Chapter 70: DevOps Interview Questions by Topic and Company
70.4 Kubernetes Interview Questions
Kubernetes madhe CrashLoopBackOff aani Pending he prashna nakki yetat. Steps lakshat theva.
What you will learn in this lesson
- 55 real Kubernetes questions with short answers
- Which companies asked them, from public interview stories
- Fresher, experienced and senior levels
- A simple way to answer: why, what, how
Why: the problem
Kubernetes runs most microservices today. Interviewers ask what each part does and how you fix pods that fail.
What: how to read this lesson
Each question has a short answer in three parts.
- Why: the reason the thing exists.
- What: the plain meaning.
- How: how you use it, often with a small command.
"Asked at" names a company only when a public interview story says the question was asked there. No tag means it is a common question that many companies ask.
Companies with the most questions in this lesson: Wipro (12), Deloitte (11), TCS (9), Tech Mahindra (7), Accenture (6), HCLTech (4).
How: answer any question in 4 steps
- Start with the reason. One sentence.
- Give the plain meaning. No big words.
- Show one command or file.
- Add one example from your work. Then stop and wait.
Fresher questions
Q1. What is a pod?
Why: The smallest unit in Kubernetes.
What: A pod is one or more containers that share network and storage.
How: Usually one app container per pod, plus optional sidecars.
kubectl run web --image=nginx
Q2. What is kubectl describe vs kubectl logs?
Why: Two main debug commands.
What: describe shows the object's details and events. logs shows container output.
How: Use describe first for scheduling and image errors, logs for app errors.
Q3. What are the components of the Kubernetes control plane?
Why: You must know who does what.
What: API server (front door), etcd (stores state), scheduler (places pods), controller manager (keeps desired state), cloud controller manager.
How: Worker nodes run kubelet, kube-proxy and a container runtime.
kubectl get pods -n kube-system
Q4. What is etcd?
Why: Losing etcd means losing the cluster state.
What: etcd is a distributed key-value store that holds all cluster data.
How: Back it up often (etcdctl snapshot save) and run 3 or 5 members for HA.
ETCDCTL_API=3 etcdctl snapshot save /backup/etcd.db
Q5. What do kubelet, kube-apiserver and kube-proxy do?
Why: Three core parts, often asked together.
What: kube-apiserver serves the Kubernetes API. kubelet runs on each node and starts pods. kube-proxy sets up Service networking rules on each node.
How: If kubelet is down, the node becomes NotReady.
systemctl status kubelet
Q6. What is the difference between a Deployment and a StatefulSet?
Why: Databases need stable identity.
What: Deployment: identical, replaceable pods with random names. StatefulSet: stable names (db-0, db-1), stable storage per pod, ordered start.
How: Use Deployment for web apps, StatefulSet for databases and queues.
Q7. What is a DaemonSet?
Why: Some agents must run on every node.
What: A DaemonSet runs one pod on each node (or selected nodes).
How: Used for log agents, monitoring agents and CNI.
kubectl get ds -A
Q8. What is a Kubernetes Service and what are its types?
Why: Pods change IPs; Services give a fixed address.
What: A Service gives a stable IP/DNS name and load-balances to pods. Types: ClusterIP, NodePort, LoadBalancer, ExternalName.
How: Use ClusterIP inside, LoadBalancer or Ingress for outside traffic.
kubectl expose deploy web --port 80 --target-port 3000
Q9. What is the difference between a ConfigMap and a Secret?
Why: Config must be outside the image.
What: ConfigMap stores plain settings. Secret stores sensitive data (base64-encoded, can be encrypted at rest).
How: Mount both as env vars or files; enable encryption and RBAC for Secrets.
kubectl create configmap app-cfg --from-literal=LOG_LEVEL=info
kubectl create secret generic db --from-literal=PASSWORD=change-me
Q10. What are liveness, readiness and startup probes?
Why: Kubernetes needs to know if your app is OK.
What: Liveness: restart if stuck. Readiness: send traffic only when ready. Startup: give slow apps time before other probes.
