 minIn writing
26Compare RollingUpdate and Recreate, and explain what maxSurge and maxUnavailable actually control.Intermediatepractical45 minIn writing
27What guarantees does a StatefulSet give that a Deployment does not, and when do you genuinely need them?Advanceddesign50 minIn writing
28What belongs in a DaemonSet, and how do you roll one out without taking every node offline at once?Intermediatepractical35 minIn writing
29Why are Deployment selectors immutable, and what goes wrong when two controllers select the same Pods?Intermediatetroubleshooting40 minIn writing
30How do ownerReferences, garbage collection, and cascading deletes decide what disappears when you delete a controller?Advancedconceptual40 minIn writing
31Pick the right controller for a payments API, a Kafka cluster, a log agent, and a nightly reconciliation job, and defend each choice.Scenariodesign25 minIn writing
32Check your understanding of Deployments, StatefulSets, DaemonSets, and ownership.Intermediateconceptual15 minIn writing

33How do completions, parallelism, and backoffLimit shape how a Job runs and when it gives up?Intermediatepractical40 minIn writing
34How does a CronJob decide when to run, and what do concurrencyPolicy and startingDeadlineSeconds protect you from?Intermediatepractical40 minIn writing
35Kubernetes gives at-least-once execution for Jobs. How do you design a batch task that survives being run twice?Advanceddesign45 minIn writing
36What does an Indexed Job give you, and how would you use it to shard a large data-processing run?Advancedpractical40 minIn writing
37How do ttlSecondsAfterFinished and history limits stop finished Jobs from filling up the cluster?Intermediatepractical35 minIn writing
38A nightly Job fails intermittently and never alerts anyone. How do you make batch failures visible and retried safely?Advancedtroubleshooting45 minIn writing
39Design a nightly ETL pipeline on Kubernetes that must never double-charge customers if it retries.Scenariodesign25 minIn writing
40Check your understanding of Jobs, CronJobs, retries, and batch cleanup.Intermediateconceptual15 minIn writing

41Compare ClusterIP, NodePort, LoadBalancer, and ExternalName, and say when each is the right choice.Basicconceptual40 minIn writing
42How does a Service find its backing Pods, and what problem do EndpointSlices solve over the old Endpoints object?Intermediateconceptual40 minIn writing
43How does kube-proxy actually route traffic in iptables versus IPVS mode, and where does eBPF-based routing fit?Advancedconceptual45 minIn writing
44How does CoreDNS resolve a Service name, and what do ndots and the search path do to your latency?Intermediatepractical40 minIn writing
45What is a headless Service, and why do StatefulSets and client-side load balancing depend on it?Advancedpractical40 minIn writing
46What does the CNI plugin guarantee about Pod-to-Pod networking, and how do overlay and native routing differ?Advancedconceptual45 minIn writing
47A Pod can reach a Service by IP but not by name, and only from some nodes. Walk me through your diagnosis.Scenarioscenario25 minIn writing
48Check your understanding of Service types, endpoints, kube-proxy, and cluster DNS.Intermediateconceptual15 minIn writing

49Why would you put an Ingress in front of Services instead of giving every Service its own LoadBalancer?Intermediateconceptual40 minIn writing
50What does an Ingress controller do with your Ingress objects, and what is the controller versus the resource?Intermediateconceptual40 minIn writing
51How do you terminate TLS at the Ingress, and how does cert-manager keep certificates from expiring on a Saturday?Intermediatepractical45 minIn writing
52What does the Gateway API fix about Ingress, and how do Gateway, HTTPRoute, and role separation work?Advanceddesign50 minIn writing
53How would you run a canary or blue-green release at the edge without a service mesh?Advanceddesign50 minIn writing
54When does a service mesh earn its operational cost, and what do you get that plain Services do not give you?Advanceddesign45 minIn writing
55Design north-south traffic for a multi-tenant SaaS with custom customer domains and per-tenant TLS.Scenariodesign25 minIn writing
56Check your understanding of Ingress, TLS, the Gateway API, and traffic splitting.Intermediateconceptual15 minIn writing

