Kubernetes Orchestration Practice Exam

Question 1 Kubernetes Orchestration

What is the kubelet configuration?

A LoadBalancer Service provisions an external load balancer from the cloud provider (AWS ELB, GCP LB, etc.). It automatically creates NodePort and ClusterIP Services. Traffic flows: External LB → NodePort → ClusterIP → Pod. Best for production workloads needing external access. A PersistentVolume is a cluster-level storage resource provisioned by an admin or dynamically via a StorageClass. Key attributes:

capacity – storage size
accessModes – ReadWriteOnce, ReadOnlyMany, ReadWriteMany
persistentVolumeReclaimPolicy – Retain, Delete, or Recycle

PVs exist independently of any Pod. The kubelet is configured via /var/lib/kubelet/config.yaml (or via flags). It controls cluster DNS, image pull policy, cgroup driver, authentication mode, and event recording. After editing, restart the kubelet or send SIGHUP. The Kubernetes API is the central REST interface through which all cluster interactions occur. Every component — kubelet, scheduler, controllers, kubectl — talks to it. It is versioned, discoverable (via OpenAPI), and serves resources like Pod, Service, Deployment, etc.

Question 2 Kubernetes Orchestration

What are finalizers in Kubernetes?

A default-deny policy selects all Pods in a namespace and denies all ingress and egress traffic. It's the recommended baseline; you then layer allow rules for specific traffic. Without this, anything not explicitly blocked is allowed. PodSecurity Admission is a built-in admission controller that enforces the Pod Security Standards at the namespace level via labels: pod-security.kubernetes.io/enforce: restricted (or baseline / privileged). It replaced PodSecurityPolicy, which was removed in v1.25. Finalizers are metadata strings on objects that block deletion until cleared. They let controllers run cleanup (e.g., releasing cloud resources) before the object is fully removed. Common examples: kubernetes.io/pv-protection on PVs. Network Policies are namespace-scoped rules that control Pod-to-Pod (and Pod-to-external) traffic at the IP/port level. They're enforced by a CNI plugin (Calico, Cilium). Without any Network Policy, all Pods can talk to all Pods (default allow).

Question 3 Kubernetes Orchestration

What is a Kubernetes Node?

Each probe type supports:

initialDelaySeconds — wait before first check
periodSeconds — interval between checks
timeoutSeconds — per-probe timeout
successThreshold — successes to mark healthy
failureThreshold — failures to mark unhealthy

Startup probes can replace initialDelaySeconds with a long failureThreshold. Dynamic provisioning creates PVs on demand when a PVC references a StorageClass. The StorageClass's provisioner field points to a driver (e.g., ebs.csi.aws.com) that creates the underlying storage. No admin pre-provisioning needed. A Node is a worker machine (VM or bare-metal) that runs Pods. Each node has:

A kubelet
A container runtime
A kube-proxy
Capacity attributes (CPU, memory, GPUs, labels)

Nodes are registered via the apiserver and managed by the Node controller. Annotations are non-identifying metadata attached to objects, used by external tools (service meshes, ingress controllers, monitoring) to store configuration or context. They cannot be used in label selectors and have no semantic meaning to Kubernetes core.

Question 4 Kubernetes Orchestration

What is a Kubernetes admission policy engine?

OPA Gatekeeper and Kyverno are policy engines that enforce custom rules across the cluster via admission webhooks. They answer questions like "must all images come from a trusted registry?" or "must all Deployments have a specific label?". Stored as code (Rego for OPA, YAML for Kyverno). kubectl describe <resource> <name> shows detailed information including:

Metadata and labels
Status and conditions
Events – useful for debugging scheduling/pull errors

Example: kubectl describe pod my-pod reveals image pull errors, OOMKilled events, and probe failures. Helm is the package manager for Kubernetes. Key concepts:

Chart – a packaged set of Kubernetes manifests
Values – configurable parameters for a chart
Release – an installed instance of a chart
Repository – a collection of charts

Install with: helm install my-release my-chart You must add an explicit egress rule to allow UDP port 53 to the kube-system namespace (or wherever CoreDNS runs):

egress:
  - to: [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}} ]
    ports: [{protocol: UDP, port: 53}]

Question 5 Kubernetes Orchestration

What is the Kubernetes API server endpoint?

imagePullPolicy controls when the kubelet pulls an image:

Always — every start
IfNotPresent — only if missing (default for tagged images)
Never — must be present locally

Use :latest with care; pin tags for reproducibility. Finalizers are metadata strings on objects that block deletion until cleared. They let controllers run cleanup (e.g., releasing cloud resources) before the object is fully removed. Common examples: kubernetes.io/pv-protection on PVs. kubectl diff -f manifest.yaml shows the differences between the live cluster state and the manifests on disk before applying. It prevents accidental drift and is a best-practice preflight step in CI/CD pipelines. The apiserver is reachable at https://<apiserver>:6443 by default. Tools and components authenticate via client certificates, bearer tokens, or OIDC. The endpoint serves the OpenAPI spec and is the only place from which cluster state can be mutated.

Question 6 Kubernetes Orchestration

What is kubectl replace?

Taints are applied to nodes to repel Pods unless those Pods have matching tolerations. Taint effects:

NoSchedule – Pods won't be scheduled
PreferNoSchedule – soft preference to avoid
NoExecute – evicts existing Pods without tolerations

Example: kubectl taint nodes node1 gpu=true:NoSchedule An ExternalName Service maps a Service to an external DNS name using a CNAME record. It does not use selectors or define endpoints. Example: spec.externalName: my.database.example.com. Useful for referencing external services with a cluster-internal DNS alias. The downward API exposes Pod metadata (name, namespace, labels, resource limits) to running containers as environment variables or files in a downwardAPI volume. It lets containers react to their own context without external lookups. Example: fieldRef: {fieldPath: metadata.name}. kubectl replace -f new.yaml replaces a live object with a new manifest. It fails if the resource doesn't exist (unlike apply) and does not merge — every field must be re-declared. Use it when you want full replacement, not partial updates.

Question 7 Kubernetes Orchestration

What is a kubelet's Pod lifecycle?

