Kubernetes Interview Questions
128 questions
The most extensive topic on this site: RBAC and security context, storage (PV/PVC/StorageClass), workloads and controllers (Deployments, StatefulSets, DaemonSets, Jobs, CronJobs), autoscaling (HPA/VPA), scheduling and affinity, networking, cluster architecture, CRDs and operators, admission control, and cluster security hardening. Every question is a realistic production scenario — a pod stuck Pending, a webhook silently breaking scheduling, a StatefulSet rollout behaving unexpectedly — not a bare definition.
How would you debug a Service routing failure differently if you were using a service mesh like Istio instead of plain kube-proxy-based Services?
AdvancedKubernetesIstio7 min
You deploy a new version of a Kubernetes Deployment. The pods show Running and pass their readiness checks, but the Service in front of them stops routing traffic entirely. Where do you look?
IntermediateKubernetes10 min
What's the difference between ClusterIP, NodePort, LoadBalancer, and ExternalName, and how do you choose?
BeginnerKubernetes5 min
Why does Kubernetes require a CNI plugin at all — what job does it do that kube-proxy doesn't?
BeginnerKubernetes5 min
A security team rejects a pod spec requesting privileged: true — what SecurityContext alternatives would you propose to meet the actual requirement?
AdvancedKubernetes7 min
How would you audit an entire cluster to find ServiceAccounts with effectively cluster-admin permissions before a security review?
AdvancedKubernetes7 min
How would you design RBAC so a monitoring tool has read access across the whole cluster without being able to read Secrets?
IntermediateKubernetes6 min
A pod's ServiceAccount token was found in a public repo — what's your incident response, and how do you reduce blast radius for next time?
ExpertKubernetes8 min
How would you design least-privilege RBAC for a CI/CD pipeline that deploys to multiple namespaces, without granting cluster-admin?
AdvancedKubernetes8 min
A Pod Security Standard (restricted) rejects a legacy workload that needs to run as root — how do you handle this without disabling the standard cluster-wide?
AdvancedKubernetes7 min
A pod can read ConfigMaps but not Secrets in the same namespace, even though its Role looks like it should allow both — how do you find the gap?
IntermediateKubernetes6 min
What's the difference between a Role/RoleBinding and a ClusterRole/ClusterRoleBinding, and when would you bind a ClusterRole at namespace scope on purpose?
BeginnerKubernetes5 min
Why doesn't a RoleBinding in namespace A grant access to namespace B, even though the ClusterRole it references is itself cluster-scoped?
IntermediateKubernetes5 min
A ServiceAccount that worked fine before a deployment suddenly gets Forbidden errors on the Kubernetes API — how do you diagnose it?
IntermediateKubernetes7 min
A Deployment runs fine in the staging namespace but fails with RBAC errors in production — what's actually different?
IntermediateKubernetes6 min
What's the difference in behavior between a container hitting its own memory limit versus the underlying node running out of memory overall?
IntermediateKubernetes6 min
How would you distinguish a genuine memory leak from a legitimately growing in-memory cache, using only Kubernetes-level metrics?
AdvancedKubernetesPrometheus8 min
Your container runs fine locally but repeatedly gets OOMKilled after you deploy it to Kubernetes. How would you investigate it?
IntermediateKubernetesContainers10 min
How do requests.memory and limits.memory affect Pod scheduling and node-level eviction behavior differently from each other?
IntermediateKubernetes6 min
Two pods that should never co-locate keep landing on the same node — what's wrong with the anti-affinity rule?
AdvancedKubernetes7 min
A critical pod gets preempted by a seemingly lower-priority pod during a resource crunch — how do you investigate and prevent it?
AdvancedKubernetes7 min
How would you dedicate a set of nodes exclusively to one team's workloads, while still letting that team's pods run elsewhere too?
AdvancedKubernetes7 min
How does the Kubernetes scheduler actually decide which node to place a pod on — walk through filtering and scoring?
IntermediateKubernetes6 min
What's the practical difference between node affinity and a plain node selector, given affinity seems strictly more powerful?
BeginnerKubernetes5 min