How: Use a light /health endpoint and sensible delays.
readinessProbe:
httpGet: {path: /ready, port: 8080}
periodSeconds: 5
Q11. What is an Ingress and an Ingress controller?
Why: Many services, one entry point.
What: Ingress is a set of HTTP routing rules. The controller (NGINX, ALB) is the software that applies them.
How: Without a controller, Ingress objects do nothing.
kind: Ingress
spec:
rules:
- host: app.example.com
Q12. What is the difference between a ReplicaSet and a ReplicationController?
Why: Shows knowledge of K8s history.
What: Both keep N pods running. ReplicaSet supports set-based selectors; ReplicationController is the older version.
How: Today you use Deployments, which manage ReplicaSets.
Q13. What is a Helm chart and its structure?
Why: Helm packages Kubernetes apps.
What: A chart is a folder: Chart.yaml (info), values.yaml (defaults), templates/ (YAML with placeholders).
How: Install with helm install and override values per environment.
helm create web
helm upgrade --install web ./web -f values-prod.yaml
Q14. Write a Deployment and Service YAML.
Why: A common live task.
What: Deployment runs pods; Service gives them a stable address.
How: Match the Service selector to pod labels.
apiVersion: apps/v1
kind: Deployment
metadata: {name: web}
spec:
replicas: 2
selector: {matchLabels: {app: web}}
template:
metadata: {labels: {app: web}}
spec:
containers:
- name: web
image: nginx:1.27
---
apiVersion: v1
kind: Service
metadata: {name: web}
spec:
selector: {app: web}
ports: [{port: 80}]
Q15. What is a Namespace?
Why: It divides one cluster for many teams.
What: A namespace is a virtual group of resources with its own names, quotas and RBAC.
How: Use one per team or environment.
kubectl create ns team-a
kubectl get pods -n team-a
Q16. What is the difference between requests and limits?
Why: Wrong values cause eviction or throttling.
What: Requests are what the scheduler reserves. Limits are the maximum allowed.
How: Going over the memory limit = OOMKilled; over CPU limit = throttled.
resources:
requests: {cpu: 100m, memory: 128Mi}
limits: {memory: 256Mi}
Q17. What is a PersistentVolume and a PersistentVolumeClaim?
Why: Pods need storage that survives them.
What: PV is the actual storage. PVC is a pod's request for storage. StorageClass creates PVs automatically.
How: Pods mount the PVC by name.
kind: PersistentVolumeClaim
spec:
accessModes: [ReadWriteOnce]
resources: {requests: {storage: 10Gi}}
Q18. What is kubectl apply vs kubectl create?
Why: Declarative vs imperative.
What: create makes a new object and fails if it exists. apply creates or updates to match the file.
How: Use apply with files kept in Git.
kubectl apply -f deploy.yaml
Q19. What is a ResourceQuota and LimitRange?
Why: One team should not use the whole cluster.
What: ResourceQuota caps total resources in a namespace. LimitRange sets default and max per pod.
How: Use both in shared clusters.
Experienced questions (2-5 years)
Q20. What is the difference between a rolling update and recreate strategy?
Why: Deployment strategy basics.
What: Rolling replaces pods gradually. Recreate kills all old pods first (downtime).
How: Use Recreate only when two versions cannot run together.
Q21. What are taints and tolerations?
Why: They control which pods can use which nodes.
What: A taint on a node repels pods. A toleration on a pod lets it ignore that taint.
How: Use them for GPU nodes or dedicated nodes.
kubectl taint nodes node1 gpu=true:NoSchedule
tolerations:
- key: gpu
operator: Equal
value: "true"
effect: NoSchedule
Q22. A pod is in CrashLoopBackOff. How do you fix it?
Why: The most common K8s question.
What: The container starts and keeps exiting; K8s waits longer between restarts.
How: 1) kubectl describe pod (events, exit code). 2) kubectl logs --previous. 3) Check command, env, ConfigMap/Secret, probes, memory (OOMKilled). 4) Fix and redeploy.
kubectl describe pod web-7d9
kubectl logs web-7d9 --previous
Q23. A pod is in ImagePullBackOff. What do you check?
Why: Image pull errors block every deploy.
