Started fine but I rambled too long on pods and didn't leave enough space to talk about how Services abstract the networking.
Start by defining each Kubernetes object in one clear sentence, then contrast their scopes and lifecycles. Use a concrete example (e.g., a web app) to show how they work together, and explain when you'd use each based on requirements like scaling, stability, and networking.
Pro tip: Emphasize that Pods are ephemeral and rarely created directly; instead, you use controllers like Deployments to manage them. Mention that Services provide stable networking, which is crucial for microservices communication.
Explain that a Pod is the smallest deployable unit, representing a single instance of a running process, and can contain one or more containers. Mention that Pods are ephemeral and not self-healing.
Describe a Deployment as a higher-level controller that manages ReplicaSets, which in turn manage Pods. It provides declarative updates, scaling, and self-healing for stateless applications.
Explain that a Service is an abstraction that defines a logical set of Pods and a policy to access them, providing stable networking and load balancing. Mention types like ClusterIP, NodePort, and LoadBalancer.
Highlight that Pods are the building blocks, Deployments manage Pods for scalability and updates, and Services expose Pods to other services or external traffic. They are complementary, not alternatives.
Give scenarios: use Pods directly for one-off tasks or debugging; use Deployments for stateless apps needing scaling and rolling updates; use Services to enable communication between microservices or expose apps externally.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
I knew the basics, filtering and scoring phases, but blanked a bit when they pushed on affinity rules and taints/tolerations in the same breath.
Explain the Kubernetes scheduler's two-phase process: filtering nodes that meet the pod's requirements, then scoring the remaining nodes to pick the best fit. Highlight key factors like resource requests, affinity rules, and taints/tolerations, and mention how custom schedulers or profiles can alter behavior.
Pro tip: Emphasize that the scheduler is extensible and pluggable—mention that you can write custom scheduling policies or use multiple schedulers to handle specialized workloads, showing you understand production-grade flexibility.
State that the scheduler assigns pods to nodes by watching for unscheduled pods and running a cycle to find the best node. Mention it's a control-plane component that can be replaced or extended.
Describe how the scheduler filters out nodes that don't meet the pod's requirements, such as insufficient resources, taints, or node selectors. This yields a list of feasible nodes.
Explain that the scheduler scores each feasible node based on priorities like spreading pods, affinity, and resource balance. The highest-scoring node wins.
Mention that after selection, the scheduler binds the pod to the node. Also note that scheduling profiles and custom schedulers can modify these phases.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by framing Kubernetes networking around the fundamental requirement that every Pod gets a unique IP and can communicate without NAT. Then layer on CNI for pod-to-pod connectivity, Services for stable virtual IPs and load balancing, and Ingress for external HTTP(S) routing. Use a concrete example (e.g., a user request hitting an Ingress, then a Service, then a Pod) to tie the layers together and highlight trade-offs.
Pro tip: Mention that while Services provide L4 load balancing, Ingress operates at L7 and often requires an Ingress Controller (e.g., NGINX, Traefik) — this shows you understand the operational reality beyond just the API objects.
Explain that each Pod gets a unique IP from the cluster CIDR, and CNI plugins (e.g., Calico, Flannel, Cilium) implement the network fabric to enable pod-to-pod communication across nodes without NAT.
Describe how Services provide a stable virtual IP (ClusterIP) and DNS name, load-balancing traffic to a set of Pods selected by labels. Mention kube-proxy and iptables/IPVS as the underlying mechanism.
Cover the different Service types: ClusterIP (internal), NodePort (exposes on each node's IP), LoadBalancer (cloud provider integration), and ExternalName (DNS CNAME). Explain when to use each.
Explain that Ingress provides HTTP/HTTPS routing based on host/path, TLS termination, and virtual hosting. It requires an Ingress Controller (e.g., NGINX, HAProxy) to actually implement the rules.
Walk through a request: external client -> Ingress Controller -> Service -> Pod. Discuss trade-offs like CNI performance (e.g., overlay vs. native routing), Service vs. Ingress responsibilities, and when to use a Service Mesh.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Answered it but I mixed up my explanation of StorageClasses halfway through.
Start by defining Persistent Volumes (PVs) and Persistent Volume Claims (PVCs) and their roles in decoupling storage from pods. Then explain the lifecycle and binding process, and contrast static vs dynamic provisioning with examples. Finally, discuss trade-offs and when to use each approach.
Pro tip: Mention how dynamic provisioning with StorageClasses simplifies storage management at scale, but also note that static provisioning can be useful for pre-provisioned or specialized storage. Highlight that PVCs enable portability across environments.
