Senior DevOps Interview Questions
516 questions across 39 categories
Deeper trade-off and design questions — why a specific approach was chosen, what breaks at scale, and how to reason about a system you didn't build.
How would you troubleshoot connectivity that works within a node but fails between pods on different nodes?
AdvancedKubernetes8 min
How would you design NetworkPolicies for a namespace using default-deny-all while still allowing necessary traffic?
IntermediateKubernetes7 min
What's the difference between Kubernetes Endpoints and EndpointSlices, and why did Kubernetes introduce EndpointSlices?
IntermediateKubernetes6 min
A headless Service behaves completely differently for DNS resolution — what's different, and when do you need it?
IntermediateKubernetes6 min
What's the difference between the older Ingress resource and the newer Gateway API, and when would you actually migrate?
IntermediateKubernetes6 min
A pod resolves a Service's DNS name intermittently but not consistently — how do you investigate CoreDNS itself?
AdvancedKubernetes8 min
What does a pod's ndots DNS setting default to, and how can it cause unexpectedly slow external DNS lookups?
AdvancedKubernetes7 min
A NetworkPolicy is applied but pods that should be blocked can still communicate — why might it not be enforced?
AdvancedKubernetes7 min
How would you debug a Service routing failure differently if you were using a service mesh like Istio instead of plain kube-proxy-based Services?
AdvancedKubernetesIstio7 min
You deploy a new version of a Kubernetes Deployment. The pods show Running and pass their readiness checks, but the Service in front of them stops routing traffic entirely. Where do you look?
IntermediateKubernetes10 min
A security team rejects a pod spec requesting privileged: true — what SecurityContext alternatives would you propose to meet the actual requirement?
AdvancedKubernetes7 min
How would you audit an entire cluster to find ServiceAccounts with effectively cluster-admin permissions before a security review?
AdvancedKubernetes7 min
How would you design RBAC so a monitoring tool has read access across the whole cluster without being able to read Secrets?
IntermediateKubernetes6 min
How would you design least-privilege RBAC for a CI/CD pipeline that deploys to multiple namespaces, without granting cluster-admin?
AdvancedKubernetes8 min
A Pod Security Standard (restricted) rejects a legacy workload that needs to run as root — how do you handle this without disabling the standard cluster-wide?
AdvancedKubernetes7 min
A pod can read ConfigMaps but not Secrets in the same namespace, even though its Role looks like it should allow both — how do you find the gap?
IntermediateKubernetes6 min
Why doesn't a RoleBinding in namespace A grant access to namespace B, even though the ClusterRole it references is itself cluster-scoped?
IntermediateKubernetes5 min
A ServiceAccount that worked fine before a deployment suddenly gets Forbidden errors on the Kubernetes API — how do you diagnose it?
IntermediateKubernetes7 min
A Deployment runs fine in the staging namespace but fails with RBAC errors in production — what's actually different?
IntermediateKubernetes6 min
What's the difference in behavior between a container hitting its own memory limit versus the underlying node running out of memory overall?
IntermediateKubernetes6 min
How would you distinguish a genuine memory leak from a legitimately growing in-memory cache, using only Kubernetes-level metrics?
AdvancedKubernetesPrometheus8 min
Your container runs fine locally but repeatedly gets OOMKilled after you deploy it to Kubernetes. How would you investigate it?
IntermediateKubernetesContainers10 min
How do requests.memory and limits.memory affect Pod scheduling and node-level eviction behavior differently from each other?
IntermediateKubernetes6 min
Two pods that should never co-locate keep landing on the same node — what's wrong with the anti-affinity rule?
AdvancedKubernetes7 min