The cgroup driver manages cgroups (resource control groups) on the node. cgroupfs and systemd are the two options. It must match the container runtime's cgroup driver — mismatches cause kubelet errors. Modern Linux distros default to systemd. The kubelet's lifecycle per Pod:

Receives Pod spec from apiserver
Runs any init containers in order
Pulls images via the CRI
Sets up networking via CNI
Mounts volumes
Starts containers and runs probes
Reports status back

Pod Security Standards define three levels:

Privileged — unrestricted
Baseline — blocks known dangerous escalations
Restricted — hardened best practices (no root, no host network, etc.)

Apply via namespace labels with PodSecurity Admission. Use kubectl scale deployment/<name> --replicas=<count>. Examples:

kubectl scale deployment/nginx --replicas=5
kubectl scale --replicas=0 deployment/nginx – scale to zero

For automatic scaling, use the HPA: kubectl autoscale deployment/nginx --min=2 --max=10 --cpu-percent=80

Question 8 Kubernetes Orchestration

What is a CustomResourceDefinition (CRD)?

The garbage collector runs in the controller-manager and removes objects whose owners no longer exist (cascade deletion). It supports both background and foreground cascading — foreground waits for dependents to be cleaned up first. A CRD is a manifest that registers a new resource kind with the apiserver. Once applied, you can kubectl get and kubectl apply objects of that kind. Examples: Certificate from cert-manager, VirtualService from Istio. An Ingress manages external HTTP/HTTPS access to Services within the cluster. It provides:

Host-based routing (e.g., app.example.com)
Path-based routing (e.g., /api → service-a)
TLS termination

Requires an Ingress Controller (e.g., NGINX, Traefik) to function. Kyverno is a Kubernetes-native policy engine using YAML for rules. It supports validate, mutate, generate, and verifyImage operations. Example: auto-inject a default team label, deny images from latest, or generate a default NetworkPolicy for new namespaces.

Question 9 Kubernetes Orchestration

What is a LoadBalancer Service?

kubectl api-resources lists every resource kind, its API group/version, and whether it's namespaced. Examples:
kubectl api-resources --namespaced=false — cluster-scoped resources only
kubectl api-resources -o name — names only, for scripting The VPA automatically adjusts CPU and memory requests/limits for containers based on actual usage. Modes:

Off – only recommends, no changes
Auto – applies recommendations (may restart Pods)
Initial – sets resources only at Pod creation

Note: Do not use VPA and HPA on the same CPU/memory metrics simultaneously. Create with kubectl create namespace <name> or declaratively:

apiVersion: v1
kind: Namespace
metadata:
  name: my-namespace

Set your default namespace with: kubectl config set-context --current --namespace=my-namespace. Use -n <namespace> flag to target a specific namespace. A LoadBalancer Service provisions an external load balancer from the cloud provider (AWS ELB, GCP LB, etc.). It automatically creates NodePort and ClusterIP Services. Traffic flows: External LB → NodePort → ClusterIP → Pod. Best for production workloads needing external access.

Question 10 Kubernetes Orchestration

What does kubectl port-forward do?

Key kubectl rollout subcommands:

kubectl rollout status deployment/app – watch rollout progress
kubectl rollout history deployment/app – view revision history
kubectl rollout undo deployment/app – rollback to previous
kubectl rollout pause deployment/app – pause a rollout
kubectl rollout resume deployment/app – resume a paused rollout

An emptyDir volume is created when a Pod is assigned to a node and exists for the Pod's lifetime. Initially empty, it's shared between containers in the same Pod. Useful for scratch space, caches, and checkpoint data. Lost on Pod restart. kubectl port-forward forwards local ports to a Pod or Service for debugging:

kubectl port-forward pod/my-pod 8080:80 – forward local 8080 to Pod port 80
kubectl port-forward svc/my-svc 8080:80 – forward to a Service

Traffic goes directly without needing Ingress or LoadBalancer. Useful for local development and debugging. External secret managers like HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault hold sensitive values. The External Secrets Operator (or AWS Secrets Store CSI Driver) syncs them into Kubernetes Secrets so apps can mount them as usual.

Question 11 Kubernetes Orchestration

What is the sidecar pattern in Kubernetes?

Use kubectl get <resource>. Examples:

kubectl get pods – list Pods in current namespace
kubectl get pods -A – list Pods in all namespaces
kubectl get svc,deploy – list Services and Deployments
kubectl get pods -o wide – show extra info (node, IP)
kubectl get pods -o yaml – full YAML output

The sidecar pattern places a helper container alongside the main application container within the same Pod. The sidecar extends or enhances the main container's functionality. Examples:

Log shipping (e.g., Fluentd sidecar)
Service mesh proxy (e.g., Envoy in Istio)
Configuration reloading

Multiple containers in a Pod share the same network and storage, making them ideal for tightly coupled processes. Common patterns include:

Sidecar – adds functionality (e.g., logging agent)
Ambassador – proxies network traffic
Adapter – transforms output for external consumers

etcd is a distributed, consistent key-value store that serves as the source of truth for all cluster state — node information, Pod specs, Secrets, ConfigMaps, etc. It uses the Raft consensus algorithm. Losing etcd data effectively destroys the cluster, so always back it up.

Question 12 Kubernetes Orchestration

What is a Kubernetes controller?

kubectl cordon <node> marks a node as unschedulable so the scheduler stops placing new Pods on it, without evicting existing workloads. Use it before draining to gracefully migrate workloads. kubectl uncordon reverses it. During a rolling update, Kubernetes incrementally replaces old Pods with new ones. Key parameters:

maxSurge – max extra Pods above desired count (default 25%)
maxUnavailable – max Pods that can be unavailable (default 25%)

This ensures the application stays available throughout the update. A controller is a control loop that watches the state of the cluster via the apiserver and converges actual state toward desired state. Examples: Deployment controller, ReplicaSet controller, Job controller. The Operator pattern is custom controllers + CRDs. Namespaces provide logical isolation within a cluster. They partition resources and allow:

Separate environments (dev, staging, prod)
Resource quotas per namespace
RBAC scoping

Default namespaces: default, kube-system, kube-public, kube-node-lease.

Question 13 Kubernetes Orchestration

What is the difference between a Role and a ClusterRole?

