Kubernetes

A service depends on a database that goes down for 60 seconds. Which probe configuration behaves correctly?

Readiness controls whether a pod receives traffic; liveness controls whether it gets killed and restarted. Checking a downstream dependency in a liveness probe turns a brief dependency blip into a cluster-wide restart storm.

You run kubectl get pods and the request succeeds, but new Pods created afterwards stay in Pending forever with no events about nodes. Which control plane component is the first one to suspect?

The API server is clearly working, since kubectl gets answers. Deciding which node a Pod runs on is the kube-scheduler's only job, so a Pod that is accepted but never placed points at the scheduler.

A colleague runs kubectl get pv -n team-a and is surprised the namespace makes no difference to the output. Why does the flag change nothing?

PersistentVolume is a cluster-scoped resource, so it belongs to no namespace and -n is ignored. kubectl api-resources --namespaced=false lists everything that behaves this way.

You have one kubeconfig holding three clusters. Every kubectl command keeps hitting the wrong one. Which command changes the target for subsequent commands?

A context ties a cluster, a user and a default namespace together. kubectl config use-context switches which one is current, and kubectl config get-contexts shows the choices.

You delete a Pod that a Deployment created. Seconds later a Pod with a similar name is running again. What is doing that, and how do you actually stop it?

A ReplicaSet controller compares desired replicas with what exists and creates a replacement. To stop it you change the desired state, by scaling to zero or deleting the Deployment.

You need to grant a user permission to list nodes. Which object must the permission be defined in, and why?

Nodes are cluster-scoped, so permission on them can only be expressed in a ClusterRole, granted through a ClusterRoleBinding. A Role covers namespaced resources only.

True or false: you can stop a user who has been granted cluster-wide pod read access from reading Pods in one sensitive namespace by adding a Role in that namespace that denies it.

False. RBAC permissions are purely additive and there are no deny rules. To take access away you have to change or remove the binding that granted it.

A configuration has both a required_providers entry for aws and a provider "aws" block setting a region. A reviewer asks whether one of them is redundant. What does each one do?

required_providers declares which providers the module needs, with their source address and version constraint. A provider block configures one of them, with settings such as region.

Pods on a new cluster stay in ContainerCreating and the kubelet logs mention that the network plugin is not ready. Which extension interface is involved?

CNI is the container network interface, and Kubernetes ships no default implementation. Until a CNI plugin is installed and healthy, Pods cannot be given network namespaces and stay in ContainerCreating.

A Deployment with 4 replicas and no rollingUpdate settings is updated to a new image. What does Kubernetes guarantee about Pod counts during the rollout?

maxUnavailable and maxSurge both default to 25%. With 4 replicas that allows one Pod unavailable and one extra Pod, so the count stays between 3 and 5.

kubectl get all in a namespace shows one Deployment, two ReplicaSets and three Pods. Only one ReplicaSet has replicas. What does the second one represent?

A Deployment creates a new ReplicaSet for each revision of its Pod template. Old ReplicaSets are scaled to zero and kept, which is what makes a rollback possible.

A Job must process exactly 12 work items, running at most 4 Pods at a time. Which fields express that, and what does the Job controller do as Pods finish?

completions is how many Pods must succeed, and parallelism is how many may run at once. Set 12 and 4, and the controller keeps starting Pods until 12 have succeeded.

A Deployment exists and someone tries to change spec.selector.matchLabels to a new value. The apply is rejected. What is the rule, and what does it force you to do?

A Deployment's label selector is immutable after creation in apps/v1. Changing it means deleting and recreating the Deployment, optionally with --cascade=orphan to keep the Pods up.

A developer says Secrets are safe to commit to Git because Kubernetes encrypts them. What is the accurate correction?

Secret data is base64 encoded, not encrypted. Anyone with API or etcd access can read it, so protecting Secrets means RBAC plus encryption at rest, which is off by default.

A monitoring agent must run exactly once on every node, including nodes added to the cluster next week. Which workload object fits, and why not the alternative?

A DaemonSet places one Pod per eligible node and covers new nodes automatically. A Deployment counts replicas without caring which nodes they land on.

A configuration repeats the expression "${var.project}-${var.env}" in eleven resource names. The team wants to write it once. Should that be a variable or a local value?

A local value names an expression for reuse inside one module and cannot be set from outside. An input variable is a value the caller supplies, so it cannot be computed from other variables.

A subnet resource needs the id of a VPC declared in the same configuration as aws_vpc.main. Which expression provides it, and what side effect does writing it have?

Write aws_vpc.main.id to read the attribute. The reference also creates an implicit dependency, so Terraform creates the VPC before the subnet without any depends_on.

An internal API must be reachable by other Pods in the cluster but must not be exposed outside it. Which Service type meets that, and how do the other types relate to it?

ClusterIP is the default and is reachable only from inside the cluster. NodePort and LoadBalancer build on top of it by adding external entry points.

A container listens on 8080. Clients inside the cluster must reach the Service on 80. Which combination of port and targetPort is correct?

port is the port clients use on the Service. targetPort is the port on the Pod that traffic is forwarded to. Here that means port 80 and targetPort 8080.

A Pod in the frontend namespace must reach a Service named api in the backend namespace. Which name resolves, and what is the fully qualified form?