57What are the ways to get a ConfigMap into a container, and what are the tradeoffs of env vars versus mounted files?Basicpractical35 minIn writing
58Kubernetes Secrets are only base64-encoded in etcd. What does that mean for your threat model?Intermediateconceptual40 minIn writing
59How do you enable encryption at rest for Secrets, and how does a KMS provider change the picture?Advancedpractical45 minIn writing
60How would you source Secrets from Vault or a cloud secret manager instead of committing them to Git?Advanceddesign45 minIn writing
61A mounted ConfigMap changed but the app never noticed. Why, and what are the ways to make config changes take effect?Intermediatetroubleshooting40 minIn writing
62How do you keep dev, staging, and production configuration separate without copying manifests four times?Intermediatedesign40 minIn writing
63Design configuration and secret delivery for a service deployed to three environments and two cloud regions.Scenariodesign25 minIn writing
64Check your understanding of ConfigMaps, Secrets, encryption, and config reloads.Intermediateconceptual15 minIn writing

65What is the difference between emptyDir, hostPath, and a persistent volume, and when is each acceptable?Basicconceptual35 minIn writing
66Explain the PersistentVolume and PersistentVolumeClaim relationship and how dynamic provisioning binds them.Intermediateconceptual40 minIn writing
67What does a StorageClass control, and how do reclaim policy and volumeBindingMode change behaviour?Intermediatepractical40 minIn writing
68What do ReadWriteOnce, ReadOnlyMany, ReadWriteMany, and ReadWriteOncePod actually mean in practice?Intermediateconceptual35 minIn writing
69How do volumeClaimTemplates give each StatefulSet replica its own disk, and what happens to those disks on scale-down?Advancedpractical45 minIn writing
70What does the CSI driver model give you, and how do volume snapshots and expansion work?Advanceddesign45 minIn writing
71Design storage for a PostgreSQL cluster on Kubernetes, including backups, resizing, and node failure.Scenariodesign25 minIn writing
72Check your understanding of volumes, PV/PVC binding, StorageClasses, and access modes.Intermediateconceptual15 minIn writing

73What is the difference between a resource request and a limit, and how does each affect scheduling versus runtime?Intermediateconceptual45 minIn writing
74How are the Guaranteed, Burstable, and BestEffort QoS classes assigned, and what do they change under node pressure?Advancedconceptual40 minIn writing
75How does a CPU limit turn into CFS throttling, and why can a latency-sensitive service get slower when you raise its limit?Advancedtroubleshooting45 minIn writing
76How do node affinity, pod affinity, and pod anti-affinity differ, and when is required versus preferred appropriate?Intermediatepractical45 minIn writing
77How do taints and tolerations work together, and how do they differ from node affinity for reserving nodes?Intermediatepractical40 minIn writing
78How do topology spread constraints, PriorityClasses, and preemption interact when a cluster runs out of room?Advanceddesign50 minIn writing
79Spread a latency-sensitive service across three availability zones on GPU-tainted nodes without letting batch jobs evict it.Scenariodesign25 minIn writing
80Check your understanding of requests, limits, QoS, affinity, and taints.Intermediateconceptual15 minIn writing

81How does the Horizontal Pod Autoscaler compute a replica count, and why does it depend on resource requests?Intermediateconceptual45 minIn writing
82How do you scale on queue depth or requests per second instead of CPU, and what does that require in the cluster?Advanceddesign50 minIn writing
83Your HPA is flapping between 3 and 20 replicas every few minutes. What causes that and how do you damp it?Advancedtroubleshooting45 minIn writing
84What does the Vertical Pod Autoscaler do, and why can it not be used naively alongside an HPA on the same metric?Advanceddesign40 minIn writing
85How does the cluster autoscaler decide to add or remove a node, and what stops it from removing one?Advancedconceptual45 minIn writing
86When does scale-to-zero make sense, and what does the first request after a cold start actually experience?Advanceddesign40 minIn writing
87Design autoscaling for a service with a 20x traffic spike every weekday at 09:00 and a 90-second startup time.Scenariodesign25 minIn writing
88Check your understanding of HPA, VPA, cluster autoscaling, and scaling signals.Advancedconceptual15 minIn writing

89Explain the difference between a liveness probe and a readiness probe, and what happens when each one fails.Intermediatepractical5 min
90What problem does a startup probe solve for a slow-booting app, and how does it interact with the liveness probe?Intermediatepractical40 minIn writing
91Which probe configurations cause cascading restarts under load, and how do you write a probe that does not lie?Advancedtroubleshooting45 minIn writing
92How do kubectl rollout status, history, and undo work, and what does progressDeadlineSeconds do to a stuck deploy?Intermediatepractical40 minIn writing
93How does a PodDisruptionBudget change what happens during a node drain or cluster upgrade?Advancedpractical45 minIn writing
94What has to be true, end to end, for a rolling update to drop zero requests?Advanceddesign50 minIn writing
95A rollout reports success but error rates double for ten minutes afterwards. Explain how you would find and prevent that.Scenarioscenario25 minIn writing
96Check your understanding of probes, rollouts, rollbacks, and disruption budgets.Intermediateconceptual15 minIn writing