Liveness failure restarts the container.
Readiness failure removes the Pod from Service endpoints but does not restart it. Use liveness for "process is deadlocked" and readiness for "not yet ready to serve traffic". A Role grants permissions within a specific namespace (e.g., read Pods in "dev"). A ClusterRole grants permissions cluster-wide or on non-namespaced resources (nodes, PVs). ClusterRoles can also be bound to a namespace via a RoleBinding to reuse permission sets across namespaces. Each probe type supports:

initialDelaySeconds — wait before first check
periodSeconds — interval between checks
timeoutSeconds — per-probe timeout
successThreshold — successes to mark healthy
failureThreshold — failures to mark unhealthy

Startup probes can replace initialDelaySeconds with a long failureThreshold. etcd is a distributed, consistent key-value store that serves as the source of truth for all cluster state — node information, Pod specs, Secrets, ConfigMaps, etc. It uses the Raft consensus algorithm. Losing etcd data effectively destroys the cluster, so always back it up.

Question 14 Kubernetes Orchestration

How do you create a Namespace?

Create with kubectl create namespace <name> or declaratively:

apiVersion: v1
kind: Namespace
metadata:
  name: my-namespace

Set your default namespace with: kubectl config set-context --current --namespace=my-namespace. Use -n <namespace> flag to target a specific namespace. A Secret stores sensitive data such as passwords, tokens, or TLS certificates. Data is base64-encoded (not encrypted by default). Types include:

Opaque – arbitrary key-value data
kubernetes.io/tls – TLS cert and key
kubernetes.io/dockerconfigjson – registry credentials

Enable encryption at rest for production clusters. Labels are identifying key-value pairs used by selectors. Annotations are non-identifying metadata used by tools and libraries.
kubectl label pod my-pod env=prod
kubectl annotate pod my-pod owner="team-a"
Use --overwrite to update existing. Each probe type supports:

initialDelaySeconds — wait before first check
periodSeconds — interval between checks
timeoutSeconds — per-probe timeout
successThreshold — successes to mark healthy
failureThreshold — failures to mark unhealthy

Startup probes can replace initialDelaySeconds with a long failureThreshold.

Question 15 Kubernetes Orchestration

What is a Kubernetes API group?

API groups organize resources into collections. Core resources (Pod, Service) are in the core group (empty string). CRDs and other resources live in named groups: apps/v1, batch/v1, networking.k8s.io/v1. apiVersion encodes this. A controller is a control loop that watches the state of the cluster via the apiserver and converges actual state toward desired state. Examples: Deployment controller, ReplicaSet controller, Job controller. The Operator pattern is custom controllers + CRDs. Admission controllers are plugins that intercept requests to the apiserver after authentication/authorization but before persistence. They can mutate or validate objects. Examples: MutatingAdmissionWebhook, ValidatingAdmissionWebhook, PodSecurity, ResourceQuota. The kubelet is configured via /var/lib/kubelet/config.yaml (or via flags). It controls cluster DNS, image pull policy, cgroup driver, authentication mode, and event recording. After editing, restart the kubelet or send SIGHUP.

Question 16 Kubernetes Orchestration

What is an ACME challenge?

ACME (Automatic Certificate Management Environment) is the protocol Let's Encrypt uses. The two main challenge types:

HTTP-01 — serves a token over HTTP on port 80
DNS-01 — adds a TXT record to DNS

DNS-01 supports wildcard certs. Use kubectl rollout undo deployment/<name> to revert to the previous revision. To rollback to a specific revision: kubectl rollout undo deployment/<name> --to-revision=2. View revision history with kubectl rollout history deployment/<name>. Kubernetes API versions progress through stages:

Alpha — disabled by default, may break, no guarantee
Beta — enabled by default, stable features, no breaking changes
GA / Stable — versioned like v1; safe for production

Deprecated APIs are removed after the deprecation policy window. Namespaces provide logical isolation within a cluster. They partition resources and allow:

Separate environments (dev, staging, prod)
Resource quotas per namespace
RBAC scoping

Default namespaces: default, kube-system, kube-public, kube-node-lease.

Question 17 Kubernetes Orchestration

What is a PersistentVolume (PV)?

kubectl api-versions lists every API group/version the cluster supports (e.g., apps/v1, networking.k8s.io/v1). Useful when checking whether a feature is available on the cluster. Use kubectl scale deployment/<name> --replicas=<count>. Examples:

kubectl scale deployment/nginx --replicas=5
kubectl scale --replicas=0 deployment/nginx – scale to zero

For automatic scaling, use the HPA: kubectl autoscale deployment/nginx --min=2 --max=10 --cpu-percent=80 A LimitRange sets default and min/max constraints per-container or per-Pod within a namespace. It pairs with ResourceQuota to enforce both defaults (so every Pod gets sensible limits) and ceilings (so no single workload hogs the namespace). A PersistentVolume is a cluster-level storage resource provisioned by an admin or dynamically via a StorageClass. Key attributes:

capacity – storage size
accessModes – ReadWriteOnce, ReadOnlyMany, ReadWriteMany
persistentVolumeReclaimPolicy – Retain, Delete, or Recycle

PVs exist independently of any Pod.

Question 18 Kubernetes Orchestration

What is the Kubernetes downward API?

A CRD is a manifest that registers a new resource kind with the apiserver. Once applied, you can kubectl get and kubectl apply objects of that kind. Examples: Certificate from cert-manager, VirtualService from Istio. A Job creates one or more Pods and ensures they run to successful completion. Key fields:

spec.completions – number of successful completions needed
spec.parallelism – how many Pods run concurrently
spec.backoffLimit – retries before marking as failed

Use for batch processing, data migrations, one-off tasks. An Ingress manages external HTTP/HTTPS access to Services within the cluster. It provides:

Host-based routing (e.g., app.example.com)
Path-based routing (e.g., /api → service-a)
TLS termination

Requires an Ingress Controller (e.g., NGINX, Traefik) to function. The downward API exposes Pod metadata (name, namespace, labels, resource limits) to running containers as environment variables or files in a downwardAPI volume. It lets containers react to their own context without external lookups. Example: fieldRef: {fieldPath: metadata.name}.

Question 19 Kubernetes Orchestration

How do you label and annotate Kubernetes resources?