Explain that a Persistent Volume is a cluster-wide storage resource, while a Persistent Volume Claim is a request for storage by a user or pod. Emphasize that PVCs abstract storage details from pods.
Describe how a PVC binds to a suitable PV based on capacity, access modes, and other criteria. Mention that binding is one-to-one and that PVs can be reclaimed via Retain, Delete, or Recycle policies.
Static provisioning involves an administrator manually creating PVs in advance. Pods then claim them via PVCs. This is suitable for predictable or specialized storage needs.
Dynamic provisioning automatically creates a PV when a PVC is made, using a StorageClass that defines the provisioner and parameters. This is more scalable and common in cloud environments.
Contrast static vs dynamic: static offers control but requires manual management; dynamic is automated and scalable but may lack fine-grained control. Mention use cases for each.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by explaining the concept of layers as immutable filesystem diffs, then walk through the build process step-by-step, highlighting how each instruction creates a new layer. Emphasize the implications for caching, image size, and build performance, and tie it back to system design trade-offs like reproducibility and efficiency.
Pro tip: Mention that layer caching is keyed on the instruction and the checksum of the files being copied, so ordering instructions from least to most frequently changing maximizes cache hits. Also note that multi-stage builds can drastically reduce final image size by discarding build-time dependencies.
Explain that a Docker image is composed of read-only layers, each representing a set of filesystem changes from a Dockerfile instruction. Layers are stacked to form the final filesystem via union mounts.
Walk through how 'docker build' executes each instruction: for each, it creates an intermediate container, applies the change, and commits it as a new layer. The final image is the top layer plus all parent layers.
Detail how Docker caches layers: if an instruction and its context (e.g., copied files) haven't changed, it reuses the cached layer. This speeds up builds but can lead to stale caches if not managed.
Cover how layering affects image size (each layer adds overhead), build speed (cache hits/misses), and security (minimizing layers reduces attack surface). Mention strategies like multi-stage builds and squashing.
Relate to system design trade-offs: e.g., caching vs. freshness, image size vs. build simplicity, and reproducibility vs. optimization. Show awareness of when to prioritize each.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by defining containerd and runc and their roles in the container runtime stack, then explain how they interact via the CRI and OCI specifications. Use a layered analogy (e.g., containerd as a manager, runc as a worker) to clarify the relationship and highlight practical implications.
Pro tip: Emphasize that containerd is a daemon that manages the full container lifecycle, while runc is a lightweight CLI tool that actually spawns containers according to OCI specs. Mention that containerd uses runc as its default runtime but can be configured with alternatives like crun or Kata Containers, showing awareness of the ecosystem.
Explain that containerd is a high-level container runtime daemon that manages the complete container lifecycle, including image transfer, storage, execution, and supervision. It provides an API for container orchestration systems like Kubernetes via CRI.
Describe runc as a low-level CLI tool that implements the OCI runtime specification. It is responsible for spawning and running containers according to the OCI configuration, handling namespaces, cgroups, and other Linux primitives.
Clarify that containerd uses runc as its default runtime to create containers. When containerd receives a request to start a container, it prepares the OCI bundle and invokes runc to execute the container process. runc then exits after starting the container, leaving the container process running under containerd's supervision.
Outline the stack: orchestration (e.g., Kubernetes) → high-level runtime (containerd) → low-level runtime (runc) → Linux kernel. Mention that containerd can also be used directly without orchestration, and that it supports multiple low-level runtimes.
Discuss why this separation matters: containerd provides a stable, feature-rich API for management, while runc focuses on OCI compliance and simplicity. This modularity allows for innovation and choice in the low-level runtime space.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Namespaces for isolation (pid, net, mnt, uts, ipc), cgroups for resource limits.
Start by defining Linux namespaces and cgroups separately, then explain how they complement each other to provide isolation and resource control. Use a concrete example like Docker to illustrate their combined effect, and discuss trade-offs such as security and performance.
Pro tip: Emphasize that namespaces provide the 'view' of isolation while cgroups provide the 'enforcement' of resource limits—this distinction shows deep understanding. Also, mention that while they are powerful, they are not a complete security boundary without additional measures like seccomp or capabilities.
Explain that namespaces partition kernel resources such as process IDs, network stacks, and mount points, giving each container a separate view of the system.
Describe cgroups as a mechanism to limit, account for, and isolate resource usage (CPU, memory, I/O) of a group of processes.
