50 Kubernetes Interview Questions (With Answers)

Kubernetes interviews test your understanding of container orchestration, cluster architecture, workload management, networking, storage, security, and production patterns. This guide covers the 50 most common questions — with concise answers and real examples.

Quick reference

Core architecture

1. What is Kubernetes and what problem does it solve?

Kubernetes (K8s) is an open-source container orchestration platform. It solves running containers at scale: automatic scheduling, self-healing, rolling updates, service discovery, load balancing, and secret/config management — across a cluster of machines.

2. Describe the Kubernetes control plane components.

3. What runs on each worker node?

4. What is a Pod?

The smallest deployable unit. One or more tightly coupled containers that share:

• Network namespace (same IP, port space)
• Storage volumes
• Lifecycle

apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
    - name: nginx
      image: nginx:alpine
      ports:
        - containerPort: 80

5. What is the role of etcd in Kubernetes?

etcd stores the entire cluster state — all objects (pods, services, secrets, configmaps). It uses the Raft consensus algorithm for distributed consistency. If etcd goes down, the cluster cannot be updated (but existing workloads keep running). Back up etcd regularly.

# Backup etcd
ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-$(date +%F).db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/etcd/ca.crt \
  --cert=/etc/etcd/server.crt \
  --key=/etc/etcd/server.key

Workloads

6. Deployment vs StatefulSet vs DaemonSet — when to use which?

7. What is a ReplicaSet?

Ensures a specified number of pod replicas are running at all times. Deployments manage ReplicaSets — you rarely create ReplicaSets directly.

kubectl get replicasets
kubectl describe rs my-deployment-6d8f4b5d9

8. How does a Deployment rolling update work?

spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1        # extra pods above desired count
      maxUnavailable: 0  # zero downtime

Kubernetes creates a new ReplicaSet, scales it up gradually, and scales down the old one. maxSurge: 1, maxUnavailable: 0 gives zero-downtime deploys.

kubectl rollout status deployment/my-app
kubectl rollout undo deployment/my-app     # rollback
kubectl rollout history deployment/my-app  # history

9. Liveness vs Readiness vs Startup probes?

livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
  initialDelaySeconds: 10
  periodSeconds: 5

readinessProbe:
  httpGet:
    path: /ready
    port: 8080
  periodSeconds: 5

startupProbe:
  httpGet:
    path: /healthz
    port: 8080
  failureThreshold: 30   # 30 × 10s = 5 min max startup time
  periodSeconds: 10

10. What is a StatefulSet and when should you use it?

StatefulSets provide:

• Stable network identity: pod-0, pod-1, pod-2 (predictable DNS)
• Stable storage: each pod gets its own PVC that survives rescheduling
• Ordered deployment/scaling: starts pod-0 before pod-1

Use for: Databases (MySQL, PostgreSQL, MongoDB), message brokers (Kafka), distributed caches (Redis Cluster).

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  serviceName: "mysql"
  replicas: 3
  template:
    spec:
      containers:
        - name: mysql
          image: mysql:8
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 10Gi

Services & networking

11. What are the Service types in Kubernetes?

12. How does Kubernetes Service discovery work?

Every Service gets a DNS entry: <service-name>.<namespace>.svc.cluster.local

# From inside a pod:
curl http://my-service                          # same namespace
curl http://my-service.other-ns                 # cross-namespace
curl http://my-service.other-ns.svc.cluster.local  # FQDN

kube-proxy maintains iptables/IPVS rules to route traffic from the Service's ClusterIP to the actual pod IPs.

13. What is an Ingress?

An API object that manages external HTTP/HTTPS access to Services, typically providing:

• URL-based routing (/api → service-a, /web → service-b)
• TLS termination
• Host-based routing (api.example.com vs app.example.com)

Requires an Ingress Controller (nginx-ingress, Traefik, AWS ALB Ingress) to be installed.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  tls:
    - hosts: [api.example.com]
      secretName: tls-secret
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /v1
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 80

14. What is a NetworkPolicy?

Controls which pods can communicate with each other. Default: all pods can talk to all pods. NetworkPolicies are additive — they whitelist traffic.

