Kubernetes Interview Questions
128 questions
The most extensive topic on this site: RBAC and security context, storage (PV/PVC/StorageClass), workloads and controllers (Deployments, StatefulSets, DaemonSets, Jobs, CronJobs), autoscaling (HPA/VPA), scheduling and affinity, networking, cluster architecture, CRDs and operators, admission control, and cluster security hardening. Every question is a realistic production scenario — a pod stuck Pending, a webhook silently breaking scheduling, a StatefulSet rollout behaving unexpectedly — not a bare definition.
Kubernetes has built-in admission controllers compiled into the API server, separate from webhook-based ones — what's the actual difference and when does it matter?
IntermediateKubernetes5 min
How would you design and roll out a policy blocking :latest image tags cluster-wide, without breaking every existing deployment on day one?
IntermediateKubernetes7 min
Two mutating webhooks both touch a pod's containers field, and the final result isn't what either webhook intended alone — how do you diagnose and resolve this?
ExpertKubernetes8 min
How do OPA Gatekeeper and Kyverno actually differ as policy engines for Kubernetes admission control, and which would you choose?
IntermediateKubernetesOpaKyverno6 min
A new mutating webhook accidentally intercepted kube-system pod creation and broke core cluster components — how would you design its scoping to prevent this?
AdvancedKubernetes7 min
What's the difference between a validating and a mutating admission webhook, and in what order do they actually run?
IntermediateKubernetes6 min
Every pod creation cluster-wide suddenly starts failing with an admission webhook TLS error — what happened, and how do you recover quickly?
ExpertKubernetes8 min
An admission webhook's failurePolicy is set to Fail — what happens if the webhook itself becomes unavailable, and why might that be the wrong default?
AdvancedKubernetes7 min
A validating webhook is rejecting pod creations that look completely valid — how do you diagnose what it's actually objecting to?
AdvancedKubernetes7 min
kubectl apply --dry-run=server behaves unexpectedly for requests a webhook handles — what does a webhook's sideEffects field have to do with it?
AdvancedKubernetes6 min
For enforcing a new policy, when does it belong in a cluster admission webhook versus a CI-time check before deployment even happens?
IntermediateKubernetes6 min
What's the difference between kube-apiserver, kube-scheduler, and kube-controller-manager, and what breaks if each is unavailable?
IntermediateKubernetes6 min
The API server responds slowly to all requests — how do you determine whether etcd, the API server, or something else is the bottleneck?
ExpertKubernetes9 min
How would you design a highly-available control plane, and what breaks with only one control-plane node?
IntermediateKubernetes7 min
How would you design backup/DR for etcd, and what's actually recoverable from a snapshot versus what isn't?
AdvancedKubernetesEtcd8 min
How does etcd's quorum requirement affect control-plane node count, and why is an even number a bad choice?
IntermediateKubernetesEtcd6 min
What's etcd's actual role in a cluster, and what happens if it becomes unavailable?
BeginnerKubernetesEtcd5 min
How would you safely drain and remove a node without disrupting running workloads?
IntermediateKubernetes6 min
What's the difference between a static pod and a normal pod, and why does the control plane often run as static pods?
IntermediateKubernetes5 min
How would you design multi-cluster architecture — when does an org actually need multiple clusters instead of namespaces?
AdvancedKubernetes8 min
A cluster upgrade needs zero workload downtime — walk through sequencing control-plane and node upgrades safely.
AdvancedKubernetes8 min
A team wants to run HPA and VPA on the same Deployment for both CPU and memory — what breaks if you're not careful, and how do you combine them safely?
ExpertKubernetes8 min
What's the difference between HPA scaling on CPU utilization versus a custom metric like queue depth, and when is CPU actually the wrong signal?
IntermediateKubernetes6 min
How does HPA's scaling decision actually get computed from raw metrics — walk through what happens between a CPU spike and a new replica appearing?
IntermediateKubernetes6 min