A Service is reachable as api.backend from another namespace, and the fully qualified name is api.backend.svc.cluster.local. A bare api only resolves inside the Service's own namespace.

Two Pods on different nodes talk to each other directly by Pod IP with no port mapping anywhere. Which rule of the Kubernetes network model makes that work?

Every Pod gets its own cluster-wide IP, and Pods reach each other on that IP without NAT. The network plugin is what has to deliver that, not Kubernetes itself.

A cluster must expose two applications on one external hostname, routed by URL path. Which object does the path-based routing, and what is still required underneath it?

An Ingress routes HTTP by host and path, which a Service cannot do. It still forwards to ClusterIP Services, and it needs an Ingress controller to be running.

A Service of type NodePort is created without specifying a node port. Which port is assigned, and what is the constraint if you want to pick one yourself?

Kubernetes allocates a port from the range set by the API server's --service-node-port-range flag, 30000-32767 by default. A port you choose by hand must be inside that range and free.

An Ingress resource for app.example.com has been applied and the object exists, but nothing responds and the ADDRESS column stays empty. What is missing?

An Ingress is only configuration. An Ingress controller has to be running to satisfy it, and the Ingress usually needs an ingressClassName telling that controller to pick it up.

Three Pods on three different nodes must all write to the same volume. The available storage class provisions block volumes that support ReadWriteOnce only. What does that mean?

ReadWriteOnce means read-write by a single node, so Pods on other nodes cannot mount it. Shared writes across nodes need ReadWriteMany, which usually means file storage rather than block.

An application team needs 20Gi of storage. A cluster with dynamic provisioning is available. Which object does the team write, and where does the other one come from?

The team writes a PersistentVolumeClaim asking for size and access mode. With dynamic provisioning the StorageClass creates the matching PersistentVolume automatically.

A Deployment with three replicas mounts a hostPath volume at /data. Replicas land on three different nodes and each sees different files. Why, and what is the deeper risk?

hostPath mounts a directory from whichever node the Pod runs on, so each node has its own copy. It also exposes the host filesystem, which is why it is discouraged outside single-node use.

A PVC with no storageClassName field is applied to a cluster and stays Pending. Which check explains it fastest?

A PVC that omits storageClassName uses the default StorageClass, marked by the storageclass.kubernetes.io/is-default-class annotation. With no default and no matching PV, the claim waits.

A team mounts a ConfigMap as a volume and asks whether they should set a reclaim policy and access mode on it. What is the accurate answer?

ConfigMap and Secret volumes are projections of API objects, not persistent storage. They have no PV, no claim, no reclaim policy, and they are always mounted read-only.

A container writes a cache to /scratch using an emptyDir volume. Which statement describes when that data is lost?

An emptyDir lives as long as the Pod on that node. It survives a container restart but is gone when the Pod is deleted or rescheduled elsewhere.

A Pod has been Pending for ten minutes. Which single command gives you the reason, and what should you expect to read in it?

kubectl describe pod shows the scheduler's FailedScheduling event, which names the reason node by node: insufficient CPU or memory, an untolerated taint, or no node matching the selector.

kubectl get pods shows a Pod with STATUS Running and READY 1/2, and requests to its Service are failing. What does that pair of columns tell you?

READY counts ready containers out of total containers in the Pod. At 1/2 the Pod is not ready, so it is left out of Service endpoints even though STATUS says Running.

A Pod is in ImagePullBackOff. Which TWO causes are consistent with that status?

ImagePullBackOff means the kubelet cannot fetch the image. A wrong name or tag and a missing registry credential are the two usual reasons, and the Pod's events name which one.

A Pod will not start and you need both the scheduling events and the exact resource requests as submitted. Which two commands give you those, and what does each leave out?

describe gives a human summary plus recent Events, which the YAML never contains. get -o yaml gives the exact stored object including defaults, which describe abbreviates.

A container is in CrashLoopBackOff and kubectl logs returns nothing useful because the container has just restarted. Which command shows the output from the failed run?

kubectl logs --previous returns the logs of the previous instantiation of the container, which is where the reason for the crash actually is.

A Pod is scheduled to a node but its status reads CreateContainerConfigError. The image pulled fine. What class of problem is this, and where do you look?

The kubelet could not assemble the container's configuration, usually because a referenced ConfigMap, Secret or key does not exist. The Pod events name the missing object.

You are asked to find out what happened in a namespace over the last few minutes. Which command gives the most useful ordered picture, and what limitation should you expect?

kubectl get events --sort-by=.lastTimestamp gives a namespace timeline. Events are namespaced and short-lived, retained for one hour by default, so older history is simply gone.

kubectl top nodes fails with an error saying the metrics API is not available, though every node is Ready and workloads are healthy. What does that indicate?

kubectl top reads the Metrics API, which is served by metrics-server rather than by the API server itself. Without it installed there is nothing to answer, and resource usage has to come from elsewhere.

On a fresh install, kubectl get nodes fails with a message about the connection to the server localhost:8080 being refused. What does that specific message mean?

localhost:8080 is kubectl's fallback when it finds no kubeconfig. The fix is to point it at a real one, usually by copying admin.conf into ~/.kube/config.