# Only allow pods with label app=frontend to reach app=backend on port 8080
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - port: 8080

15. How does DNS resolution work for headless Services?

Set clusterIP: None for a headless Service. DNS returns individual pod IPs (A records) instead of a single ClusterIP. Used with StatefulSets so each pod is individually addressable: pod-0.my-service.default.svc.cluster.local.

Storage

16. PersistentVolume vs PersistentVolumeClaim?

# PVC
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 5Gi
  storageClassName: fast-ssd

17. What are the access modes for PersistentVolumes?

18. What is a StorageClass?

Defines how storage is dynamically provisioned. Parameters differ per provider:

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
provisioner: ebs.csi.aws.com
parameters:
  type: gp3
  iops: "3000"
reclaimPolicy: Delete        # or Retain
volumeBindingMode: WaitForFirstConsumer

19. What happens to a PV when a PVC is deleted?

Depends on the reclaimPolicy:

Configuration & secrets

20. ConfigMap vs Secret?

# ConfigMap
kubectl create configmap app-config --from-literal=LOG_LEVEL=info

# Secret
kubectl create secret generic db-secret \
  --from-literal=password=s3cr3t

# Use in pod
envFrom:
  - configMapRef:
      name: app-config
  - secretRef:
      name: db-secret

21. How do you avoid hardcoding secrets in Kubernetes?

1. Use external secret managers (AWS Secrets Manager, HashiCorp Vault) with CSI Secrets Store driver
2. Use Sealed Secrets (encrypted K8s secrets committed to git)
3. Never store raw Secret manifests in git — use SOPS encryption or External Secrets Operator

RBAC & security

22. Explain RBAC in Kubernetes.

Role-Based Access Control controls who can do what to which resources.

Subjects: Users, Groups, ServiceAccounts.

# Role: read pods in default namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
---
# RoleBinding: give the role to a ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
  - kind: ServiceAccount
    name: my-service-account
    namespace: default
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

23. What is a ServiceAccount?

An identity for processes running in pods. Pods use ServiceAccounts to authenticate with the Kubernetes API server.

spec:
  serviceAccountName: my-service-account
  automountServiceAccountToken: false  # disable if not needed

24. What security contexts can you set on a pod/container?

spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
  containers:
    - name: app
      securityContext:
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        capabilities:
          drop: [ALL]

25. What are Pod Security Standards?

Replaced PodSecurityPolicies in K8s 1.25. Three profiles enforced via namespace labels:

kubectl label namespace production pod-security.kubernetes.io/enforce=restricted

Scaling & scheduling

26. How does the Horizontal Pod Autoscaler work?

HPA monitors metrics (default: CPU utilisation) and adjusts replica count:

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: my-app-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-app
  minReplicas: 2
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: AverageValue
          averageValue: 500Mi

27. What are resource requests and limits?

resources:
  requests:
    cpu: "250m"      # 0.25 core — used for scheduling
    memory: "256Mi"
  limits:
    cpu: "1"         # throttled if exceeded
    memory: "512Mi"  # OOMKilled if exceeded

• Requests: minimum guaranteed; scheduler uses this for placement
• Limits: maximum allowed; CPU throttled, memory OOMKilled

28. What are taints and tolerations?

Taints on nodes repel pods. Tolerations on pods allow them to be scheduled on tainted nodes.

# Taint a node (only GPU workloads allowed)
kubectl taint nodes gpu-node-1 dedicated=gpu:NoSchedule

# Toleration in pod spec
tolerations:
  - key: dedicated
    operator: Equal
    value: gpu
    effect: NoSchedule

Effects: NoSchedule (don't place), PreferNoSchedule (avoid), NoExecute (evict existing pods).

29. What is node affinity vs nodeSelector?

# nodeSelector (simple, legacy)
nodeSelector:
  disktype: ssd

# nodeAffinity (flexible expressions)
affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
        - matchExpressions:
            - key: disktype
              operator: In
              values: [ssd, nvme]
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        preference:
          matchExpressions:
            - key: zone
              operator: In
              values: [us-east-1a]

30. What is pod anti-affinity? Give a use case.

Spreads pods across nodes/zones to avoid single points of failure:

affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchLabels:
            app: my-app
        topologyKey: kubernetes.io/hostname  # one pod per node

Use case: Ensure no two replicas of a web server land on the same node.