An Ingress Controller is the component that implements the Ingress resource rules. It watches for Ingress objects and configures the underlying load balancer. Popular controllers:

NGINX Ingress Controller
Traefik
HAProxy
AWS ALB Ingress Controller

Without a controller, Ingress resources have no effect. Labels are identifying key-value pairs used by selectors. Annotations are non-identifying metadata used by tools and libraries.
kubectl label pod my-pod env=prod
kubectl annotate pod my-pod owner="team-a"
Use --overwrite to update existing. Key kubectl rollout subcommands:

kubectl rollout status deployment/app – watch rollout progress
kubectl rollout history deployment/app – view revision history
kubectl rollout undo deployment/app – rollback to previous
kubectl rollout pause deployment/app – pause a rollout
kubectl rollout resume deployment/app – resume a paused rollout

A Pod transitions through these phases:

Pending — accepted, not yet running (image pull, scheduling)
Running — at least one container is running
Succeeded — all containers exited 0 and won't restart
Failed — at least one container exited non-zero
Unknown — apiserver can't reach the kubelet

Question 20 Kubernetes Orchestration

What is an init container?

A Role grants permissions within a specific namespace (e.g., read Pods in "dev"). A ClusterRole grants permissions cluster-wide or on non-namespaced resources (nodes, PVs). ClusterRoles can also be bound to a namespace via a RoleBinding to reuse permission sets across namespaces. An init container runs before the main application containers start. It runs to completion and must succeed before the next init container (or main container) starts. Use cases include:

Pre-populating shared volumes with data
Waiting for a dependent service to become available
Running database migrations

A Node is a worker machine (VM or bare-metal) that runs Pods. Each node has:

A kubelet
A container runtime
A kube-proxy
Capacity attributes (CPU, memory, GPUs, labels)

Nodes are registered via the apiserver and managed by the Node controller. Hard (requiredDuringScheduling...) makes the constraint mandatory — Pods won't schedule unless it can be met. Soft (preferredDuringScheduling...) is a preference; the scheduler tries to honor it but will still schedule the Pod if not possible. Soft rules have a weight field.

Question 21 Kubernetes Orchestration

What is kube-proxy?

A controller is a control loop that watches the state of the cluster via the apiserver and converges actual state toward desired state. Examples: Deployment controller, ReplicaSet controller, Job controller. The Operator pattern is custom controllers + CRDs. A Mutating Admission Webhook is an HTTPS endpoint the apiserver calls with incoming requests, allowing the webhook to modify the object before it's stored. Common uses: injecting sidecars, defaulting fields, secret rotation. Order matters — multiple mutations chain. kube-proxy is a network component on each node that maintains iptables/IPVS rules (or eBPF programs) so traffic to Service cluster IPs gets load-balanced to the correct backend Pods. Without it, Service IPs would not resolve inside the cluster. An Ingress manages external HTTP/HTTPS access to Services within the cluster. It provides:

Host-based routing (e.g., app.example.com)
Path-based routing (e.g., /api → service-a)
TLS termination

Requires an Ingress Controller (e.g., NGINX, Traefik) to function.

Question 22 Kubernetes Orchestration

What is a container runtime?

Every namespace has a default ServiceAccount. Pods that don't specify one get it. For tighter security, create a dedicated ServiceAccount per workload and disable automounting via automountServiceAccountToken: false. -o jsonpath='{.items[*].metadata.name}' extracts specific fields from resources via JSONPath expressions. Useful in scripts: kubectl get pods -o jsonpath='{.items[*].status.podIP}'. Combine with --template for reusable formats. Set automountServiceAccountToken: false on either the Pod spec or the ServiceAccount. This prevents the projected SA token from being mounted at /var/run/secrets/..., which is the recommended default unless the Pod actually calls the apiserver. The container runtime is the software responsible for running containers. Kubernetes supports any runtime implementing the CRI (Container Runtime Interface), such as containerd, CRI-O, or Mirantis Container Runtime. Docker is no longer supported directly since v1.24 — clusters now use containerd/CRI-O under the hood.

Question 23 Kubernetes Orchestration

What is kubectl explain?

kubectl edit <resource>/<name> opens the live object's YAML in $EDITOR, lets you modify it, and applies the changes back to the cluster. Useful for quick tweaks; for production prefer version-controlled manifests with apply. kubectl explain <resource>.<field> returns inline API documentation. Examples:
kubectl explain pod.spec.containers
kubectl explain deployment.spec.strategy
It's like a built-in man page — handy when you don't have web access. A NodePort Service exposes the Service on a static port (range 30000–32767) on every node's IP. External traffic can reach the Service via <NodeIP>:<NodePort>. It automatically creates a ClusterIP Service that the NodePort routes to. WaitForFirstConsumer delays PV binding until a Pod is scheduled, so the volume is created in the same zone as the Pod. Without it (Immediate), PVs may be provisioned in zones the Pod cannot reach, leaving PVCs Pending.

Question 24 Kubernetes Orchestration

What is a Kubernetes startup probe?

A startup probe checks if a container application has started successfully. While the startup probe is active, liveness and readiness probes are disabled. This is ideal for slow-starting containers that need extra time to initialize. Once the startup probe succeeds, liveness and readiness probes take over. Configure with failureThreshold × periodSeconds to set the maximum startup time. Each probe type supports:

initialDelaySeconds — wait before first check
periodSeconds — interval between checks
timeoutSeconds — per-probe timeout
successThreshold — successes to mark healthy
failureThreshold — failures to mark unhealthy

Startup probes can replace initialDelaySeconds with a long failureThreshold. An emptyDir volume is created when a Pod is assigned to a node and exists for the Pod's lifetime. Initially empty, it's shared between containers in the same Pod. Useful for scratch space, caches, and checkpoint data. Lost on Pod restart. kubectl reads the ~/.kube/config file, which stores:

Clusters (apiserver URL, CA cert)
Users (credentials: cert/token/oidc)
Contexts (cluster + user + namespace tuples)

You switch contexts with kubectl config use-context <name>.

Question 25 Kubernetes Orchestration

How do you execute commands inside a running container?

HPA scales the number of Pods in a Deployment/ReplicaSet based on metrics. Cluster Autoscaler adds or removes worker nodes when Pods can't be scheduled (Pending) or when nodes are underutilized. They work together: HPA handles demand, Cluster Autoscaler handles capacity. The HPA automatically scales the number of Pod replicas based on observed metrics. It adjusts replicas to meet target utilization:

CPU utilization
Memory utilization
Custom/external metrics

Create with: kubectl autoscale deployment my-app --cpu-percent=50 --min=2 --max=10 A Validating Admission Webhook is called after mutating webhooks to accept or reject an object. It cannot modify the request. Common uses: enforce naming conventions, block disallowed image registries, require specific labels. Use kubectl exec:

kubectl exec -it my-pod -- /bin/sh – interactive shell
kubectl exec my-pod -- cat /etc/config – run a single command
kubectl exec -it my-pod -c sidecar -- /bin/bash – target a specific container

The -it flags enable interactive TTY mode.