97How do Roles, ClusterRoles, and their bindings combine to authorise a request, and why is there no deny rule?Intermediateconceptual45 minIn writing
98How does a Pod authenticate to the API server, and what changed with projected, short-lived service account tokens?Advancedconceptual45 minIn writing
99What do the Privileged, Baseline, and Restricted Pod Security Standards enforce, and how does the admission controller apply them?Advancedpractical45 minIn writing
100Which securityContext settings would you require on every workload, and what does each one prevent?Advancedpractical45 minIn writing
101How do NetworkPolicies work, why is the default allow-all, and how do you move a namespace to default-deny safely?Advanceddesign50 minIn writing
102How do you stop an unreviewed image from running: registries, digests, scanning, signing, and admission policy?Advanceddesign50 minIn writing
103An attacker gets remote code execution in one Pod. Explain what they can reach in a default cluster and what you would have done to contain it.Scenariodesign25 minIn writing
104Check your understanding of RBAC, service accounts, pod security, and network policy.Advancedconceptual15 minIn writing

105Where do container logs actually live, and how does a node-level agent turn them into something searchable?Intermediatedesign45 minIn writing
106What do kubectl describe events and object conditions tell you, and why do events disappear after an hour?Intermediatetroubleshooting40 minIn writing
107What is the difference between metrics-server and Prometheus, and which one does kubectl top depend on?Intermediateconceptual45 minIn writing
108Which cluster and workload signals do you alert on, and which ones only belong on a dashboard?Advanceddesign45 minIn writing
109How do you debug a Pod with no shell in its image using ephemeral containers, port-forward, and exec?Intermediatepractical40 minIn writing
110How do you correlate a slow user request with the Pod, node, and deploy that caused it?Advanceddesign45 minIn writing
111You are paged for elevated 5xx on a service you have never seen. Narrate the first ten minutes of investigation.Scenarioscenario25 minIn writing
112Check your understanding of logs, events, metrics, and debugging tools.Intermediateconceptual15 minIn writing

113When do you reach for Helm and when for Kustomize, and what does each one do badly?Intermediatedesign45 minIn writing
114How do you design a Helm chart other teams can consume without forking it, and what belongs in values.yaml?Advancedpractical50 minIn writing
115What does Helm store about a release, and how do you recover from a failed upgrade or a stuck hook?Intermediatetroubleshooting40 minIn writing
116How do bases, overlays, and patches keep environment differences small and reviewable?Intermediatepractical40 minIn writing
117How does a pull-based GitOps controller like Argo CD or Flux differ from kubectl apply in CI, and what does drift detection buy you?Advanceddesign50 minIn writing
118How do you wire automated canary analysis and rollback into a GitOps pipeline?Advanceddesign45 minIn writing
119Design the path from a merged pull request to running Pods in three environments, including who can promote to production.Scenariodesign25 minIn writing
120Check your understanding of Helm, Kustomize, GitOps, and progressive delivery.Intermediateconceptual15 minIn writing

121Where does Kubernetes spend actually go, and how do you attribute cluster cost back to a team or service?Advanceddesign50 minIn writing
122How far can namespace-based multi-tenancy be pushed with quotas, limits, and policy before you need separate clusters?Advanceddesign50 minIn writing
123A Pod has been Pending for twenty minutes. Walk through every reason that happens and how you tell them apart.Scenariotroubleshooting45 minIn writing
124A container is repeatedly OOMKilled but the dashboards show memory well under the limit. How do you investigate?Scenariotroubleshooting45 minIn writing
125Pods are being evicted from one node while others sit idle. Explain node pressure, eviction thresholds, and your fix.Scenariotroubleshooting50 minIn writing
126How do you upgrade a production cluster and its workloads without an outage or a deprecated-API surprise?Advanceddesign50 minIn writing
127Design and defend a complete production Kubernetes platform for a multi-service SaaS: topology, networking, security, scaling, delivery, observability, and cost.Scenariodesign240 minIn writing
128A Deployment's Pods are stuck in CrashLoopBackOff after a routine rollout. Walk through how you would diagnose and fix it.Scenarioscenario5 min