DevOps Engineer Interview Questions
372 questions across 38 categories
The bulk of a working DevOps engineer's day-to-day: hands-on tooling, common troubleshooting, and the practical judgment calls that come up once you're actually operating systems.
Why are Kubernetes Secrets only base64-encoded by default, not encrypted, and how would you actually protect them at rest?
BeginnerKubernetes5 min
Why should a CRD's status be a separate subresource from spec, and what belongs in status versus spec?
IntermediateKubernetes6 min
How does an operator's reconciliation loop actually work, and why is it designed to be idempotent and level-triggered rather than event-driven?
IntermediateKubernetes6 min
A custom resource is deleted, but the Deployments and Services an operator created for it are left orphaned in the cluster — why doesn't Kubernetes clean them up automatically?
IntermediateKubernetes6 min
What's actually different about a CustomResourceDefinition versus a built-in Kubernetes resource like a Deployment?
BeginnerKubernetes5 min
What's the actual difference between a Pod and a Deployment in Kubernetes, and why would you almost never create a bare Pod directly in production?
BeginnerKubernetes6 min
How does a Service-not-routing-traffic failure mode differ between a plain ClusterIP Service and one fronted by an Ingress controller?
IntermediateKubernetes7 min
How would you design NetworkPolicies for a namespace using default-deny-all while still allowing necessary traffic?
IntermediateKubernetes7 min
What's the difference between Kubernetes Endpoints and EndpointSlices, and why did Kubernetes introduce EndpointSlices?
IntermediateKubernetes6 min
A headless Service behaves completely differently for DNS resolution — what's different, and when do you need it?
IntermediateKubernetes6 min
What's the difference between the older Ingress resource and the newer Gateway API, and when would you actually migrate?
IntermediateKubernetes6 min
You deploy a new version of a Kubernetes Deployment. The pods show Running and pass their readiness checks, but the Service in front of them stops routing traffic entirely. Where do you look?
IntermediateKubernetes10 min
What's the difference between ClusterIP, NodePort, LoadBalancer, and ExternalName, and how do you choose?
BeginnerKubernetes5 min
Why does Kubernetes require a CNI plugin at all — what job does it do that kube-proxy doesn't?
BeginnerKubernetes5 min
How would you design RBAC so a monitoring tool has read access across the whole cluster without being able to read Secrets?
IntermediateKubernetes6 min
A pod can read ConfigMaps but not Secrets in the same namespace, even though its Role looks like it should allow both — how do you find the gap?
IntermediateKubernetes6 min
What's the difference between a Role/RoleBinding and a ClusterRole/ClusterRoleBinding, and when would you bind a ClusterRole at namespace scope on purpose?
BeginnerKubernetes5 min
Why doesn't a RoleBinding in namespace A grant access to namespace B, even though the ClusterRole it references is itself cluster-scoped?
IntermediateKubernetes5 min
A ServiceAccount that worked fine before a deployment suddenly gets Forbidden errors on the Kubernetes API — how do you diagnose it?
IntermediateKubernetes7 min
A Deployment runs fine in the staging namespace but fails with RBAC errors in production — what's actually different?
IntermediateKubernetes6 min
What's the difference in behavior between a container hitting its own memory limit versus the underlying node running out of memory overall?
IntermediateKubernetes6 min
Your container runs fine locally but repeatedly gets OOMKilled after you deploy it to Kubernetes. How would you investigate it?
IntermediateKubernetesContainers10 min
How do requests.memory and limits.memory affect Pod scheduling and node-level eviction behavior differently from each other?
IntermediateKubernetes6 min
How does the Kubernetes scheduler actually decide which node to place a pod on — walk through filtering and scoring?
IntermediateKubernetes6 min