What: Kubernetes cannot download the image.
How: Check image name and tag, registry login (imagePullSecrets), network to the registry, and rate limits.
kubectl describe pod web-7d9 | grep -A5 Events
Q24. A pod is stuck in Pending. Why?
Why: Pending means it is not scheduled yet.
What: The scheduler cannot find a node.
How: Read describe events: not enough CPU/memory, taints, node selectors/affinity, or an unbound PVC. Add nodes or fix requests.
kubectl describe pod web-7d9
kubectl get pvc
Q25. What is the difference between HPA and VPA?
Why: Scaling is a core SRE topic.
What: HPA adds or removes pods. VPA changes CPU/memory requests of pods.
How: Use HPA for stateless web apps; avoid using both on the same metric.
kubectl autoscale deploy web --cpu-percent=60 --min=2 --max=10
Q26. What is the difference between HPA and Cluster Autoscaler or Karpenter?
Why: Pods need nodes to run on.
What: HPA scales pods. Cluster Autoscaler/Karpenter add or remove nodes when pods cannot fit.
How: They work together: HPA creates pods, and the node scaler gives them room.
Q27. What are network policies?
Why: By default every pod can talk to every pod.
What: A NetworkPolicy is a firewall for pods, using labels.
How: Start with deny-all, then allow only needed traffic. Needs a CNI that supports it (Calico, Cilium).
kind: NetworkPolicy
spec:
podSelector: {}
policyTypes: [Ingress]
Q28. How do you set up RBAC for a namespace?
Why: Teams need limited access.
What: RBAC uses Role (what) + RoleBinding (who) in a namespace.
How: Give each team edit rights only in its namespace.
kubectl create role dev --verb=get,list,create --resource=pods -n team-a
kubectl create rolebinding dev-b --role=dev --group=team-a -n team-a
Q29. What is the difference between Ingress and a service mesh like Istio?
Why: Both route traffic but at different places.
What: Ingress handles north-south traffic (outside → cluster). A mesh handles east-west traffic between services with mTLS, retries and tracing.
How: Use a mesh only when you need its features; it adds complexity.
Q30. What are init containers and sidecar containers?
Why: Pods can have helper containers.
What: Init containers run once before the app starts. Sidecars run next to the app the whole time (logs, proxy).
How: Use init to wait for a DB or run migrations.
initContainers:
- name: wait-db
image: busybox
command: ["sh","-c","until nc -z db 5432; do sleep 2; done"]
Q31. How do you roll back a Deployment?
Why: Bad releases must be undone fast.
What: Kubernetes keeps old ReplicaSets as revisions.
How: Use rollout history and rollout undo.
kubectl rollout history deploy/web
kubectl rollout undo deploy/web --to-revision=3
Q32. What is a PodDisruptionBudget?
Why: Upgrades must not take down all pods.
What: A PDB sets how many pods must stay up during voluntary disruptions like node drains.
How: Set minAvailable or maxUnavailable for each important app.
kind: PodDisruptionBudget
spec:
minAvailable: 2
selector: {matchLabels: {app: web}}
Q33. What do you check before upgrading a Kubernetes cluster?
Why: Upgrades can break apps.
What: Plan control plane first, then nodes, one minor version at a time.
How: Check deprecated APIs, add-on versions, PDBs, backups of etcd, and test in staging.
kubectl get --raw /metrics | grep apiserver_requested_deprecated_apis
Q34. How do you debug DNS inside Kubernetes?
Why: Service names failing breaks microservices.
What: Pods use CoreDNS through the kube-dns Service.
How: Run a test pod, nslookup the service, check CoreDNS pods and logs.
kubectl run t --rm -it --image=busybox -- nslookup web.default.svc.cluster.local
kubectl logs -n kube-system -l k8s-app=kube-dns
Q35. How does a pod get its IP address?
Why: Network design questions start here.
What: The CNI plugin gives each pod an IP from the pod range. On EKS, the VPC CNI gives real VPC IPs.
How: If the subnet runs out of IPs, new pods stay pending; use bigger subnets or prefix delegation.
Q36. How do you roll back a Helm release?
