Technical - Kubernetes

Question 1

Control Plane Components

Question 2

Worker Node Components

Question 3

Kubelet

Question 4

Service Mesh (w/examples)

Question 5

CNI (w/examples)

Question 6

Container Runtime (w/examples)

Question 7

Headless Service

Question 8

Service vs Ingress

Question 9

How do cloud controller managers integrate with cloud providers

Question 10

Deployment vs ReplicaSet vs StatefullSet

Question 11

Horizontal Pod Autoscaler vs Horizontal Node Autoscaler

Question 12

ConfigMap vs Secret (+ how to mount to pod)

Question 13

How does a namespace provide isolation

Question 14

How do pods / containers provide isolation

Question 15

How is networking between pods enabled and restricted

Question 16

Trace the network path from a cloud services network edge to a pod

Question 17

Kube-scheduler (+taints, affinity, and tolerations)

Question 18

Best practices for securing kubernetes clusters

Question 19

Helm vs Kustomize

Question 20

Liveness vs Readiness vs Startup Probes

Question 21

How would you implement a rolling, blue green, and canary deployment in kubernetes

Question 22

Static pods

Question 23

Init containers

Question 24

RBAC in Kubernetes

Question 25

hostIPC vs hostNetwork vs hostPID vs priveledgedMode

Question 26

How to use AppArmour to secure clusters

Question 27

How to secure secrets in kubernetes?

Answer 27

1. Sealed Secrets 2. External Secret Manager (Vault, AWS Secrets Manager)

Question 28

How to setup end to end encryption in EKS?

Answer 28

1. Terminate traffic within cluster (nginx) with service mesh (istio) handling transparency mTLS 2. Terminate traffic at service mesh (istio) ingress gateway 3. Terminate traffic at ingress ALB and setup encryption between ALB and ingress gateway (istio)

Question 29

How to manage DNS in EKS with Kubernetes native objects?

Answer 29

ExternalDNS

Question 30

Istio Architecture

Answer 30

1. Control Plane (istiod): service discovery, configuration, and cert management 2. Data Plane (envoy): side car proxies that manages TLS termination, load balancing, health checks, etc.

Question 31

AWS VPC CNI

Answer 31

Default EKS CNI which integrates EKS cluster into VPC. Limits available IP addresses due to ENI limits.

Question 32

How to integrate IAM and EKS?

Answer 32

1. AWS access entries/policies and k8s RBAC 2. IAM Roles for Service Accounts (IRSA)

Question 33

Node selectors vs node affinity