Kubernetes interview questions and answers

1. Why use a .dockerignore file

What is the main purpose of a .dockerignore file?

1. A.It lists base images that docker pull should never download from a registry.
2. B.It tells the running container which network ports to block at runtime.
3. C.It keeps files like .git, node_modules and .env out of the build context.
4. D.It lists Dockerfile instructions that the builder should skip during the build, such as RUN apt-get.

2. CMD vs ENTRYPOINT

An image has ENTRYPOINT ["python", "app.py"] and CMD ["--port", "8000"]. You run `docker run myimg --port 9000`. What command runs inside the container?

1. A.python app.py --port 8000 --port 9000
2. B.--port 9000 (the entrypoint is replaced)
3. C.python app.py (arguments are ignored)
4. D.python app.py --port 9000

3. What EXPOSE really does

A Dockerfile has `EXPOSE 8080`. You run the container with plain `docker run myimg` and cannot reach it on localhost:8080. Why?

1. A.EXPOSE works only when the image is pushed to a registry
2. B.EXPOSE only documents the port; you still need -p to publish it
3. C.EXPOSE opens the port only for UDP traffic by default
4. D.EXPOSE needs the container to run as root to bind

4. Reading a -p port mapping

You run `docker run -p 8081:80 nginx`. Which URL on your laptop reaches the nginx server?

1. A.http://localhost:8081
2. B.http://localhost:80
3. C.http://localhost:8080
4. D.http://localhost:8180

5. Reading a CronJob schedule

A CronJob has `schedule: "30 2 * * 1"` and no timeZone field. When does it run?

1. A.At 02:30 on the first day of every month
2. B.Every 30 minutes between 02:00 and 03:00 daily
3. C.At 30 minutes past every hour on Mondays
4. D.At 02:30 every Monday, in the controller's time zone

6. Finding which node a Pod is on

You want to see the node and Pod IP for each Pod in a namespace in one command. Which do you run?

1. A.kubectl get pods -o wide
2. B.kubectl get pods --show-labels
3. C.kubectl get nodes -o yaml
4. D.kubectl top pods

7. Docker restart policy on a VM

You run a small service with plain Docker on a VM. You want it to start again after a crash or a VM reboot, but not if you stopped it on purpose. Which restart policy fits?

1. A.--restart unless-stopped
2. B.--restart no
3. C.--restart on-failure:0
4. D.--restart never

8. Where cluster state lives

Where does Kubernetes keep the desired and current state of all objects such as Deployments and Secrets?

1. A.In etcd, through the API server
2. B.In a file on each worker node
3. C.Inside the kube-scheduler memory
4. D.In the container registry

9. Pushing an image to a registry

You built an image locally as myapp:1.4.0 and want to push it to registry.example.ae/team/myapp. What must you do before docker push?

1. A.Rebuild it with the --push-only flag set to the registry
2. B.Export it with docker save and upload the tar file by hand
3. C.Tag it with the full registry path and the same version
4. D.Rename the Dockerfile so it matches the registry name

10. Docker image vs container

What is the relationship between a Docker image and a container?

1. A.An image is a read-only template; a container is a running instance of it
2. B.A container is a compressed archive of an image used for shipping it between registries
3. C.Images run processes, while containers only store configuration files
4. D.They are two names for exactly the same thing in Docker

11. Keeping CPU near a target

You want an Auto Scaling group to add or remove instances so average CPU stays near 50 percent. Which scaling setup fits?

1. A.A target tracking scaling policy on average CPU
2. B.A scheduled action that runs every hour
3. C.Changing the desired capacity by hand when alerts fire
4. D.Moving to a larger instance type

12. Containers vs virtual machines

Why do containers usually start faster and use less overhead than VMs?

1. A.They run without any operating system underneath
2. B.They share the host kernel rather than boot their own
3. C.They always need bigger, dedicated hardware
4. D.They skip storing application code on disk

13. Managed Kubernetes on each cloud

Which list gives the managed Kubernetes service on AWS, Azure and Google Cloud?

