Kubernetes interviews move from vocabulary (pod, deployment, service) to operations (what happens when a pod crashes, how you debug a stuck rollout) and design (how you'd run an app safely). Interviewers like commands and symptoms, so practice saying what you'd actually type and what you'd expect to see.
Below are 26 questions with answers, grouped by topic. Replace the examples with your own cluster experience where you can.
Architecture and objects
1. What is Kubernetes?
An open source system for running and managing containers across a cluster of machines. You declare the state you want, such as three copies of a service, and Kubernetes keeps working to match it.
2. What are the main components of a cluster?
The control plane has the API server (the front door), etcd (the data store), the scheduler (which picks a node for each pod), and the controller manager (which runs control loops). Each worker node runs the kubelet (which runs pods), a container runtime, and kube-proxy (which handles service networking).
3. What is a pod?
The smallest deployable unit. It holds one or more containers that share a network namespace and storage. Most pods have one main container, and extra containers are sidecars or init containers.
4. What is the difference between a Deployment, a ReplicaSet, and a StatefulSet?
A ReplicaSet keeps a number of identical pods running. A Deployment manages ReplicaSets and gives you rolling updates and rollbacks. A StatefulSet is for stateful apps: pods get stable names, stable storage, and ordered start and stop.
5. What is a DaemonSet? A Job? A CronJob?
A DaemonSet runs one pod per node, for agents such as log collectors. A Job runs a task to completion. A CronJob runs Jobs on a schedule.
6. What are labels, selectors, and annotations?
Labels are key-value pairs on objects, and selectors pick objects by label. Services find pods this way, and Deployments find their ReplicaSets. Annotations also hold key-value data, but they're for non-identifying metadata used by tools.
7. What is a namespace?
A way to divide a cluster into virtual groups, usually by team or environment. Namespaces scope names, and you can apply resource quotas and access rules per namespace. They're not a strong security boundary on their own.
Networking
8. What are the Service types?
| Type | What it does |
|---|---|
| ClusterIP | A stable internal IP, reachable only inside the cluster (default) |
| NodePort | Opens a port on every node |
| LoadBalancer | Creates an external load balancer, via the cloud provider |
| ExternalName | Maps the service to a DNS name |
9. What is an Ingress?
An object that routes external HTTP and HTTPS traffic to services by host and path, with an ingress controller doing the work. The newer Gateway API is a more expressive successor.
10. How do pods find each other?
Through Services and cluster DNS. A service named api in namespace shop is reachable as api.shop.svc.cluster.local, or just api from inside the same namespace.
11. What is a NetworkPolicy?
A rule set controlling which pods can talk to which. By default all pods can reach each other. With policies (and a network plugin that enforces them), you can restrict traffic, for example allowing only the API pods to reach the database.
Configuration and storage
12. What's the difference between a ConfigMap and a Secret?
Both hold configuration injected as environment variables or files. Secrets are meant for sensitive data, but by default they're only base64-encoded, not encrypted. Turn on encryption at rest, restrict access with RBAC, and consider an external secrets manager.
13. What are PersistentVolumes and PersistentVolumeClaims?
A PersistentVolume is a piece of storage in the cluster. A PersistentVolumeClaim is a pod's request for storage. A StorageClass lets Kubernetes provision volumes automatically. Data in a normal container filesystem disappears when the pod is replaced.
14. What are requests and limits?
Requests are the resources the scheduler reserves for a container. Limits are the maximum it can use. Exceeding a memory limit gets the container killed (OOMKilled), while exceeding a CPU limit causes throttling.
Reliability and updates
15. What are liveness, readiness, and startup probes?
Liveness checks whether the container should be restarted. Readiness checks whether it should receive traffic. Startup gives slow-starting apps time before the other probes begin. A common mistake is a liveness probe that depends on a database, which can restart every pod when the database is down.
16. How does a rolling update work?
The Deployment creates new pods and removes old ones gradually, controlled by maxSurge and maxUnavailable. Readiness probes decide when a new pod counts as ready. If it goes wrong, kubectl rollout undo goes back to the previous revision.
17. How does autoscaling work?
The Horizontal Pod Autoscaler changes the number of pods based on metrics such as CPU. The Vertical Pod Autoscaler adjusts requests and limits. The cluster autoscaler adds or removes nodes when pods can't be scheduled or nodes are underused.
18. How do you keep an app available during node maintenance?
Run several replicas, spread them across nodes or zones, and set a PodDisruptionBudget so voluntary evictions keep a minimum number running. Drain nodes with kubectl drain.
Troubleshooting
19. A pod is in CrashLoopBackOff. What do you do?
The container starts and then exits repeatedly. Run kubectl logs <pod> --previous to see why it failed, kubectl describe pod for events, exit codes, and probe failures, and check configuration, missing secrets, and resource limits.
20. A pod is stuck in Pending. What do you check?
kubectl describe pod shows why the scheduler couldn't place it: not enough CPU or memory on any node, node selectors or taints that don't match, or an unbound volume claim.
21. A pod is OOMKilled. What do you do?
It exceeded its memory limit. Check the usage trend, find whether there's a leak or the limit is just too low, and raise the limit or fix the app. Set requests close to real usage so scheduling is realistic.
22. A service isn't reachable. How do you debug it?
- Check the pods are running and ready.
- Check the service's selector matches the pod labels (kubectl get endpoints).
- Test from inside the cluster with a temporary pod.
- Check the port, the target port, and the container's listening address.
- Check network policies, then the ingress and DNS.
Security and operations
23. How does RBAC work?
Roles define permissions on resources, and bindings grant them to users, groups, or service accounts. Use namespaced Roles when possible, avoid cluster-admin, and give each workload its own service account with the least permissions it needs.
24. How do you secure a cluster?
Use RBAC with least privilege, restrict API access, scan images, run containers as non-root with a read-only filesystem where possible, apply network policies, encrypt secrets, keep Kubernetes updated, and audit activity.
25. What is Helm?
A package manager for Kubernetes. A chart is a set of templated manifests, and a release is an installed instance with its own values. It helps you reuse and version deployments across environments. Kustomize is another approach that patches plain manifests.
26. How would you deploy a web app to Kubernetes safely?
"A Deployment with at least three replicas spread across zones, requests and limits set, readiness and liveness probes, a Service and an Ingress with TLS, config in ConfigMaps and Secrets, an HPA, and a PodDisruptionBudget. Deploy through a pipeline with rolling updates and an easy rollback, and watch error rate and latency during the rollout."
Commands to know
| Task | Command |
|---|---|
| List pods | kubectl get pods -n <namespace> |
| Pod details and events | kubectl describe pod <pod> |
| Logs | kubectl logs <pod> -c <container> (add --previous after a crash) |
| Shell in a pod | kubectl exec -it <pod> -- sh |
| Roll back | kubectl rollout undo deployment/<name> |
| Scale | kubectl scale deployment/<name> --replicas=5 |
| Apply a manifest | kubectl apply -f file.yaml |
How to prepare
Run a small cluster locally with kind or minikube and break things on purpose: a bad image tag, a failing probe, a memory limit that's too low. Practice reading the output of describe and logs. Prepare one real incident you handled and what you changed afterward. For design practice, see our system design guide, and for cloud topics the AWS interview guide.
Say your debugging steps out loud, because interviewers care about your order of checks. A mock interview with a transcript will show where you skipped a step. Follow the employer's rules on AI tools in any live interview.
Practice Kubernetes interview answers with YesToTheOffer
Run a mock technical interview, talk through your debugging steps, and review your transcript afterward. 30 free minutes, no subscription.
