Senior DevOps Interview Questions
516 questions across 39 categories
Deeper trade-off and design questions — why a specific approach was chosen, what breaks at scale, and how to reason about a system you didn't build.
A helm rollback succeeds but the application still behaves like the newer version — why might rollback not fully revert the deployed state?
AdvancedHelm7 min
How would you override a specific value inside a subchart that a parent Helm chart depends on, without modifying the subchart itself?
IntermediateHelm6 min
A `helm upgrade` gets interrupted (CI job killed, network blip) and now every subsequent `helm upgrade` or `helm rollback` fails with "another operation (install/upgrade/rollback) is in progress". How do you recover?
IntermediateHelmKubernetes8 min
A Helm chart's deployed values don't match any single values file you can find — how does Helm's value-override precedence actually work?
IntermediateHelmKubernetes6 min
Why does Helm use Kubernetes Secrets as its storage backend by default instead of an external database, and what does that trade off?
IntermediateHelmKubernetes6 min
How would you design scheduled Terraform drift detection so it alerts the right team without becoming noise nobody reads?
AdvancedTerraform8 min
Someone manually changed a cloud resource in the console that's managed by your IaC. What actually happens the next time the pipeline runs, and how would you handle the drift?
IntermediateTerraform8 min
How does the severity of infrastructure drift change for a stateful resource like a database, versus a stateless one like a security group rule?
IntermediateTerraform6 min
What's the risk of using terraform apply -target to fix drift on just one resource, and when is it actually the right call?
IntermediateTerraform6 min
What does idempotency actually mean for infrastructure-as-code tooling, and what breaks when a module isn't genuinely idempotent?
IntermediateTerraform6 min
What does 'immutable infrastructure' actually mean in practice, and what's the real trade-off against just patching servers in place?
IntermediateInfrastructure as Code6 min
Your team writes automated tests for application code as a matter of course, but your Terraform modules have none. How would you introduce testing for infrastructure code?
IntermediateTerraform7 min
How would you actually decide between Terraform, Pulumi, and a cloud-native tool like CloudFormation for a new project, beyond just 'what the team already knows'?
IntermediateTerraform7 min
You need to make a breaking change to a shared infrastructure module used by 30 different projects. How do you version and roll this out without breaking everyone simultaneously?
AdvancedTerraform8 min
When would you use Jenkins' built-in credentials store versus an external secrets manager like Vault for pipeline secrets, and what does each actually protect against?
IntermediateJenkins6 min
Your Jenkins controller has a fixed pool of static build agents. When would switching to ephemeral, on-demand agents (e.g. via Kubernetes) actually be worth the added complexity?
IntermediateJenkinsKubernetes6 min
You've inherited 60 Jenkins freestyle jobs with configuration nobody fully documented. How would you migrate them to pipeline-as-code without breaking builds teams depend on daily?
IntermediateJenkins7 min
Your Jenkins pipeline runs three test suites in parallel stages. One fails after 2 minutes, but the pipeline keeps running the other two for another 20 minutes before reporting failure. How do you fix this?
IntermediateJenkins6 min
You upgraded a Jenkins plugin to patch a security vulnerability, and now several unrelated pipelines are failing with errors that didn't exist yesterday. How do you handle this?
IntermediateJenkins7 min
You've extracted common pipeline logic into a Jenkins shared library used by 40+ Jenkinsfiles. How do you version it so you can improve the library without breaking every pipeline that depends on it?
AdvancedJenkins7 min
A Jenkins pipeline stage runs `docker build`. It works fine when run by hand on the agent, but fails in the pipeline with a permission denied error talking to the Docker daemon. Why?
IntermediateJenkinsDocker8 min
Why is mounting the host Docker socket into a build container considered a security risk beyond just the permission-configuration hassle?
IntermediateJenkinsDocker6 min
How would Kaniko or rootless BuildKit avoid the Docker socket mounting problem entirely, and what do you give up by switching to them?
AdvancedJenkinsDocker7 min
If a Jenkins agent ran on Kubernetes instead of a static VM, how would troubleshooting the same Docker permission problem differ?
IntermediateJenkinsKubernetesDocker6 min