1. A.EKS, AKS, GKE
2. B.ECS, ACI, Cloud Run
3. C.ECR, ACR, Artifact Registry
4. D.EC2, Azure VMs, Compute Engine

14. Where container images live

Your CI pipeline builds a Docker image. Where should it push the image so ECS or EKS can pull it?

1. A.An EBS volume attached to the CI server
2. B.A DynamoDB table holding image bytes
3. C.A container registry such as Amazon ECR
4. D.The application's CloudWatch log group

15. Traffic before the model has loaded

A model pod takes 60 seconds to load weights. Requests sent during that time fail. Which Kubernetes feature prevents this?

1. A.A liveness probe that restarts the pod
2. B.A larger CPU limit
3. C.A ConfigMap
4. D.A readiness probe that reports ready only after the model is loaded

16. GPU nodes show zero GPUs

A new GPU node joins the cluster, but kubectl describe node shows no nvidia.com/gpu capacity. What is most likely missing?

1. A.A larger memory limit on each pod
2. B.The NVIDIA device plugin (GPU Operator)
3. C.A faster container image registry
4. D.A second network interface

17. Training pod keeps getting evicted

A Kubernetes training job is evicted when the node is busy. Its manifest sets no resource requests. What should be added?

1. A.More replicas of the same training pod
2. B.A higher log level for the container
3. C.CPU, memory and GPU requests and limits
4. D.A shorter image name for the training job

18. Running tests in Docker

Why do many teams run their UI test suite inside a Docker container in CI?

1. A.Docker makes tests pass even when the app is broken
2. B.Docker removes the need for assertions
3. C.The container gives the same OS, browser versions and dependencies on every machine, so results are reproducible
4. D.Docker is required by all test frameworks

19. Effect of resource leveling

A project manager applies resource leveling to remove over-allocation. What can happen to the finish date?

1. A.It always moves earlier, because work is spread out
2. B.It never changes, because leveling only uses float
3. C.It is removed from the schedule until approved
4. D.It can move later, because tasks are delayed until people are free

20. What a resource calendar shows

What does a resource calendar in a scheduling tool show?

1. A.The cost of each resource per hour
2. B.The dates on which invoices are paid
3. C.The order in which tasks must happen
4. D.When each person or item is available to work

21. Readiness vs liveness probes

A service takes 40 seconds to warm its cache at startup and sometimes cannot reach its database for a few seconds. Which probe setup is most correct?

1. A.Use only a liveness probe that checks the database, so Pods restart when it is down.
2. B.Use only a readiness probe; liveness probes are deprecated.
3. C.Use a startup probe for the warm-up, a readiness probe that removes the Pod from Service endpoints when it cannot serve, and a light liveness probe that only checks the process is not stuck.
4. D.Set initialDelaySeconds to 0 on all probes so problems are found faster.

22. CPU vs memory limits

A container goes over its Kubernetes resource limits. What happens for CPU and for memory?

1. A.Both cause the container to be restarted immediately.
2. B.Going over the CPU limit causes throttling; going over the memory limit gets the container OOMKilled.
3. C.Going over the CPU limit gets it OOMKilled; going over memory causes throttling.
4. D.Nothing happens; limits are only used for scheduling.

23. Pod rejected by the restricted profile

A namespace is labelled pod-security.kubernetes.io/enforce=restricted. A Pod that runs as root with default settings is rejected. Which settings are needed to pass?

1. A.A higher PriorityClass and a memory limit on every container
2. B.An image pulled by digest instead of by tag
3. C.runAsNonRoot, no privilege escalation, drop ALL caps, RuntimeDefault seccomp
4. D.A ServiceAccount with cluster-admin rights

24. Linux capabilities for a web app

A non-root web server needs to bind to port 80 and nothing else special. What capability setting follows least privilege?

