DevOps Engineer
Kubernetes and containers questions
154 questions on Kubernetes and containers for devops engineers, easiest first.
Easy 39
- Ordering Dockerfile steps for cachingeasy
- Image vs containereasy
- Smallest unit in Kuberneteseasy
- Why use a .dockerignore fileeasy
- Container exits right after starteasy
- Deployment and ReplicaSeteasy
- Logs from a crashed containereasy
- Are Kubernetes Secrets encryptedeasy
- What namespaces isolateeasy
- Helm values precedenceeasy
- ENV password in a Dockerfileeasy
- Starting from default denyeasy
- Passwords in a Helm values fileeasy
- CMD vs ENTRYPOINTeasy
- What EXPOSE really doeseasy
- Reading a -p port mappingeasy
- Keeping database data across restartseasy
- kubectl apply vs kubectl createeasy
- What a ConfigMap is foreasy
- Running a log agent on every nodeeasy
- Reading a CronJob scheduleeasy
- Finding which node a Pod is oneasy
- How a Service finds its Podseasy
- Calling a Service in another namespaceeasy
- Reaching a Pod from your laptopeasy
- Helm chart vs releaseeasy
- Using :latest in a Deploymenteasy
- Rolling back a bad Deploymenteasy
- Seeing why a Pod is not startingeasy
- Running a command inside a Podeasy
- Docker restart policy on a VMeasy
- Local app with a database and cacheeasy
- What the scheduler doeseasy
- What the kubelet doeseasy
- Where cluster state liveseasy
- Switching between clusterseasy
- Including Postgres in your charteasy
- Pushing an image to a registryeasy
- Job Pod shows Completedeasy
Medium 66
- Readiness vs liveness probesmedium
- Why use multi-stage buildsmedium
- Kubernetes Service typesmedium
- CPU vs memory limitsmedium
- ImagePullBackOff from a private registrymedium
- Pod stuck Pending on CPUmedium
- Exit code 137medium
- HPA shows unknown targetsmedium
- NetworkPolicy has no effectmedium
- Node drain hangs forevermedium
- Argo CD app always OutOfSyncmedium
- Helm says another operation is in progressmedium
- Running containers as non-rootmedium
- Cloud access from Podsmedium
- Choosing an image tag in CImedium
- Pod rejected by the restricted profilemedium
- Why use a read-only root filesystemmedium
- Linux capabilities for a web appmedium
- Risk of privileged: truemedium
- What External Secrets Operator doesmedium
- KMS encryption for Kubernetes Secretsmedium
- RBAC that leaks every Secretmedium
- Private registry token during buildmedium
- Blocking :latest at the clustermedium
- Cloud access without key filesmedium
- Mounting secrets straight from a vaultmedium
- Pods that never call the APImedium
- Modern ServiceAccount tokensmedium
- Who can read etcdmedium
- Who read a Kubernetes Secretmedium
- How many more Pods fit on a nodemedium
- Pods during a 25 percent rolloutmedium
- Why use Ingress for many appsmedium
- Ingress created but nothing happensmedium
- Service with zero endpointsmedium
- PVC Pending: waiting for first consumermedium
- What init containers guaranteemedium
- Declaring a native sidecarmedium
- Changed ConfigMap, old value in appmedium
- RoleBinding pointing to a ClusterRolemedium
- Checking a ServiceAccount permissionmedium
- NoSchedule vs NoExecute taintsmedium
- Required vs preferred node affinitymedium
- Keeping replicas on separate nodesmedium
- Undoing a Helm upgrademedium
- Stale packages from layer cachemedium
- COPY or ADD in a Dockerfilemedium
- Debugging a container with no shellmedium
- Drain refuses because of DaemonSetsmedium
- Quota rejects Pods without requestsmedium
- Per-environment changes with Kustomizemedium
- Slow Python builds on Alpinemedium
- Build ARG missing at runtimemedium
- Dockerfile HEALTHCHECK on Kubernetesmedium
- Routing rules in Gateway APImedium
- Deleting a PVC deleted the diskmedium
- Multi-Attach error on a second Podmedium
- Giving the app its own Pod namemedium
- kubectl top gives an errormedium
- Overlapping CronJob runsmedium
- Stopping a Job that keeps failingmedium
- Docker images after dockershim removalmedium
- How rollout restart worksmedium
- Events gone the next morningmedium
- Making CI wait for the rolloutmedium
- Looking up a field without the docs sitemedium
Hard 49
- Container ignores SIGTERMhard
- Rolling update that never finisheshard
- Hotfix keeps disappearinghard
- Errors during every rollouthard
- Throttled at 30 percent CPUhard
- Slow external DNS in Podshard
- StatefulSet Pod pending after node replacementhard
- Java Pod OOMKilled with free heaphard
- Only deploy images built by CIhard
- Policy webhook takes down deployshard
- Running workloads on spothard
- All replicas landed in one zonehard
- Deleted secret still in the imagehard
- Same commit, different build resulthard
- Docker cache on fresh runnershard
- Secrets as env vars vs fileshard
- Running customer code in containershard
- Trusted registries and digests onlyhard
- Rotating the Secrets encryption keyhard
- Pod create rights reveal Secretshard
- Pods stealing the node cloud rolehard
- Limiting where Pods can connecthard
- Cluster and workloads in one applyhard
- HPA replica calculationhard
- Memory HPA never scales downhard
- VPA and HPA fightinghard
- Node never removed by the autoscalerhard
- Backing up a self-managed control planehard
- Canary with StatefulSet partitionhard
- Reaching one StatefulSet replicahard
- externalTrafficPolicy: Local trade-offhard
- OOMKilled by a scratch directoryhard
- Evicted for ephemeral storagehard
- Critical Pod cannot schedule on a full clusterhard
- Namespace stuck in Terminatinghard
- Changing a Deployment selectorhard
- Restart delay in CrashLoopBackOffhard
- ConfigMap file mounted with subPathhard
- Spotting a Guaranteed QoS Podhard
- Effective CPU request with init containershard
- Failed pre-upgrade migration hookhard
- Manifests fail after a cluster upgradehard
- Order of a cluster upgradehard
- Scale-out slowed by image pullshard
- Annotation too long on applyhard
- Config change does not roll Podshard
- Where the next Pod can gohard
- StatefulSet Pod stuck on a dead nodehard
- CronJob stops after controller downtimehard