Guides

Kubernetes Interview Questions and Answers: 30 Scenario-Based Questions

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 16 October 2026 · Last updated: 17 October 2026

These are the Kubernetes interview questions asked most often for 2 to 10 years of experience, with a focus on scenarios, because that is what panels ask. For every troubleshooting question, the interviewer listens for a method: get the status, describe for events, read logs --previous, fix the spec, and verify. Practise each scenario on a kind, minikube or small EKS cluster, so your answers include the real error text.

kubectl get pods -o wide
kubectl describe pod <pod>          # events, exit code, reason
kubectl logs <pod> --previous       # error of the crashed container
kubectl get events --sort-by=.lastTimestamp | tail
kubectl rollout undo deployment/<name>   # if a release broke it

The method behind every scenario answer

Core concepts

Q1. What is Kubernetes?

A system that runs containers across many machines and keeps them in the state you declare: how many copies, which image, which config, and how they are reached.

Q2. Pod vs Deployment?

A pod is one or more containers that run together on one node. A Deployment manages a ReplicaSet of identical pods and handles rolling updates and rollbacks.

Q3. What does the control plane do?

The API server takes requests, etcd stores state, the scheduler picks nodes for pods, and controllers keep the real state equal to the desired state. On EKS, AWS runs this for you.

Q4. Service types?

ClusterIP (inside the cluster), NodePort (a port on every node), LoadBalancer (a cloud load balancer, such as an AWS NLB), and ExternalName (a DNS alias).

Q5. What is an Ingress?

HTTP routing rules (host and path) handled by an ingress controller, such as the AWS Load Balancer Controller creating an ALB, or ingress-nginx.

Q6. ConfigMap vs Secret?

Both hold config for pods. Secrets are for sensitive values and can be encrypted at rest with KMS on EKS, but they are only base64 encoded by default, so control access with RBAC.

Q7. StatefulSet vs Deployment?

A StatefulSet gives each pod a stable name (mysql-0, mysql-1) and its own volume, for databases and queues. Deployments treat pods as identical and replaceable.

Scenario round: troubleshooting

Q8. A pod is in CrashLoopBackOff. Walk me through it.

kubectl describe pod for the exit code and reason, kubectl logs --previous for the error, then fix the cause in the Deployment: config, command, memory limit or probe. Deleting the pod does not help.

Q9. A pod is stuck in Pending. What do you check?

The FailedScheduling event: Insufficient cpu/memory, untolerated taints, node selector mismatch, or an unbound PVC. Fix requests or labels, or add nodes.

Q10. ImagePullBackOff after a release. Why?

Wrong tag, missing registry login or ECR permission on the node role, or a Docker Hub rate limit. The Failed event in describe pod says which.

Q11. Pods restart every few hours with exit 137. What is it?

Reason OOMKilled means the memory limit was hit. Measure with kubectl top, tune the limit and the runtime (Java MaxRAMPercentage, Node max-old-space-size), and look for leaks.

Q12. The Service returns no response. How do you debug?

Check kubectl get endpoints svc-name. Empty endpoints mean the Service selector does not match the pod labels, or the pods are not Ready. Then check targetPort vs the container port.

Q13. A rollout broke production. What do you do first?

kubectl rollout undo deployment/name to go back, then find the cause in a calm way. Use readiness probes and maxUnavailable so a bad version does not take all traffic.

Q14. A node is NotReady. What do you check?

kubectl describe node for conditions such as MemoryPressure or DiskPressure, the kubelet status on the node, and the cloud console for the instance health check.

Scaling, security and operations

Q15. HPA vs Cluster Autoscaler vs Karpenter?

HPA adds pods based on CPU, memory or custom metrics. Cluster Autoscaler and Karpenter add nodes when pods cannot be scheduled. Karpenter picks instance types per need on AWS.

Q16. Requests vs limits?

Requests are what the scheduler reserves. Limits are the maximum. Going over the CPU limit slows the pod; going over the memory limit gets it OOMKilled.

Q17. Liveness vs readiness vs startup probes?

Readiness decides if the pod gets traffic. Liveness restarts a stuck container. Startup gives slow apps time before liveness begins.

Q18. How do you limit who can do what?

RBAC Roles and RoleBindings per namespace with least privilege. On EKS, map IAM roles with access entries, and avoid giving cluster-admin to people.

Q19. How do pods get AWS permissions?

IRSA or EKS Pod Identity give each service account its own IAM role. Never put access keys in a Secret.

Q20. How do you stop pods from talking to everything?

NetworkPolicies, for example deny all ingress by default and allow only the frontend to reach the API on port 8080. The CNI must support them.

Q21. How do you upgrade a cluster safely?

Read the release notes for removed APIs, upgrade a test cluster first, upgrade the control plane, then node groups one by one, with PodDisruptionBudgets in place.

Q22. What went wrong in Reddit's 2023 outage?

Reddit's post-mortem says a Kubernetes upgrade to 1.24 broke networking because of an old node label used by their Calico route reflectors, leading to about 5 hours of downtime. Lesson: test upgrades on a copy and check old, custom config.

Q23. How do you back up a cluster?

Keep all manifests in Git (GitOps), back up persistent volumes with EBS snapshots or Velero, and on self-managed clusters back up etcd.

Q24. How do you see logs from all pods?

Ship them with Fluent Bit to CloudWatch Logs, OpenSearch or Loki, because pod logs disappear when the pod is deleted.

A live example to tell in the interview

"In our EKS lab, the orders API went into CrashLoopBackOff after a release. kubectl describe showed exit code 1, and kubectl logs --previous showed SPRING_DATASOURCE_URL was missing because the new ConfigMap name had a typo. I rolled back with rollout undo in under a minute, fixed the name, and added a check in CI that every ConfigMap referenced by a Deployment exists."

That answer has a symptom, real commands, a fast recovery, the cause and a lasting fix. Prepare two or three stories like it.

Summary table