1. A.Keep the default set and add SYS_ADMIN
2. B.Drop ALL, then add only NET_BIND_SERVICE
3. C.Run with privileged: true to avoid errors
4. D.Add NET_ADMIN so it can manage sockets

25. KMS encryption for Kubernetes Secrets

You enable KMS encryption at rest for Secrets on your cluster. How does envelope encryption work in this setup?

1. A.KMS stores every Secret and etcd keeps only a link
2. B.Each Secret is base64 encoded twice before saving
3. C.A data key encrypts each Secret; KMS encrypts the data key
4. D.The API server sends Secrets to KMS on every read

26. Mounting secrets straight from a vault

You want Pods to read secrets from Azure Key Vault as files, without first creating Kubernetes Secret objects. Which component does this?

1. A.A ConfigMap that points to the Key Vault URL
2. B.The Secrets Store CSI Driver with the provider for Key Vault
3. C.An init container that runs kubectl create secret
4. D.A Helm chart value with the secret in plain text

27. Pods that never call the API

Most of your app Pods never talk to the Kubernetes API, but each has a ServiceAccount token mounted. What is the hardening step?

1. A.Set automountServiceAccountToken: false for those Pods
2. B.Give the default ServiceAccount cluster-admin rights
3. C.Delete the kube-system namespace
4. D.Mount the token as an env var instead

28. Modern ServiceAccount tokens

In current Kubernetes, how do the ServiceAccount tokens mounted into Pods differ from the old Secret-based tokens?

1. A.They expire, are bound to the Pod, and get refreshed
2. B.They never expire and are stored as Secret objects
3. C.They are shared by all of the Pods on one node
4. D.They contain the user's password in clear text form

29. What init containers guarantee

A Pod has two init containers (wait-for-db, then run-migrations) and one app container. How do they run?

1. A.Init containers run one by one to success, then the app starts
2. B.All three start together and the app waits for a signal
3. C.Init containers run after the app container exits
4. D.Init containers rerun every time the readiness probe fails

30. Declaring a native sidecar

You want a log shipper sidecar that starts before the app, keeps running alongside it, and does not block a Job from completing. In current Kubernetes, how do you declare it?

1. A.As a second entry in containers with a startup probe
2. B.As an ephemeral container added by kubectl debug
3. C.As an init container with restartPolicy: Always
4. D.As an init container with a longer timeout

31. Changed ConfigMap, old value in app

You edit a ConfigMap. The app reads one key as an environment variable and another from a mounted file (no subPath). A few minutes later, what has the running Pod seen?

1. A.The file shows the new value; the env var keeps the old one
2. B.Both show the new value right away
3. C.Neither changes until the node reboots
4. D.The env var changes; the file keeps the old one

32. Checking a ServiceAccount permission

A Pod logs "forbidden: User system:serviceaccount:jobs:runner cannot list pods". You add a Role and RoleBinding. How do you verify the permission without redeploying?

1. A.kubectl get rolebinding -n jobs -o yaml --verify-access=runner
2. B.kubectl auth can-i list pods -n jobs --as=system:serviceaccount:jobs:runner
3. C.kubectl describe serviceaccount runner -n jobs --show-permissions
4. D.kubectl auth whoami -n jobs --serviceaccount=system:serviceaccount:jobs:runner

33. Quota rejects Pods without requests

A namespace has a ResourceQuota on requests.cpu. Developers now get "must specify requests.cpu" when they deploy charts that set no resources. How can admins fix this without editing every chart?

1. A.Raise the ResourceQuota to an unlimited value
2. B.Add a PriorityClass to the namespace
3. C.Add a LimitRange that sets default requests and limits
4. D.Label the namespace to skip quota checks

34. Deleting a PVC deleted the disk

Someone deleted a PVC by mistake and the cloud disk with the data was deleted too. The StorageClass used the default settings. What setting would have kept the disk?