Question 26 Kubernetes Orchestration

What is kubectl cp?

kubectl top node and kubectl top pod show live CPU/memory usage, sourced from the Metrics Server. Without the Metrics Server installed, the command fails. Useful for quick resource checks and validating HPA targets. Mutual TLS means both client and server present certificates to each other. Service meshes like Istio and Linkerd enforce it transparently via sidecars, ensuring all inter-Pod traffic is authenticated and encrypted — even without changes to app code. kubectl cp <pod>:<remote_path> <local_path> copies files between a container and your local machine. Reverse direction is supported. Internally it uses tar streams through kubectl exec. Useful for retrieving logs or uploading configs. A liveness probe checks if a container is still running. If it fails, Kubernetes restarts the container. Probe types:

httpGet – HTTP request to an endpoint
tcpSocket – TCP connection check
exec – run a command inside the container

Configure with initialDelaySeconds, periodSeconds, and failureThreshold.

Question 27 Kubernetes Orchestration

What is the Vertical Pod Autoscaler (VPA)?

A readiness probe checks if a container is ready to accept traffic. If it fails, the Pod is removed from Service endpoints (no traffic routed to it) but is not restarted. Use readiness probes for:

Waiting for cache warm-up
Loading large datasets
Dependency health checks

Use kubectl logs <pod-name>. Useful flags:

-f – stream logs in real time
--tail=100 – show last 100 lines
-c <container> – specify container in multi-container Pod
--previous – logs from a previous (crashed) instance
-l app=nginx – logs from all Pods matching a label

The VPA automatically adjusts CPU and memory requests/limits for containers based on actual usage. Modes:

Off – only recommends, no changes
Auto – applies recommendations (may restart Pods)
Initial – sets resources only at Pod creation

Note: Do not use VPA and HPA on the same CPU/memory metrics simultaneously. kubectl diff -f manifest.yaml shows the differences between the live cluster state and the manifests on disk before applying. It prevents accidental drift and is a best-practice preflight step in CI/CD pipelines.

Question 28 Kubernetes Orchestration

What is a RoleBinding in Kubernetes?

kubectl wait blocks until a condition is met on a resource. Examples:
kubectl wait --for=condition=Ready pod/my-pod --timeout=120s
kubectl wait --for=jsonpath='{.status.readyReplicas}'=3 deployment/app
Often used in CI/CD pipelines. A DaemonSet ensures that a copy of a Pod runs on every node (or a subset via node selectors). When nodes are added, the DaemonSet Pod is automatically scheduled. Common use cases:

Log collectors (Fluentd, Filebeat)
Monitoring agents (Prometheus node-exporter)
Network plugins (Calico, Cilium)

Admission controllers are plugins that intercept requests to the apiserver after authentication/authorization but before persistence. They can mutate or validate objects. Examples: MutatingAdmissionWebhook, ValidatingAdmissionWebhook, PodSecurity, ResourceQuota. A RoleBinding associates a Role (or ClusterRole) with subjects within a namespace. Subjects can be:

User – an authenticated user
Group – a set of users
ServiceAccount – an identity for Pods

Example: Bind role "pod-reader" to user "jane" in namespace "dev".

Question 29 Kubernetes Orchestration

What is dynamic volume provisioning?

Pod Security Standards define three levels:

Privileged — unrestricted
Baseline — blocks known dangerous escalations
Restricted — hardened best practices (no root, no host network, etc.)

Apply via namespace labels with PodSecurity Admission. Node affinity constrains which nodes a Pod can be scheduled on based on node labels. Two types:

requiredDuringSchedulingIgnoredDuringExecution – hard requirement (must match)
preferredDuringSchedulingIgnoredDuringExecution – soft preference (try to match)

Use it to place Pods on specific hardware, availability zones, or node pools. Dynamic provisioning creates PVs on demand when a PVC references a StorageClass. The StorageClass's provisioner field points to a driver (e.g., ebs.csi.aws.com) that creates the underlying storage. No admin pre-provisioning needed. PodSecurity Admission is a built-in admission controller that enforces the Pod Security Standards at the namespace level via labels: pod-security.kubernetes.io/enforce: restricted (or baseline / privileged). It replaced PodSecurityPolicy, which was removed in v1.25.

Question 30 Kubernetes Orchestration

What is an API version lifecycle in Kubernetes?

Every namespace has a default ServiceAccount. Pods that don't specify one get it. For tighter security, create a dedicated ServiceAccount per workload and disable automounting via automountServiceAccountToken: false. The container runtime is the software responsible for running containers. Kubernetes supports any runtime implementing the CRI (Container Runtime Interface), such as containerd, CRI-O, or Mirantis Container Runtime. Docker is no longer supported directly since v1.24 — clusters now use containerd/CRI-O under the hood. An Ingress manages external HTTP/HTTPS access to Services within the cluster. It provides:

Host-based routing (e.g., app.example.com)
Path-based routing (e.g., /api → service-a)
TLS termination

Requires an Ingress Controller (e.g., NGINX, Traefik) to function. Kubernetes API versions progress through stages:

Alpha — disabled by default, may break, no guarantee
Beta — enabled by default, stable features, no breaking changes
GA / Stable — versioned like v1; safe for production

Deprecated APIs are removed after the deprecation policy window.

Question 31 Kubernetes Orchestration

What is a ConfigMap?

kubectl describe <resource> <name> shows detailed information including:

Metadata and labels
Status and conditions
Events – useful for debugging scheduling/pull errors

Example: kubectl describe pod my-pod reveals image pull errors, OOMKilled events, and probe failures. A service mesh is a dedicated infrastructure layer for service-to-service communication, typically implemented by sidecar proxies (Envoy/Linkerd). It provides mTLS, retries, traffic splitting, and observability without changing app code. Examples: Istio, Linkerd, Consul Connect. Kubernetes serves an OpenAPI spec at /openapi/v2 and /openapi/v3. Tools like kubectl, client-go, and Swagger use it to generate clients and validators. You can browse it directly: kubectl get --raw /openapi/v2 | jq. A ConfigMap stores non-confidential configuration data as key-value pairs. Pods consume ConfigMaps as:

Environment variables
Command-line arguments
Mounted files in a volume

Create with: kubectl create configmap my-config --from-literal=key=value

Question 32 Kubernetes Orchestration

How do you view container logs with kubectl?