Why: Helm keeps release history.
What: Each upgrade is a revision.
How: Use helm history and helm rollback.
helm history web
helm rollback web 4
Q37. How do you do blue-green or canary deployments with Helm?
Why: Safe releases are expected.
What: Blue-green: two releases, switch the Service selector. Canary: small share of traffic to the new version.
How: Use two releases with a label switch, or tools like Argo Rollouts or Flagger for canary.
Q38. How do you exec into a pod?
Why: You need a shell to debug.
What: kubectl exec runs a command inside a container.
How: Use -it and choose the container with -c if there are many.
kubectl exec -it web-7d9 -c app -- sh
Q39. Only 7 of 10 pods are healthy. How do you investigate?
Why: Partial failures are tricky.
What: Something is different about the failing pods: node, config or timing.
How: 1) kubectl get pods -o wide (same node?). 2) describe and logs of a bad pod. 3) Check node health. 4) Compare with a good pod.
kubectl get pods -o wide -l app=web
Q40. Rollout succeeded but the old image is still running. Why?
Why: Tag confusion is common.
What: The image tag did not change (e.g. latest), or imagePullPolicy uses the cached image.
How: Use unique tags (git SHA) or digests; check kubectl describe for the actual image.
kubectl get deploy web -o jsonpath='{.spec.template.spec.containers[0].image}'
Q41. How do you securely manage secrets in EKS?
Why: Plain Secrets are only base64.
What: Use AWS Secrets Manager with External Secrets Operator or the Secrets Store CSI driver; enable KMS encryption for etcd.
How: Give pods access through IRSA or Pod Identity.
Q42. How does authentication work in EKS?
Why: Access to the cluster must be controlled.
What: EKS uses IAM to prove who you are, then Kubernetes RBAC for what you can do.
How: Map IAM roles with access entries (or aws-auth ConfigMap).
aws eks update-kubeconfig --name prod --region ap-south-1
Q43. How would you set up an EKS cluster?
Why: A common senior question.
What: EKS gives a managed control plane; you add node groups or Fargate.
How: Use Terraform or eksctl: VPC with private subnets, cluster, managed node groups, add-ons (VPC CNI, CoreDNS), IRSA, ingress controller.
eksctl create cluster --name dev --region ap-south-1 --nodes 2
Q44. What is the difference between EKS and ECS?
Why: AWS gives two container options.
What: ECS is AWS's own simpler orchestrator. EKS is managed Kubernetes.
How: ECS for simple AWS-only setups; EKS for Kubernetes skills, tools and portability.
Q45. How do you monitor microservices in Kubernetes?
Why: Many small services are hard to watch.
What: Metrics, logs and traces together.
How: Prometheus + Grafana for metrics, Loki/ELK for logs, OpenTelemetry for traces, alerts with Alertmanager.
kubectl top pods -A
Q46. A node is degraded or lost permanently. What happens and what do you do?
Why: Nodes fail in real life.
What: After a timeout, pods on that node are evicted and rescheduled elsewhere (if controllers own them).
How: Cordon and drain if reachable, remove the node, check StatefulSet volumes reattach, add capacity.
kubectl cordon node3
kubectl drain node3 --ignore-daemonsets --delete-emptydir-data
Q47. HPA is scaling too slowly. How do you fix it?
Why: Traffic spikes need fast scaling.
What: HPA needs metrics, has a sync period and stabilisation windows, and new pods need time to start.
How: Lower the target, tune behavior.scaleUp, speed app start, keep spare nodes, or scale on request rate.
behavior:
scaleUp:
stabilizationWindowSeconds: 0
Q48. Pods in one namespace fail readiness checks. How do you investigate?
Why: Readiness failures remove pods from traffic.
What: The app is not ready or the probe is wrong.
How: Check describe events, probe path/port/timeouts, dependencies (DB), network policies in that namespace, and ResourceQuota limits.
kubectl get events -n team-a --sort-by=.lastTimestamp
Q49. How do wrong probes cause downtime?
Why: A bad probe can kill healthy apps.
What: A strict liveness probe restarts slow-but-healthy pods; a missing readiness probe sends traffic too early.
