Kubernetes Interview Questions (with real STAR answers)

A Pod is one or more containers that share a network and storage and are scheduled together. A ReplicaSet keeps a set number of identical pods running. A Deployment manages ReplicaSets and adds rolling updates and rollbacks. You normally create Deployments, not bare pods.

ClusterIP (the default) gives a stable internal IP and DNS name inside the cluster. NodePort opens the same port on every node. LoadBalancer asks the cloud provider for an external load balancer. For HTTP routing by host or path, use an Ingress with an Ingress controller in front of ClusterIP Services.

A liveness probe failing makes the kubelet restart the container. A readiness probe failing removes the pod from Service endpoints, so it gets no traffic, but does not restart it. A startup probe gives slow-starting apps time to start before the liveness probe begins.

Requests are what the scheduler reserves for the container when placing the pod. Limits are the maximum it may use. A container that uses more memory than its limit is OOMKilled; one that hits its CPU limit is throttled, not killed.

Both inject configuration as environment variables or files. Secrets are meant for sensitive data, but by default they are only base64-encoded, not encrypted. Protect them with RBAC, encryption at rest, and often an external secret manager such as Vault or AWS Secrets Manager.

Use a Deployment for stateless apps where any pod can replace another. Use a StatefulSet for apps that need a stable network identity and their own persistent storage, such as databases. Use a DaemonSet to run one pod on every node, for example log collectors or monitoring agents.

The Deployment creates a new ReplicaSet and moves pods over step by step. maxSurge sets how many extra pods can exist during the update, and maxUnavailable sets how many can be missing. Readiness probes decide when a new pod gets traffic. Use kubectl rollout status to watch and kubectl rollout undo to go back.

The HPA reads metrics, usually from metrics-server, and changes a Deployment's replica count to keep a target such as 70% CPU. CPU and memory targets are measured against requests, so the containers must have requests set. It can also scale on custom metrics through a metrics adapter.

The kube-apiserver is the front door for all changes. etcd stores the cluster state. The scheduler picks a node for each new pod. The controller manager runs the loops that keep the real state equal to the desired state. On each node, the kubelet runs pods and kube-proxy handles Service networking.

A rule that controls which traffic can reach or leave pods, selected by labels and namespaces. Without any policy, all pod traffic is allowed. It only works if the network plugin (CNI) supports it, such as Calico or Cilium. A common pattern is default-deny plus explicit allows.

A PDB sets how many pods of an app must stay available (minAvailable) or may be down (maxUnavailable) during voluntary disruptions such as node drains and cluster upgrades. It does not protect against crashes or node failures.

Taints on a node keep pods away unless the pod has a matching toleration - the node pushes pods away. nodeSelector and node affinity make a pod prefer or require certain nodes - the pod pulls itself toward nodes. To give a workload dedicated nodes, you usually use both.

Role-based access control. A Role grants permissions on resources in one namespace, and a ClusterRole grants them across the cluster. A RoleBinding or ClusterRoleBinding gives those permissions to users, groups, or ServiceAccounts. Follow least privilege and avoid giving cluster-admin to apps.

Run kubectl describe pod and read the Events. Common causes are not enough CPU or memory on any node for the requests, a taint with no matching toleration, a nodeSelector or affinity no node matches, or a PersistentVolumeClaim that is not bound. Fix the cause or add capacity.

Run kubectl describe pod for the exact error. Check the image name and tag for typos, that the tag exists in the registry, that the cluster has credentials for a private registry (imagePullSecrets or node-level config), and that nodes can reach the registry.

Expect behavioral questions (tell me about a time you...), technical questions on workloads, Services, probes, resources, scaling, and security, and troubleshooting scenarios such as CrashLoopBackOff or a Pending pod. Many companies also give a hands-on task with kubectl. The questions on this page cover all of these.

Use STAR: Situation, Task, Action, Result. Keep it concrete - a specific incident, what you owned, what you did, and the result. The answers above are all structured this way.