--show-labels adds a final LABELS column to kubectl get output, exposing all labels at once. Combine with -L key to show only specific labels as their own columns. Useful for quickly auditing label coverage. Use kubectl logs <pod-name>. Useful flags:

-f – stream logs in real time
--tail=100 – show last 100 lines
-c <container> – specify container in multi-container Pod
--previous – logs from a previous (crashed) instance
-l app=nginx – logs from all Pods matching a label

A VolumeSnapshot is a point-in-time copy of a PVC, similar to a database snapshot. You define a VolumeSnapshotClass (which CSI driver to use) and a VolumeSnapshot resource. Useful for backups and cloning databases on Kubernetes. A LoadBalancer Service provisions an external load balancer from the cloud provider (AWS ELB, GCP LB, etc.). It automatically creates NodePort and ClusterIP Services. Traffic flows: External LB → NodePort → ClusterIP → Pod. Best for production workloads needing external access.

Question 33 Kubernetes Orchestration

How does the Kubernetes control plane differ from the worker nodes?

A VolumeSnapshot is a point-in-time copy of a PVC, similar to a database snapshot. You define a VolumeSnapshotClass (which CSI driver to use) and a VolumeSnapshot resource. Useful for backups and cloning databases on Kubernetes. Kubernetes serves an OpenAPI spec at /openapi/v2 and /openapi/v3. Tools like kubectl, client-go, and Swagger use it to generate clients and validators. You can browse it directly: kubectl get --raw /openapi/v2 | jq. kube-state-metrics is a service that generates Prometheus metrics from the Kubernetes API (number of Pods, Deployment status, Node conditions, etc.). Unlike the Metrics Server, it provides raw object state, not resource usage. Deployed via a separate Service/Deployment. The control plane runs components that make global decisions: kube-apiserver, etcd, kube-scheduler, and kube-controller-manager. Worker nodes run the workloads via kubelet, kube-proxy, and the container runtime (e.g., containerd). The control plane exposes the API; nodes actually schedule and run Pods.

Question 34 Kubernetes Orchestration

What is a Job in Kubernetes?

Kyverno is a Kubernetes-native policy engine using YAML for rules. It supports validate, mutate, generate, and verifyImage operations. Example: auto-inject a default team label, deny images from latest, or generate a default NetworkPolicy for new namespaces. kubectl diff -f manifest.yaml shows the differences between the live cluster state and the manifests on disk before applying. It prevents accidental drift and is a best-practice preflight step in CI/CD pipelines. The kubelet is the agent that runs on each worker node. It registers the node with the apiserver, watches for Pod specs assigned to it, ensures containers are healthy via probes, and reports Pod/node status back to the control plane. A Job creates one or more Pods and ensures they run to successful completion. Key fields:

spec.completions – number of successful completions needed
spec.parallelism – how many Pods run concurrently
spec.backoffLimit – retries before marking as failed

Use for batch processing, data migrations, one-off tasks.

Question 35 Kubernetes Orchestration

How do you disable automounting the ServiceAccount token?

Set automountServiceAccountToken: false on either the Pod spec or the ServiceAccount. This prevents the projected SA token from being mounted at /var/run/secrets/..., which is the recommended default unless the Pod actually calls the apiserver. Node affinity constrains which nodes a Pod can be scheduled on based on node labels. Two types:

requiredDuringSchedulingIgnoredDuringExecution – hard requirement (must match)
preferredDuringSchedulingIgnoredDuringExecution – soft preference (try to match)

Use it to place Pods on specific hardware, availability zones, or node pools. The garbage collector runs in the controller-manager and removes objects whose owners no longer exist (cascade deletion). It supports both background and foreground cascading — foreground waits for dependents to be cleaned up first. kube-proxy is a network component on each node that maintains iptables/IPVS rules (or eBPF programs) so traffic to Service cluster IPs gets load-balanced to the correct backend Pods. Without it, Service IPs would not resolve inside the cluster.

Question 36 Kubernetes Orchestration

What is a ServiceAccount?

A PVC is a user's request for storage. It specifies size, access mode, and optionally a StorageClass. Kubernetes binds a matching PV to the PVC. Pods reference PVCs in their volume spec:

volumes:
  - name: data
    persistentVolumeClaim:
      claimName: my-pvc

A ServiceAccount provides an identity for processes running in a Pod. It's mounted at /var/run/secrets/kubernetes.io/serviceaccount/ by default. Pods use it to authenticate to the apiserver (e.g., for the controller manager or Prometheus operator). etcd is a distributed, consistent key-value store that serves as the source of truth for all cluster state — node information, Pod specs, Secrets, ConfigMaps, etc. It uses the Raft consensus algorithm. Losing etcd data effectively destroys the cluster, so always back it up. The apiserver is reachable at https://<apiserver>:6443 by default. Tools and components authenticate via client certificates, bearer tokens, or OIDC. The endpoint serves the OpenAPI spec and is the only place from which cluster state can be mutated.

Question 37 Kubernetes Orchestration

What does kubectl wait do?

A release is a running instance of a Helm chart with a specific configuration. You can install multiple releases of the same chart with different names/values.
A repository is a hosted collection of charts. Commands:

helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update
helm search repo nginx

Under node resource pressure, the kubelet evicts Pods in this order: BestEffort → Burstable → Guaranteed. Guaranteed Pods are only killed if the node is critically short. This is why setting requests/limits matters for production reliability. kubectl wait blocks until a condition is met on a resource. Examples:
kubectl wait --for=condition=Ready pod/my-pod --timeout=120s
kubectl wait --for=jsonpath='{.status.readyReplicas}'=3 deployment/app
Often used in CI/CD pipelines. ClusterIP is the default Service type. It exposes the Service on an internal IP accessible only within the cluster. Use it for:

Internal microservice-to-microservice communication
Backend services not exposed externally

Example: spec.type: ClusterIP

Question 38 Kubernetes Orchestration

How do you set namespace resource quotas?

kubectl replace -f new.yaml replaces a live object with a new manifest. It fails if the resource doesn't exist (unlike apply) and does not merge — every field must be re-declared. Use it when you want full replacement, not partial updates. The kube-controller-manager runs core controller loops that reconcile the cluster's actual state toward the desired state. Examples: Node controller, Job controller, Endpoint controller, ServiceAccount & Token controllers. Each is a separate process compiled into a single binary. A PVC is a user's request for storage. It specifies size, access mode, and optionally a StorageClass. Kubernetes binds a matching PV to the PVC. Pods reference PVCs in their volume spec:

volumes:
  - name: data
    persistentVolumeClaim:
      claimName: my-pvc

A ResourceQuota object limits total resource consumption in a namespace:

apiVersion: v1
kind: ResourceQuota
metadata: {name: compute-quota}
spec:
  hard:
    requests.cpu: "10"
    requests.memory: 20Gi
    pods: "50"

Question 39 Kubernetes Orchestration

What was the deprecated PodSecurityPolicy?