How: Set startupProbe for slow starts, keep liveness light, and test probes under load.
Q50. What is securityContext in a pod?
Why: Containers should not run as root.
What: securityContext sets user, group, privileges and file system options.
How: Use runAsNonRoot, readOnlyRootFilesystem, and drop capabilities.
securityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
Q51. What is a Job and a CronJob?
Why: Not every workload runs forever.
What: A Job runs pods until a task completes. A CronJob runs Jobs on a schedule.
How: Use for backups, reports and migrations.
kubectl create cronjob backup --image=busybox --schedule="0 2 * * *" -- echo backup
Q52. What is node affinity vs pod anti-affinity?
Why: Placement affects availability.
What: Node affinity: run on nodes with certain labels. Pod anti-affinity: keep replicas apart.
How: Use anti-affinity so replicas are on different nodes or zones.
Q53. A Service has no endpoints. Why?
Why: Traffic fails even though pods run.
What: The selector does not match pod labels, or pods are not ready.
How: Compare labels; check readiness.
kubectl get endpoints web
kubectl get pods --show-labels
Q54. What is GitOps and how does Argo CD work?
Why: Many companies deploy with Git as the source of truth.
What: GitOps: the desired state is in Git; a controller syncs the cluster to it. Argo CD watches a repo and applies changes.
How: CI builds the image and updates the manifest; Argo CD deploys and shows drift.
argocd app sync web
Senior questions
Q55. How do you make a Kubernetes cluster highly available?
Why: One master is a single point of failure.
What: Run 3+ control plane nodes and 3/5 etcd members across zones, with a load balancer in front of the API.
How: Spread worker nodes and app replicas across zones with topology spread rules and PDBs.
Practice tasks
Easy What is a pod?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What are the components of the Kubernetes control plane?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What is etcd?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What do kubelet, kube-apiserver and kube-proxy do?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What is a DaemonSet?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What is a Kubernetes Service and what are its types?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What is the difference between a ConfigMap and a Secret?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium What are taints and tolerations?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Homework: try at home
- Pick five questions you find hard.
- Write your own answer for each in three lines.
- Record yourself answering them. Listen once and improve.
Recap
In short
- Answer in order: why, what, how, then one example.
- Show one small command when you can.
- "Asked at" comes from public interview stories.
- Practise aloud; do not memorise word for word.
FAQ
Do I need to learn all 55 questions?
No. Start with the fresher ones. Then add the experienced ones for your level.
Should I memorise these answers?
No. Understand the why, then say it in your own words. Interviewers notice memorised lines.
What if I do not know an answer?
Say so honestly. Then explain how you would find out, step by step.
Are these questions only for one company?
No. "Asked at" shows where people said it was asked. Other companies ask the same things.
How long should an answer be?
About 30 to 60 seconds. Give a reason, a plain meaning and one example.
Is a lab really needed?
Yes. Running the command once makes your answer real and confident.
Interview questions
Practise these five first. Many companies asked them.
- What is the difference between a Deployment and a StatefulSet? - Deployment: identical, replaceable pods with random names.
- What is a Kubernetes Service and what are its types? - A Service gives a stable IP/DNS name and load-balances to pods.
- What are liveness, readiness and startup probes? - Liveness: restart if stuck.
- A pod is in CrashLoopBackOff. How do you fix it? - The container starts and keeps exiting; K8s waits longer between restarts.
- A pod is in ImagePullBackOff. What do you check? - Kubernetes cannot download the image.
Quick quiz
Q1. What is a pod?
A pod is one or more containers that share network and storage.
Q2. What is a Kubernetes Service and what are its types?
A Service gives a stable IP/DNS name and load-balances to pods.
Q3. What is the difference between HPA and Cluster Autoscaler or Karpenter?
HPA scales pods.
Q4. What is a PodDisruptionBudget?
A PDB sets how many pods must stay up during voluntary disruptions like node drains.
Q5. Write a Deployment and Service YAML.
Deployment runs pods; Service gives them a stable address.
Samajla ka?
Revision card
Interview card
Comparison card