1. A.volumeBindingMode: Immediate on the StorageClass
2. B.accessModes: ReadOnlyMany on the PVC
3. C.reclaimPolicy: Retain on the StorageClass or PV
4. D.allowVolumeExpansion: true on the StorageClass

35. Scanning container images

A team pushes images to ECR and deploys them straight to production. What should be added to catch known vulnerable packages?

1. A.Running containers as root so they can patch themselves
2. B.Using the latest tag so images are always the newest
3. C.Image scanning in the registry and CI, blocking critical findings
4. D.Encrypting the registry with a customer managed key

36. Kubernetes access in EKS

Every developer is mapped to the system:masters group in an EKS cluster so they can debug. What is a better approach?

1. A.Use EKS access entries with namespace-scoped Kubernetes RBAC roles
2. B.Share one kubeconfig file with cluster-admin for the whole team
3. C.Give each developer AdministratorAccess in IAM instead
4. D.Disable Kubernetes RBAC so permissions are simpler to manage

37. Unknown containers on a build host

A build server shows containers you never started, running "alpine" with a mining command. netstat shows dockerd listening on 0.0.0.0:2375. What is the most likely entry point?

1. A.A developer typed a wrong password into the SSH prompt
2. B.The Alpine image is always infected with a miner by default
3. C.Port 2375 is used by antivirus updates that run containers
4. D.The Docker API was exposed with no TLS or authentication at all

38. Pod killed while loading the model

A pod has a memory limit of 2Gi. While loading a 3 GB model it restarts and kubectl describe shows "OOMKilled". What happened?

1. A.The CPU limit was too low
2. B.The readiness probe failed
3. C.The container exceeded its memory limit, so the kernel killed it
4. D.The image was too large to pull

39. Purpose of a multi-stage build

What is the main benefit of this Dockerfile pattern?

FROM python:3.12 AS build
COPY requirements.txt .
RUN pip wheel --wheel-dir /wheels -r requirements.txt

FROM python:3.12-slim
COPY --from=build /wheels /wheels
RUN pip install --no-index /wheels/*
COPY app/ /app

1. A.The final image has no compilers or build caches, so it is smaller and has less attack surface
2. B.It makes the model more accurate
3. C.It lets the container use a GPU
4. D.It removes the need for a requirements file

40. CPU pods filling GPU nodes

Ordinary CPU workloads keep landing on expensive GPU nodes, leaving no room for GPU jobs. What is the standard Kubernetes fix?

1. A.Delete the CPU workloads
2. B.Taint the GPU nodes and give only GPU workloads a matching toleration
3. C.Give every pod a GPU request
4. D.Run all workloads on one node pool

41. Autoscaling during a dependency outage

Workers autoscale on queue depth. When a downstream API went down, every job failed and was requeued, so the queue grew and workers scaled from 10 to 200, hammering the API as it tried to recover. What fixes this?

1. A.Scale on CPU instead, since it stays the same
2. B.Raise the maximum to 500 workers
3. C.Delete the queue when it passes 10,000 jobs
4. D.Back off or pause on dependency errors and cap scale

42. Container ignores SIGTERM

Pods with this image always take the full 30-second grace period to stop and are then SIGKILLed, dropping requests. What is the most likely cause?

FROM python:3.12-slim
COPY app.py .
CMD python app.py

1. A.Shell form CMD runs /bin/sh -c as PID 1, which does not forward SIGTERM to the Python process; use exec form CMD ["python", "app.py"] and handle SIGTERM in the app.
2. B.The python:3.12-slim base image blocks all signals by default.
3. C.terminationGracePeriodSeconds must be set to 0 for signals to be delivered.
4. D.Kubernetes sends SIGINT, not SIGTERM, so Python ignores it.

43. Rolling update that never finishes

A Deployment uses maxUnavailable: 0 and maxSurge: 1. The cluster has no spare capacity and no autoscaler. What happens during a rollout?