Networking deep-dive

31. What is the CNI (Container Network Interface)?

A plugin interface for pod networking. Popular CNI plugins:

32. How does kube-proxy route traffic?

Three modes:

1. iptables (default): Rules for each Service/endpoint. Scalability issues at thousands of Services.
2. IPVS: Kernel load balancer, O(1) lookup, better for large clusters.
3. eBPF (Cilium): Bypasses iptables entirely.

33. What is a Service mesh? When would you use one?

A service mesh (Istio, Linkerd) adds a sidecar proxy to each pod:

• Mutual TLS (mTLS) between services
• Traffic management (canary, circuit breaking, retries)
• Observability (traces, metrics per service pair)

Use when you need fine-grained traffic control and security beyond what K8s provides natively.

Helm

34. What is Helm?

Kubernetes package manager. A chart is a package of K8s manifests with templating. A release is an installed chart instance.

helm repo add bitnami https://charts.bitnami.com/bitnami
helm install my-postgres bitnami/postgresql \
  --set auth.postgresPassword=secret \
  --namespace db \
  --create-namespace

helm upgrade my-postgres bitnami/postgresql --set image.tag=15
helm rollback my-postgres 1
helm uninstall my-postgres

35. What is a Helm chart structure?

my-chart/
├── Chart.yaml          # metadata (name, version, appVersion)
├── values.yaml         # default values
├── templates/
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── _helpers.tpl    # reusable template snippets
│   └── NOTES.txt       # post-install instructions
└── charts/             # subcharts (dependencies)

36. What are Helm hooks?

Run jobs at specific points in the release lifecycle:

annotations:
  "helm.sh/hook": pre-install    # also: post-install, pre-upgrade, post-upgrade, pre-delete
  "helm.sh/hook-weight": "5"
  "helm.sh/hook-delete-policy": hook-succeeded

Common use: database migration Job before pre-upgrade.

Observability & debugging

37. How do you debug a pod that won't start?

# Step 1: describe for events
kubectl describe pod <pod-name>

# Step 2: logs (including previous crashed container)
kubectl logs <pod-name> --previous
kubectl logs <pod-name> -c <container-name>

# Step 3: exec into a running container
kubectl exec -it <pod-name> -- /bin/sh

# Step 4: run a debug container (K8s 1.23+)
kubectl debug -it <pod-name> --image=busybox --target=<container>

# Step 5: check node events
kubectl get events --sort-by='.lastTimestamp' -n <namespace>

38. What does CrashLoopBackOff mean?

Container starts, crashes, K8s restarts it, crashes again. K8s adds exponential backoff (10s → 20s → 40s → ... → 5 min).

Causes: application error on startup, missing environment variable, OOMKilled, bad liveness probe configuration.

39. How do you check resource usage?

kubectl top nodes          # node CPU/memory
kubectl top pods           # pod CPU/memory
kubectl top pods --containers  # per container

# For detailed metrics
kubectl describe node <node-name>  # see Allocated resources section

40. What is the difference between kubectl apply and kubectl create?

Always use apply in automation.

Advanced topics

41. What is a Custom Resource Definition (CRD)?

Extends the Kubernetes API with custom resource types. Used by operators to manage complex applications.

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: databases.mycompany.io
spec:
  group: mycompany.io
  versions:
    - name: v1
      served: true
      storage: true
  scope: Namespaced
  names:
    plural: databases
    singular: database
    kind: Database

An Operator is a controller that watches CRDs and acts on them (e.g., Prometheus Operator, cert-manager).

42. What is the Operator pattern?

Operators encode operational knowledge as code:

1. Define CRDs (e.g., PostgresCluster)
2. Write a controller that watches those CRDs
3. Controller reconciles desired state vs actual state

Examples: cert-manager (certificates), Strimzi (Kafka), Zalando Postgres Operator.

