The short answer: Kubernetes interviews start with architecture and core objects (Pods, Deployments, Services, ConfigMaps, Secrets), move to operations (probes, resources, autoscaling, scheduling, storage, security), and for experienced roles end with troubleshooting scenarios and design questions: “a Pod is stuck in CrashLoopBackOff, what do you do?” or “how would you upgrade a production cluster?” Explain the why behind each concept, and know the kubectl commands you’d actually run.
Architecture questions
“Explain Kubernetes architecture.”
The Kubernetes documentation describes a cluster as “a control plane and one or more worker nodes”:
-
Control plane: the kube-apiserver (exposes the Kubernetes API; everything talks to it), etcd (a consistent, highly available key-value store for cluster data), the kube-scheduler (assigns Pods to nodes), the kube-controller-manager (runs controllers that move actual state toward desired state), and optionally a cloud-controller-manager.
-
Nodes: the kubelet (makes sure containers in Pods are running), kube-proxy (network rules for Services, in many setups), and a container runtime (such as containerd).
-
“What does declarative mean in Kubernetes?” You describe the desired state in manifests; controllers continuously reconcile the actual state to match it.
Workload questions
- “What is a Pod?” The smallest deployable unit: one or more containers that share networking and storage and are scheduled together.
- “What is a Deployment?” The docs describe a Deployment as providing “declarative updates for Pods and ReplicaSets”: you describe a desired state, and the Deployment controller changes the actual state to it at a controlled rate. It’s the usual choice for stateless apps.
- “How do rolling updates and rollbacks work?” A Deployment gradually replaces old Pods with new ones (controlled by
maxSurgeandmaxUnavailable);kubectl rollout statuswatches it andkubectl rollout undorolls back. - “When would you use a StatefulSet?” For stateful apps needing stable network identities and persistent storage per replica, such as databases.
- “DaemonSet vs Deployment?” A DaemonSet runs one Pod per node (for example, log collectors or monitoring agents).
- “Job vs CronJob?” A Job runs Pods to completion; a CronJob runs Jobs on a schedule.
Networking questions
- “What is a Service, and what types are there?” A stable virtual IP and DNS name in front of a set of Pods selected by labels. ClusterIP (internal only), NodePort (a port on every node), LoadBalancer (an external load balancer from the cloud provider), and ExternalName (DNS alias).
- “Ingress vs Service?” Ingress (and the newer Gateway API) routes external HTTP/HTTPS traffic to Services by host and path, handled by a controller.
- “What is a NetworkPolicy?” Rules controlling which Pods can talk to each other and to external endpoints; by default, Pods can typically talk to any other Pod, so policies are key for security (if the network plugin supports them).
Configuration and storage questions
- “ConfigMap vs Secret?” Both inject configuration into Pods (as environment variables or files); Secrets hold sensitive data. Secrets are base64-encoded, not encrypted, by default, so enable encryption at rest and restrict access, or use an external secrets manager.
- “Explain PV, PVC and StorageClass.” A PersistentVolume is storage in the cluster; a PersistentVolumeClaim is a request for storage by a Pod; a StorageClass defines types of storage and enables dynamic provisioning.
Health and resource questions
- “Liveness vs readiness vs startup probes?” Liveness restarts a container that’s stuck; readiness removes a Pod from Service endpoints until it can serve traffic; startup gives slow-starting apps time before other probes begin.
- “What are requests and limits?” Requests are what the scheduler reserves for a container; limits cap usage. Exceeding a memory limit gets the container killed (OOMKilled); exceeding a CPU limit throttles it. Requests and limits together determine a Pod’s QoS class.
- “How does autoscaling work?” The Horizontal Pod Autoscaler scales replicas based on metrics such as CPU or custom metrics; the Vertical Pod Autoscaler adjusts requests; a cluster autoscaler adds or removes nodes.
Scheduling questions
- “What are taints and tolerations?” Taints on nodes repel Pods unless the Pods have matching tolerations, for example to reserve GPU nodes.
- “Node affinity and Pod anti-affinity?” Affinity attracts Pods to nodes with certain labels; anti-affinity spreads replicas across nodes or zones for availability.
Security questions
- “How does RBAC work?” Roles (namespaced) and ClusterRoles define permissions; RoleBindings and ClusterRoleBindings grant them to users, groups or ServiceAccounts. Follow least privilege.
- “How do you secure workloads?” Pod Security Standards (no privileged containers, run as non-root), image scanning and signing, NetworkPolicies, Secrets encryption, audit logging and admission policies. See our DevSecOps interview questions.
Tooling questions
- “What is Helm?” A package manager for Kubernetes that templates manifests into charts with configurable values and manages releases.
- “What is GitOps?” Using Git as the source of truth for cluster state, with a controller (such as Argo CD or Flux) syncing the cluster to the repository.
Troubleshooting scenarios
“A Pod is in CrashLoopBackOff. What do you do?”
“The container starts and keeps exiting. I’d run kubectl describe pod to see events and the exit code, then kubectl logs <pod> --previous to read the logs from the crashed container. Common causes are a bad config or missing environment variable, a failing dependency, a wrong command, or a liveness probe that’s too aggressive. I’d fix the cause, not just restart it.”
| Symptom | Likely causes | First commands |
|---|---|---|
| Pending | Not enough CPU or memory, node selectors or taints, unbound PVC | kubectl describe pod, kubectl get nodes, kubectl get pvc |
| ImagePullBackOff | Wrong image name or tag, missing registry credentials | kubectl describe pod (events) |
| OOMKilled | Memory limit too low or a memory leak | kubectl describe pod, check metrics, adjust limits |
| Service not reachable | Selector doesn’t match Pod labels, wrong port, NetworkPolicy, Pod not ready | kubectl get endpoints, kubectl describe svc, test from a debug Pod |
| Node NotReady | Kubelet down, disk or memory pressure, network | kubectl describe node, node logs |
Questions for experienced engineers
- “How would you upgrade a production cluster?” Read the release notes and deprecated APIs, test in staging, upgrade the control plane first, then node pools gradually (cordon, drain, replace), with PodDisruptionBudgets protecting availability and a rollback plan.
- “How do you run multi-tenant clusters?” Namespaces, RBAC, resource quotas and limit ranges, NetworkPolicies and, for strong isolation, separate clusters.
- “How do you control Kubernetes costs?” Right-size requests, use autoscaling, bin-pack nodes, use spot instances for tolerant workloads, and allocate costs by namespace or label. See our FinOps interview questions.
- “How do you design for high availability?” Multiple replicas spread across zones with anti-affinity, PodDisruptionBudgets, readiness probes, and a highly available control plane.
Behavioral questions
- “Tell me about a production incident involving Kubernetes. What did you learn?”
- “Tell me about a migration to Kubernetes you worked on.”
- “How have you helped developers use the platform well?”
Use the STAR method.
Related guides: DevOps engineer interview questions, site reliability engineer interview questions, Unix and Linux interview questions and MLOps engineer interview questions.
Frequently asked questions
What Kubernetes questions are asked in interviews?
What are the main Kubernetes control plane components?
How do you troubleshoot a Pod in CrashLoopBackOff?
What is the difference between liveness and readiness probes?
Are Kubernetes Secrets encrypted?
Sources
- Kubernetes documentation, Kubernetes Components. Read on 2 October 2026.
- Kubernetes documentation, Deployments. Read on 2 October 2026.
