Intermediate DevOps Interview Questions
322 questions
How would you preview exactly what a helm upgrade will change before actually running it against production?
IntermediateHelm6 min
How would you override a specific value inside a subchart that a parent Helm chart depends on, without modifying the subchart itself?
IntermediateHelm6 min
A `helm upgrade` gets interrupted (CI job killed, network blip) and now every subsequent `helm upgrade` or `helm rollback` fails with "another operation (install/upgrade/rollback) is in progress". How do you recover?
IntermediateHelmKubernetes8 min
A Helm chart's deployed values don't match any single values file you can find — how does Helm's value-override precedence actually work?
IntermediateHelmKubernetes6 min
Why does Helm use Kubernetes Secrets as its storage backend by default instead of an external database, and what does that trade off?
IntermediateHelmKubernetes6 min
Someone manually changed a cloud resource in the console that's managed by your IaC. What actually happens the next time the pipeline runs, and how would you handle the drift?
IntermediateTerraform8 min
How does the severity of infrastructure drift change for a stateful resource like a database, versus a stateless one like a security group rule?
IntermediateTerraform6 min
What's the risk of using terraform apply -target to fix drift on just one resource, and when is it actually the right call?
IntermediateTerraform6 min
What does idempotency actually mean for infrastructure-as-code tooling, and what breaks when a module isn't genuinely idempotent?
IntermediateTerraform6 min
What does 'immutable infrastructure' actually mean in practice, and what's the real trade-off against just patching servers in place?
IntermediateInfrastructure as Code6 min
Your team writes automated tests for application code as a matter of course, but your Terraform modules have none. How would you introduce testing for infrastructure code?
IntermediateTerraform7 min
How would you actually decide between Terraform, Pulumi, and a cloud-native tool like CloudFormation for a new project, beyond just 'what the team already knows'?
IntermediateTerraform7 min
When would you use Jenkins' built-in credentials store versus an external secrets manager like Vault for pipeline secrets, and what does each actually protect against?
IntermediateJenkins6 min
Your Jenkins controller has a fixed pool of static build agents. When would switching to ephemeral, on-demand agents (e.g. via Kubernetes) actually be worth the added complexity?
IntermediateJenkinsKubernetes6 min
You've inherited 60 Jenkins freestyle jobs with configuration nobody fully documented. How would you migrate them to pipeline-as-code without breaking builds teams depend on daily?
IntermediateJenkins7 min
Your Jenkins pipeline runs three test suites in parallel stages. One fails after 2 minutes, but the pipeline keeps running the other two for another 20 minutes before reporting failure. How do you fix this?
IntermediateJenkins6 min
You upgraded a Jenkins plugin to patch a security vulnerability, and now several unrelated pipelines are failing with errors that didn't exist yesterday. How do you handle this?
IntermediateJenkins7 min
A Jenkins pipeline stage runs `docker build`. It works fine when run by hand on the agent, but fails in the pipeline with a permission denied error talking to the Docker daemon. Why?
IntermediateJenkinsDocker8 min
Why is mounting the host Docker socket into a build container considered a security risk beyond just the permission-configuration hassle?
IntermediateJenkinsDocker6 min
If a Jenkins agent ran on Kubernetes instead of a static VM, how would troubleshooting the same Docker permission problem differ?
IntermediateJenkinsKubernetesDocker6 min
Kubernetes has built-in admission controllers compiled into the API server, separate from webhook-based ones — what's the actual difference and when does it matter?
IntermediateKubernetes5 min
How would you design and roll out a policy blocking :latest image tags cluster-wide, without breaking every existing deployment on day one?
IntermediateKubernetes7 min
How do OPA Gatekeeper and Kyverno actually differ as policy engines for Kubernetes admission control, and which would you choose?
IntermediateKubernetesOpaKyverno6 min
What's the difference between a validating and a mutating admission webhook, and in what order do they actually run?
IntermediateKubernetes6 min