43. What is a namespace and why use it?

Namespaces provide logical isolation within a cluster:

• Resource quotas per team/environment
• RBAC scoped to namespace
• Network policies per namespace
• Names only need to be unique within a namespace

kubectl create namespace staging
kubectl get all -n staging
kubectl config set-context --current --namespace=staging

44. What are Resource Quotas and LimitRanges?

# ResourceQuota: limits total resources in a namespace
apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-quota
  namespace: team-a
spec:
  hard:
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    pods: "50"
---
# LimitRange: sets default/min/max per pod/container
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
spec:
  limits:
    - type: Container
      default:
        cpu: "500m"
        memory: "256Mi"
      defaultRequest:
        cpu: "100m"
        memory: "128Mi"

45. How do rolling deployments differ from blue-green and canary?

# Canary with Argo Rollouts
kubectl argo rollouts set image my-app app=myimage:v2
kubectl argo rollouts promote my-app

46. What is the difference between kubectl exec and kubectl debug?

# exec: runs a command in an existing container
kubectl exec -it my-pod -- /bin/sh

# debug: attaches an ephemeral debug container (doesn't modify original)
kubectl debug -it my-pod --image=nicolaka/netshoot --share-processes

Use debug when the app container has no shell or debug tools.

47. What are Init Containers?

Run to completion before app containers start. Common uses: wait for a dependency, run DB migrations, download config.

initContainers:
  - name: wait-for-db
    image: busybox
    command: ['sh', '-c', 'until nc -z mysql-service 3306; do sleep 2; done']
  - name: run-migrations
    image: my-app:latest
    command: ['python', 'manage.py', 'migrate']
    envFrom:
      - secretRef:
          name: db-secret

48. How does Kubernetes handle pod eviction?

When a node runs out of resources, kubelet evicts pods based on QoS class:

Always set requests = limits for critical workloads to achieve Guaranteed QoS.

49. What is the difference between Kubernetes versions and how do you upgrade?

Kubernetes releases 3 minor versions per year. Support window: current + 2 previous minors.

# Check current version
kubectl version

# Upgrade (kubeadm)
kubeadm upgrade plan
kubeadm upgrade apply v1.31.0

# Drain node before upgrading kubelet
kubectl drain node-1 --ignore-daemonsets --delete-emptydir-data
# upgrade kubelet + kubectl on the node
kubectl uncordon node-1

50. What is GitOps and how does it work with Kubernetes?

GitOps stores Kubernetes manifests in Git as the source of truth. A controller (ArgoCD, Flux) continuously syncs the cluster to match Git.

Git repo (desired state)
        ↓ (ArgoCD watches)
Kubernetes cluster (actual state)
        ↓ (drift detected → reconcile)

Benefits: audit trail, rollback = git revert, PR-based change process, no kubectl apply in CI.

Common mistakes

Kubernetes vs Docker Swarm vs Nomad

Frequently asked questions

Q: How many nodes should a production cluster have? At minimum 3 control plane nodes (HA etcd quorum) + 3+ worker nodes. Size workers to your workloads; use node pools for different workload types (general, GPU, high-memory).

Q: What is the difference between kubectl delete pod and the pod crashing? kubectl delete pod sends SIGTERM to containers (graceful), waits terminationGracePeriodSeconds (default 30s), then SIGKILL. A crash (OOMKill, application error) kills the container immediately and the kubelet restarts it (not a new pod — same pod, incremented restart count).

Q: How do you zero-downtime deploy with a single pod? You can't — always run ≥ 2 replicas with maxUnavailable: 0 and proper readiness probes. A single pod will have downtime during any update or node drain.

Q: What is KEDA? Kubernetes Event-Driven Autoscaling. Extends HPA to scale on external metrics: queue length (SQS, RabbitMQ, Kafka), cron schedules, Prometheus metrics, database query results. Can scale to zero.

Q: How does cert-manager work? cert-manager is an operator that automates TLS certificate lifecycle. It watches Certificate CRDs, requests certs from ACME (Let's Encrypt), Vault, or other issuers, stores them as Secrets, and renews before expiry.

Q: What is Pod Disruption Budget? Guarantees minimum available pods during voluntary disruptions (node drain, cluster upgrade):

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: my-app-pdb
spec:
  minAvailable: 2   # or maxUnavailable: 1
  selector:
    matchLabels:
      app: my-app