PodSecurityPolicy (PSP) was a predecessor to PodSecurity Admission, removed in v1.25. It allowed cluster-wide policy via RBAC. PSPs had a confusing precedence model and were replaced by the simpler, namespace-scoped PodSecurity Admission. A StorageClass defines how storage is dynamically provisioned. It specifies:

provisioner – e.g., kubernetes.io/aws-ebs, pd.csi.storage.gke.io
parameters – provisioner-specific settings (disk type, IOPS)
reclaimPolicy – Delete or Retain
volumeBindingMode – Immediate or WaitForFirstConsumer

kubectl diff -f manifest.yaml shows the differences between the live cluster state and the manifests on disk before applying. It prevents accidental drift and is a best-practice preflight step in CI/CD pipelines. kube-state-metrics is a service that generates Prometheus metrics from the Kubernetes API (number of Pods, Deployment status, Node conditions, etc.). Unlike the Metrics Server, it provides raw object state, not resource usage. Deployed via a separate Service/Deployment.

Question 40 Kubernetes Orchestration

What is the Metrics Server?

Liveness failure restarts the container.
Readiness failure removes the Pod from Service endpoints but does not restart it. Use liveness for "process is deadlocked" and readiness for "not yet ready to serve traffic". The Metrics Server is a cluster-wide aggregator of resource usage data (CPU/memory) scraped from kubelets. It exposes them via the Kubernetes API for the HPA, VPA, and kubectl top. It's not a long-term monitoring solution — that's Prometheus's role. Under node resource pressure, the kubelet evicts Pods in this order: BestEffort → Burstable → Guaranteed. Guaranteed Pods are only killed if the node is critically short. This is why setting requests/limits matters for production reliability. WaitForFirstConsumer delays PV binding until a Pod is scheduled, so the volume is created in the same zone as the Pod. Without it (Immediate), PVs may be provisioned in zones the Pod cannot reach, leaving PVCs Pending.

Question 41 Kubernetes Orchestration

What is kubectl context?

A context is a triple (cluster, user, namespace) saved in the kubeconfig. It lets you target different clusters/users without re-typing flags. Common commands: kubectl config get-contexts, kubectl config use-context prod. Mutual TLS means both client and server present certificates to each other. Service meshes like Istio and Linkerd enforce it transparently via sidecars, ensuring all inter-Pod traffic is authenticated and encrypted — even without changes to app code. Each probe type supports:

initialDelaySeconds — wait before first check
periodSeconds — interval between checks
timeoutSeconds — per-probe timeout
successThreshold — successes to mark healthy
failureThreshold — failures to mark unhealthy

Startup probes can replace initialDelaySeconds with a long failureThreshold. Apply: kubectl apply -f manifest.yaml creates or updates resources declaratively. Supports directories: kubectl apply -f ./k8s/.
Delete: kubectl delete -f manifest.yaml or kubectl delete pod my-pod. Use --grace-period=0 --force for immediate deletion (use with caution).

Question 42 Kubernetes Orchestration

What is a CSI volume?

A CSI (Container Storage Interface) volume is a persistent volume backed by an external driver (e.g., AWS EBS, GCP PD, Azure Disk). The driver runs as a DaemonSet or Deployment. CSI is the standard since in-tree plugins were removed in v1.26. kubectl describe <resource> <name> shows detailed information including:

Metadata and labels
Status and conditions
Events – useful for debugging scheduling/pull errors

Example: kubectl describe pod my-pod reveals image pull errors, OOMKilled events, and probe failures. kubectl debug launches an ephemeral container in an existing Pod for troubleshooting — ideal for distroless or minimal images where you can't shell in. Examples:
kubectl debug my-pod -it --image=busybox --target=app An init container runs before the main application containers start. It runs to completion and must succeed before the next init container (or main container) starts. Use cases include:

Pre-populating shared volumes with data
Waiting for a dependent service to become available
Running database migrations

Question 43 Kubernetes Orchestration

What is the difference between runAsUser and runAsNonRoot?

imagePullSecrets is a list of Secret references in a Pod spec that authenticate to a private container registry. Format:

imagePullSecrets:
  - name: regcred

Create regcred via kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=.... runAsUser sets a specific numeric UID for the container process. runAsNonRoot: true only requires that the UID be non-zero — the actual UID is decided by the image. Use runAsNonRoot as a baseline; combine with runAsUser for strictness. Every namespace has a default ServiceAccount. Pods that don't specify one get it. For tighter security, create a dedicated ServiceAccount per workload and disable automounting via automountServiceAccountToken: false. Multiple containers in a Pod share the same network and storage, making them ideal for tightly coupled processes. Common patterns include:

Sidecar – adds functionality (e.g., logging agent)
Ambassador – proxies network traffic
Adapter – transforms output for external consumers

Question 44 Kubernetes Orchestration

What is the structure of a Kubernetes YAML manifest?

Every manifest has:
apiVersion — the API group/version (e.g., apps/v1)
kind — the object type (Pod, Deployment, etc.)
metadata — name, namespace, labels, annotations
spec — the desired state
Optional: status (read-only, set by the cluster). A RoleBinding associates a Role (or ClusterRole) with subjects within a namespace. Subjects can be:

User – an authenticated user
Group – a set of users
ServiceAccount – an identity for Pods

Example: Bind role "pod-reader" to user "jane" in namespace "dev". runAsUser sets a specific numeric UID for the container process. runAsNonRoot: true only requires that the UID be non-zero — the actual UID is decided by the image. Use runAsNonRoot as a baseline; combine with runAsUser for strictness. Dynamic provisioning creates PVs on demand when a PVC references a StorageClass. The StorageClass's provisioner field points to a driver (e.g., ebs.csi.aws.com) that creates the underlying storage. No admin pre-provisioning needed.