Detail how namespaces isolate what a process can see, while cgroups control how much it can use, together forming the foundation of container isolation.
Walk through how a container runtime like Docker uses namespaces (e.g., PID, NET, MNT) and cgroups (e.g., memory limit) to create and manage a container.
Mention that namespaces and cgroups are not a full security boundary; additional tools like seccomp, SELinux, and user namespaces are needed for stronger isolation.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by defining a rolling update as a Deployment strategy that incrementally replaces old Pods with new ones to avoid downtime. Then explain the key parameters (maxSurge, maxUnavailable) and how they control the pace, and finish by discussing trade-offs like speed vs. availability and how readiness probes affect the rollout.
Pro tip: Mention that the pace is also influenced by the readiness probe and the Deployment's minReadySeconds, which are often overlooked but critical in production. Also, note that if you need more control (e.g., canary), you'd use a different strategy or a progressive delivery tool like Argo Rollouts.
Explain that a rolling update gradually replaces old Pods with new ones, ensuring zero downtime by keeping some Pods available throughout the process.
Detail how the Deployment controller creates a new ReplicaSet and scales it up while scaling down the old one, respecting the maxSurge and maxUnavailable parameters.
Discuss how maxSurge (extra Pods above desired count) and maxUnavailable (Pods that can be unavailable) determine the speed and safety of the rollout.
Mention that readiness probes and minReadySeconds affect when a new Pod is considered available, thus influencing the pace.
Compare speed vs. availability: higher maxSurge/maxUnavailable speeds up rollout but risks downtime; lower values are safer but slower.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Went through HPA, VPA, and cluster autoscaler.
Structure your answer by first categorizing scaling into three dimensions: workload-level (pods), node-level (infrastructure), and cluster-level (multi-cluster). For each, explain the mechanisms, when to use them, and the tradeoffs in terms of complexity, cost, and responsiveness. Conclude by emphasizing that the right choice depends on workload characteristics and operational maturity.
Pro tip: Mention that scaling is not just about adding resources—it's also about scaling down efficiently and handling stateful workloads, which often require custom solutions like operators. This shows you think about cost and reliability, not just performance.
Break down scaling into pod-level (horizontal and vertical), node-level (cluster autoscaling), and cluster-level (federation/multi-cluster). This provides a clear structure for your answer.
Describe Horizontal Pod Autoscaler (HPA) for scaling replicas based on metrics, Vertical Pod Autoscaler (VPA) for adjusting resource requests/limits, and manual scaling. Mention tradeoffs: HPA is reactive and needs metrics; VPA can cause restarts; manual is simple but not dynamic.
Cover Cluster Autoscaler (or Karpenter) which adds/removes nodes when pods can't be scheduled or nodes are underutilized. Tradeoffs: slower to react, cloud provider dependencies, and cost implications.
Discuss multi-cluster scaling using tools like Karmada, Cluster API, or federation for geo-distribution and isolation. Tradeoffs: increased operational complexity, networking challenges, and data consistency issues.
Compare tradeoffs: responsiveness, complexity, cost, and suitability for stateful vs stateless workloads. Emphasize that combining approaches (e.g., HPA + Cluster Autoscaler) is common, and the choice depends on workload patterns and SLAs.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
kubectl describe, then logs, then exec if it stays up long enough, then check resource limits and liveness probe config.
Start by describing the systematic process of gathering information from the pod's status, logs, and events, then narrow down to the root cause. Emphasize a methodical approach that moves from symptoms to underlying issues, and mention how you would fix and prevent recurrence.
Pro tip: Always check the previous container's logs with `kubectl logs --previous` because the current container may have already crashed and restarted, losing critical error messages. Also, remember that CrashLoopBackOff often indicates an application-level issue, not just Kubernetes misconfiguration.
Use `kubectl describe pod <pod-name>` to see the pod's status, recent events, and container states. Look for error messages, exit codes, and reasons for termination.
Retrieve logs from the current and previous container instances using `kubectl logs <pod-name>` and `kubectl logs <pod-name> --previous`. Look for application errors, stack traces, or configuration issues.
Check ConfigMaps, Secrets, environment variables, and volume mounts for correctness. Ensure the application can reach its dependencies (e.g., database, external services).
If possible, run the container image locally or in a debug pod to reproduce the issue. This helps distinguish between application bugs and cluster-specific problems.
Once the root cause is identified, apply the fix (e.g., update image, fix config, adjust resources). Monitor the pod to ensure it stabilizes and consider adding health checks or resource limits to prevent recurrence.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.