1. A.Kubernetes deletes an old Pod first to make room, then starts the new one.
2. B.The rollout finishes instantly because maxSurge is ignored when the cluster is full.
3. C.Kubernetes evicts Pods from other Deployments to make space.
4. D.The new surge Pod stays Pending, no old Pod is removed, and the rollout stalls until progressDeadlineSeconds marks it as failed.

44. Errors during every rollout

Your app handles SIGTERM correctly and stops accepting connections right away. Still, clients see a few 502 errors at every rollout. What is the most likely cause and fix?

1. A.The readiness probe period is too long; set it to 1 second and the errors disappear.
2. B.Endpoint removal reaches load balancers and kube-proxy asynchronously, so traffic still arrives after SIGTERM; add a short preStop sleep (or delay shutdown) so the Pod keeps serving until routing is updated.
3. C.Kubernetes sends SIGKILL before SIGTERM; increase terminationGracePeriodSeconds to 300.
4. D.The Service must be type LoadBalancer for graceful shutdown to work.

45. Docker cache on fresh runners

You moved to ephemeral CI runners, and Docker builds that took 2 minutes now take 12 because every layer is rebuilt. How do you keep layer caching?

1. A.Use docker build --no-cache so builds stay consistent
2. B.Turn the ephemeral runners back into long-lived ones
3. C.Export the BuildKit cache to a registry with --cache-to and reuse it
4. D.Squash the image into one layer before pushing

46. Trusted registries and digests only

You want production Pods to run only images from your registry, pinned by digest, so a tag cannot be repointed after review. What enforces this for every deploy?

1. A.A Dockerfile lint rule that checks each FROM line
2. B.An admission policy allowing only your registry and digests
3. C.A firewall rule that blocks Docker Hub on office laptops
4. D.A CI step that prints the image name before each deploy

47. Pod create rights reveal Secrets

A developer has no get or list rights on Secrets in namespace payments, but can create Pods there. Why can they still read the payments DB password Secret?

1. A.They can make a Pod that mounts the Secret and prints it
2. B.Pods inherit cluster-admin rights by default
3. C.Secrets are shown in kubectl get pods output
4. D.The scheduler sends Secret values to the Pod creator

48. Namespace stuck in Terminating

You deleted a namespace an hour ago and it still shows Terminating. Its status says some resources have finalizers remaining, and a CRD's operator was uninstalled before the namespace was deleted. What is happening?

1. A.The namespace is waiting for its ResourceQuota to reset
2. B.Kubernetes deletes namespaces only once per day
3. C.The API server is still downloading the namespace backup
4. D.Objects wait on finalizers that no controller is left to clear

49. Changing a Deployment selector

You change `spec.selector.matchLabels` from app: web to app: web-frontend in a Deployment and apply it. The API server rejects it with "field is immutable". What is the safe way forward?

1. A.Patch the selector with kubectl edit, which skips the check
2. B.Delete the ReplicaSets so the selector can be changed
3. C.Add --force-conflicts to kubectl apply
4. D.Create a new Deployment with the new selector, then remove the old one

50. Restart delay in CrashLoopBackOff

A container crashes right after starting. The kubelet restarts it with a growing delay. Under the default settings, what happens to the delay as the crashes continue?

1. A.It stays fixed at 30 seconds between every restart
2. B.It grows without limit until the Pod is deleted
3. C.It doubles from about 10 seconds and is capped at 5 minutes
4. D.It resets to zero each time the node runs low on memory

51. ConfigMap file mounted with subPath

A ConfigMap key is mounted at /etc/nginx/conf.d/app.conf using subPath, so the other files in that folder stay. After you edit the ConfigMap, the file inside the running Pod never changes. Why?