Question 45 Kubernetes Orchestration

What is a StorageClass?

Secrets are stored in etcd by default. To encrypt them at rest, configure the kube-apiserver with --encryption-provider-config pointing to a config that defines providers like aescbc, secretbox, or aws-kms. Without this, Secrets are only base64-encoded. Dynamic provisioning creates PVs on demand when a PVC references a StorageClass. The StorageClass's provisioner field points to a driver (e.g., ebs.csi.aws.com) that creates the underlying storage. No admin pre-provisioning needed. A StorageClass defines how storage is dynamically provisioned. It specifies:

provisioner – e.g., kubernetes.io/aws-ebs, pd.csi.storage.gke.io
parameters – provisioner-specific settings (disk type, IOPS)
reclaimPolicy – Delete or Retain
volumeBindingMode – Immediate or WaitForFirstConsumer

Multiple containers in a Pod share the same network and storage, making them ideal for tightly coupled processes. Common patterns include:

Sidecar – adds functionality (e.g., logging agent)
Ambassador – proxies network traffic
Adapter – transforms output for external consumers

Question 46 Kubernetes Orchestration

What is the Operator Framework?

A headless Service has clusterIP: None, returning the Pod IPs directly via DNS instead of a single virtual IP. Useful with StatefulSets to give each Pod a stable DNS name like pod-0.svc.namespace.svc.cluster.local for direct peer access. kubectl edit <resource>/<name> opens the live object's YAML in $EDITOR, lets you modify it, and applies the changes back to the cluster. Useful for quick tweaks; for production prefer version-controlled manifests with apply. Kubernetes serves an OpenAPI spec at /openapi/v2 and /openapi/v3. Tools like kubectl, client-go, and Swagger use it to generate clients and validators. You can browse it directly: kubectl get --raw /openapi/v2 | jq. The Operator Framework is a set of tools for building and managing Operators:

Operator SDK — scaffolding tool
Operator Lifecycle Manager (OLM) — install/upgrade Operators
OperatorHub.io — public registry

Question 47 Kubernetes Orchestration

What is RBAC in Kubernetes?

Kubernetes assigns each Pod a QoS class based on its resource settings:

Guaranteed — every container has requests == limits (both CPU and memory)
Burstable — at least one request/limit is set but not guaranteed
BestEffort — no requests or limits anywhere

QoS influences eviction priority under node pressure. Labels are identifying key-value pairs used by selectors. Annotations are non-identifying metadata used by tools and libraries.
kubectl label pod my-pod env=prod
kubectl annotate pod my-pod owner="team-a"
Use --overwrite to update existing. Role-Based Access Control (RBAC) regulates access to Kubernetes resources. It uses four objects:

Role – permissions within a namespace
ClusterRole – cluster-wide permissions
RoleBinding – binds a Role to users/groups/service accounts
ClusterRoleBinding – binds a ClusterRole cluster-wide

kubectl explain <resource>.<field> returns inline API documentation. Examples:
kubectl explain pod.spec.containers
kubectl explain deployment.spec.strategy
It's like a built-in man page — handy when you don't have web access.

Question 48 Kubernetes Orchestration

How do you rollback a Deployment?

Use kubectl rollout undo deployment/<name> to revert to the previous revision. To rollback to a specific revision: kubectl rollout undo deployment/<name> --to-revision=2. View revision history with kubectl rollout history deployment/<name>. You must add an explicit egress rule to allow UDP port 53 to the kube-system namespace (or wherever CoreDNS runs):

egress:
  - to: [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}} ]
    ports: [{protocol: UDP, port: 53}]

A context is a triple (cluster, user, namespace) saved in the kubeconfig. It lets you target different clusters/users without re-typing flags. Common commands: kubectl config get-contexts, kubectl config use-context prod. The VPA automatically adjusts CPU and memory requests/limits for containers based on actual usage. Modes:

Off – only recommends, no changes
Auto – applies recommendations (may restart Pods)
Initial – sets resources only at Pod creation

Note: Do not use VPA and HPA on the same CPU/memory metrics simultaneously.

Question 49 Kubernetes Orchestration

What is a NodePort Service?

A NodePort Service exposes the Service on a static port (range 30000–32767) on every node's IP. External traffic can reach the Service via <NodeIP>:<NodePort>. It automatically creates a ClusterIP Service that the NodePort routes to. kubectl proxy starts a local HTTP proxy to the apiserver using your kubeconfig credentials. Useful for browsing the API at http://localhost:8001/api/... or for connecting kubectl-aware tools without exposing the apiserver externally. During a rolling update, Kubernetes incrementally replaces old Pods with new ones. Key parameters:

maxSurge – max extra Pods above desired count (default 25%)
maxUnavailable – max Pods that can be unavailable (default 25%)

This ensures the application stays available throughout the update. The HPA automatically scales the number of Pod replicas based on observed metrics. It adjusts replicas to meet target utilization:

CPU utilization
Memory utilization
Custom/external metrics

Create with: kubectl autoscale deployment my-app --cpu-percent=50 --min=2 --max=10

Question 50 Kubernetes Orchestration

What is a ReplicaSet?

Every namespace has a default ServiceAccount. Pods that don't specify one get it. For tighter security, create a dedicated ServiceAccount per workload and disable automounting via automountServiceAccountToken: false. Admission controllers are plugins that intercept requests to the apiserver after authentication/authorization but before persistence. They can mutate or validate objects. Examples: MutatingAdmissionWebhook, ValidatingAdmissionWebhook, PodSecurity, ResourceQuota. The kube-apiserver is the front-end of the Kubernetes control plane and the only component that talks directly to etcd. It validates and processes REST requests, authenticates/authorizes callers, and serves as the central hub for all cluster component communication. A ReplicaSet ensures a specified number of Pod replicas are running at all times. If a Pod fails, the ReplicaSet creates a replacement. Key fields:

spec.replicas – desired Pod count
spec.selector – label selector to identify Pods
spec.template – Pod template

Note: Deployments manage ReplicaSets; use Deployments instead of bare ReplicaSets.