Q: What's the difference between a pod and a container? A pod is the smallest deployable unit in Kubernetes. A pod contains one or more containers that share networking (same IP, same port space) and storage volumes. Containers are the actual runtime processes; the pod is the wrapper that groups them.
Q: Deployment vs StatefulSet? Deployments manage stateless workloads where any pod is interchangeable. StatefulSets give pods stable identities (pod-0, pod-1, pod-2), ordered startup and shutdown, and persistent storage that follows the pod identity. Use StatefulSets for databases, message brokers, and anything stateful.
Q: ReplicaSet vs Deployment? ReplicaSets maintain a stable set of replica pods. Deployments manage ReplicaSets and add rolling update / rollback capability. You almost never create a ReplicaSet directly — you create a Deployment, which creates a ReplicaSet under the hood.
Q: How does a Service find its pods? A Service selects pods via label selectors. Pods that match the labels get added to the Service's endpoint list. The kube-proxy on each node sets up iptables (or IPVS) rules to load-balance traffic across the matching pod IPs.
Q: ClusterIP vs NodePort vs LoadBalancer? ClusterIP is internal-only (default). NodePort exposes the Service on every node's IP at a static port (30000-32767). LoadBalancer provisions a cloud load balancer in front (ELB on AWS, etc.) — typically used with ALB Ingress Controller for HTTP.
Q: What's an Ingress? A Layer 7 (HTTP/HTTPS) routing rule. Takes hostname and path patterns and routes to backend Services. Needs an Ingress Controller running in the cluster (nginx, Traefik, AWS ALB Controller) to actually do the routing. Without a controller, an Ingress resource does nothing.
Q: ConfigMap vs Secret? Both store key-value data. ConfigMap is for non-sensitive data (config files, env vars). Secret is for sensitive data (API keys, passwords). Secrets are base64-encoded by default, which is NOT encryption — they need to be encrypted at rest in etcd (via KMS) to be properly secure.
Q: What's a DaemonSet for? Ensures one pod runs on every node (or every node matching a selector). Used for things that need to run per-node: log shippers (Fluentd, Fluent Bit), monitoring agents (Node Exporter, Datadog Agent), networking plugins (Cilium, Calico).
Q: How does autoscaling work? Three types:
- HPA (Horizontal Pod Autoscaler) — scales pod replicas based on CPU, memory, or custom metrics
- VPA (Vertical Pod Autoscaler) — adjusts pod resource requests/limits
- Cluster Autoscaler / Karpenter — adds or removes nodes based on pending pods
Q: How would you troubleshoot a failing pod?
kubectl get pods— check status (Pending, CrashLoopBackOff, ImagePullBackOff, etc.)kubectl describe pod <name>— events at the bottom show why it's failingkubectl logs <pod> [-c container]— container logskubectl logs <pod> --previous— logs from the previous crashkubectl exec -it <pod> -- /bin/sh— get a shell if the container is running
Q: What's a sidecar? A secondary container in the same pod as your main application container. Common uses: log forwarding, service mesh proxy (Envoy in Istio/Linkerd), config reloaders, init helpers.
Q: How does Kubernetes know if a pod is healthy? Three probe types:
- Liveness probe — restart the container if this fails
- Readiness probe — remove the pod from Service endpoints if this fails (still running, just not receiving traffic)
- Startup probe — for slow-starting apps; delays liveness checks until startup is complete