1. A.subPath mounts copy the file once and do not receive updates
2. B.ConfigMaps mounted as files never update in any form
3. C.nginx locks the file so the kubelet cannot replace it
4. D.Edits apply only to ConfigMaps in the kube-system namespace

52. Spotting a Guaranteed QoS Pod

Each Pod below has one container. Which Pod gets the Guaranteed QoS class?

1. A.requests cpu 500m / memory 512Mi, limits cpu 1 / memory 512Mi
2. B.limits cpu 500m and memory 512Mi, with no requests set
3. C.requests and limits memory 512Mi, with no CPU values set
4. D.no requests or limits, but a high PriorityClass

53. Where the next Pod can go

A Deployment uses topologySpreadConstraints on zone with maxSkew: 1 and whenUnsatisfiable: DoNotSchedule. Current matching Pods: zone-a 4, zone-b 2, zone-c 1. Which zone can take the next Pod?

1. A.zone-b or zone-c
2. B.Only zone-c
3. C.Any of the three zones
4. D.None of them, so it stays Pending

54. EKS pods cannot get IP addresses

On EKS with the default VPC CNI, new pods stay in ContainerCreating with "failed to assign an IP address to container". The node subnets are small /24s and nearly full. What is the best fix?

1. A.Use larger node instance types so each node can host more pods
2. B.Change every Service to type LoadBalancer so pods need no IPs
3. C.Delete the CoreDNS pods to free up addresses in the subnets
4. D.Add pod address space via a secondary CIDR or prefix delegation

55. Slow pods at 30% CPU

Pods on a managed Kubernetes cluster show only 30% average CPU, but latency spikes. Metrics show heavy CFS throttling. What is the likely cause?

1. A.Requests are too high, so pods cannot schedule
2. B.The node pool uses the wrong region
3. C.CPU limits are too low, so bursts are throttled
4. D.Memory limits throttle the CPU

56. Throttled but not busy

A multithreaded service in a Kubernetes pod with a CPU limit of 1 core shows only 40% average CPU usage, but p99 latency is high and the container_cpu_cfs_throttled_periods_total metric keeps rising. What is the most likely cause?

1. A.The node is out of memory and swapping
2. B.The readiness probe is failing
3. C.The CPU request is too high, so the scheduler gives it less CPU
4. D.The CFS quota is enforced per 100 ms period; bursts across many threads use up the quota early in the period and the container is paused until the next period

57. Which pods are evicted first?

A node is under memory pressure and the kubelet starts evicting pods. All pods use more memory than they request except the Guaranteed ones. Which are evicted first?

1. A.BestEffort pods with no requests or limits
2. B.Guaranteed pods because they use the most memory
3. C.The pods that were scheduled most recently
4. D.Pods in the kube-system namespace

58. Many DNS queries per lookup in pods

In a Kubernetes pod, resolv.conf has "options ndots:5" and three search domains. Calls to api.partner.com are slow, and DNS logs show several NXDOMAIN queries before the real one. Why?

1. A.ndots:5 forces five retries for every query
2. B.The pod sends each query to five different servers
3. C.Names with under 5 dots try the search domains first
4. D.ndots:5 turns off caching for external names

59. Old run cannot be rebuilt

You must reproduce a model trained 8 months ago. Its Dockerfile used "FROM python:3.10-slim", and that build of the base image is no longer the same. What should the team have done?

1. A.Used the "latest" tag so it was always kept current
2. B.Rebuilt the image weekly from the very same Dockerfile
3. C.Kept only the Dockerfile in Git and never the image
4. D.Pinned the base image digest and mirrored it internally

60. Pods killed during a load test

Under load, Java pods restart with reason OOMKilled. The container memory limit is 2 GiB, and the JVM is started with -Xmx2g. What is the problem?

1. A.The JVM needs a larger CPU limit to use memory
2. B.Heap plus off-heap memory exceeds the 2 GiB container limit
3. C.OOMKilled means the database ran out of disk
4. D.The load test sent too many cookies