SRE Kubernetes and Container Orchestration

Question 1

What is the purpose of a Kubernetes 'liveness probe,' and how does it differ from a 'readiness probe'?

Accepted Answer

A liveness probe restarts a container that has deadlocked; a readiness probe removes a container from load balancer rotation when it cannot serve traffic

Answer

A liveness probe checks if a container is in the load balancer pool; a readiness probe checks if the container process is running

Answer

A liveness probe validates Kubernetes node health; a readiness probe validates pod health

Answer

Both probes perform identical checks; the difference is only in which team configures them

Question 2

A Kubernetes Deployment has 3 replicas. During a rolling update, what is the effect of setting maxSurge=1 and maxUnavailable=0?

Accepted Answer

At most 4 pods run simultaneously during the update (3 original + 1 new), and no pods are terminated until a new one is healthy — ensuring continuous availability

Answer

All 3 original pods are terminated and then 3 new pods are created, resulting in brief downtime

Answer

The update creates 1 new pod and terminates 3 old pods simultaneously, reducing capacity to 1 during the transition

Answer

maxSurge=1 and maxUnavailable=0 are incompatible settings that will cause the deployment to fail

Question 3

What is a Kubernetes PodDisruptionBudget (PDB) and when is it essential?

Accepted Answer

A PDB specifies the minimum number or percentage of pods that must remain available during voluntary disruptions like node drains, cluster upgrades, or maintenance

Answer

A PDB limits the CPU and memory resources a pod can consume to prevent resource contention

Answer

A PDB defines the maximum number of pods that can be scheduled on a single node

Answer

A PDB controls the rate at which pods are created during a deployment rollout

Question 4

In Kubernetes, what is the difference between a ConfigMap and a Secret, and what are the security implications?

Accepted Answer

ConfigMaps store non-sensitive configuration data as plain text; Secrets store sensitive data base64-encoded (not encrypted by default), and should be protected with RBAC, encryption at rest, and preferably external secret managers

Answer

ConfigMaps are cluster-scoped; Secrets are namespace-scoped, providing stronger isolation for sensitive data

Answer

Secrets are automatically encrypted by Kubernetes before storage; ConfigMaps are stored in plain text in etcd

Answer

ConfigMaps can be mounted as volumes; Secrets can only be injected as environment variables to prevent disk persistence

Question 5

What does Kubernetes horizontal pod autoscaling (HPA) do, and what metric is it MOST commonly configured to use?

Accepted Answer

HPA automatically adjusts the number of pod replicas based on observed metrics (most commonly CPU utilization), scaling out when demand increases and in when it decreases

Answer

HPA adjusts the CPU and memory limits of running pods based on their actual usage without changing the replica count

Answer

HPA distributes pods across nodes to maximize hardware utilization based on CPU load

Answer

HPA monitors pod health and replaces unhealthy pods with new ones during high-load periods

Question 6

A microservice running in Kubernetes is experiencing intermittent OOMKilled events. What is the MOST appropriate first response?

Accepted Answer

Analyze memory usage patterns using profiling tools to identify memory leaks or excessive allocation, then set appropriate memory limits and requests based on observed usage

Answer

Increase the memory limit to 10× the current value to prevent future OOMKilled events

Answer

Remove all memory limits so Kubernetes does not kill the pod when memory spikes

Answer

Scale the number of replicas to distribute memory load across more pods