How Kubernetes questions are asked in 2026
Kubernetes questions show up in three kinds of loops: platform and SRE roles, where they are the main topic; backend roles, where they take ten minutes of the system design round; and DevOps roles, where you may get a broken cluster and a shared terminal. The questions overlap, the depth does not.
Below are twenty questions that keep coming up, grouped by topic. For each one there is a short answer and the follow-up that separates a junior answer from a senior one. At the end: what changed in versions 1.33 to 1.35, because interviewers like to check whether you read release notes.
Basics: pods, deployments, services
| # | Question | Short answer | Senior follow-up |
|---|---|---|---|
| 1 | What is a pod and why not run containers directly? | The smallest schedulable unit: containers that share a network namespace and volumes | When would you put two containers in one pod, and when is that a mistake? |
| 2 | Deployment vs StatefulSet | Interchangeable replicas vs stable identity and per-replica storage | How do you scale a StatefulSet down without losing data? |
| 3 | What does a Service do? | A stable virtual IP and DNS name in front of pods chosen by labels | Traffic goes to a pod that is not ready. Why, and where do you look? |
| 4 | ClusterIP, NodePort, LoadBalancer | Inside the cluster; a port on every node; an external balancer from the cloud | What does each one cost on a managed cloud cluster? |
| 5 | Ingress vs Gateway API | Gateway API is the newer, role-oriented replacement with richer routing | Would you migrate an existing Ingress setup now? What breaks? |
Health, rollouts and failure
| # | Question | Short answer | Senior follow-up |
|---|---|---|---|
| 6 | Liveness vs readiness vs startup probe | Restart a stuck container; keep a pod out of traffic; give slow starts time | Which probe should never check the database, and why? |
| 7 | A pod is in CrashLoopBackOff. Your steps? | describe pod, logs --previous, events, then exit code | Exit code 137 vs 1: what does each tell you? |
| 8 | How does a rolling update work? | New ReplicaSet scales up while the old one scales down, limited by maxSurge and maxUnavailable | The new version passes readiness but returns errors. How do you stop the rollout automatically? |
| 9 | What is a PodDisruptionBudget? | A minimum of available pods during voluntary disruption such as node drains | Your PDB blocks a node upgrade for hours. What went wrong? |
| 10 | Pod stuck in Pending | No node fits: resources, taints, affinity, or an unbound volume | How do you tell a capacity problem from a scheduling rule problem in under a minute? |
Resources, scaling and scheduling
| # | Question | Short answer | Senior follow-up |
|---|---|---|---|
| 11 | Requests vs limits | Requests drive scheduling; limits cap usage. CPU over the limit is throttled, memory over it is killed | Should you set CPU limits at all? Argue both sides. |
| 12 | QoS classes | Guaranteed, Burstable, BestEffort, decided by requests and limits | Which pods go first under node memory pressure? |
| 13 | HPA vs VPA vs cluster autoscaler | More pods; bigger pods; more nodes | HPA on CPU scales a service that is slow because of the database. What happens? |
| 14 | Taints, tolerations, affinity | Keep pods off nodes; allow them back; attract them to nodes or to each other | How do you spread replicas across zones without breaking scheduling in a small cluster? |
| 15 | In-place pod resize | Stable since 1.35: change CPU and memory of a running pod without recreating it | Which workloads still need a restart after a resize, and why? |
Configuration, security and operations
| # | Question | Short answer | Senior follow-up |
|---|---|---|---|
| 16 | ConfigMap vs Secret | Plain configuration vs sensitive data; Secrets are only base64-encoded by default | How would you keep secrets out of etcd in plain form and out of Git? |
| 17 | RBAC: Role vs ClusterRole | Namespaced permissions vs cluster-wide; bound with RoleBinding or ClusterRoleBinding | A CI job needs to deploy to one namespace. Write the minimum permissions out loud. |
| 18 | NetworkPolicy | Allow-lists for pod traffic; without any policy, everything talks to everything | You add a deny-all policy and DNS breaks. Why? |
| 19 | Native sidecar containers | Stable since 1.33: init containers with restartPolicy Always that start before and stop after the main container | What problem did the old sidecar pattern have with Jobs? |
| 20 | How do you upgrade a cluster? | Control plane first, then node pools one at a time, after checking deprecated APIs | How many minor versions can the kubelet lag the API server, and why does it matter for upgrade order? |
What changed in 1.33 to 1.35
Interviewers do not expect you to know every release note. They do notice when a candidate describes a workaround that the platform has since replaced. Three changes are worth knowing:
- Native sidecars, stable in 1.33. Init containers with
restartPolicy: Always. They solve the old problem of a log shipper or proxy keeping a Job alive after the main container exits. - Dynamic Resource Allocation, core APIs GA in 1.34. A standard way to request GPUs and other devices with parameters, instead of fixed device-plugin counts. Expect it in AI infrastructure loops.
- In-place pod resize, stable in 1.35. CPU and memory of a running pod become mutable; the kubelet changes the cgroup without recreating the pod. Useful for JVM services with slow starts.
How to practise without a cluster at work
A laptop with kind or minikube is enough for every question above. The trick is to break things on purpose, then fix them while talking:
- Deploy a small service with three replicas and a readiness probe.
- Change the Service selector to a wrong label. Watch traffic stop. Find it with
kubectl get endpoints. - Set a memory limit of 64Mi on something that needs more. Read the OOMKilled event.
- Roll out an image tag that does not exist. Read the events and roll back.
- Add a deny-all NetworkPolicy and fix DNS by allowing port 53 to kube-system.
Five exercises, about two evenings. Then explain each failure to a partner on a pair mock: the explanation is what the interview scores.
The short version
Twenty questions cover most loops. Learn the short answers, then prepare for the follow-up, because that is where the level is decided. Know three recent changes, practise failures on a local cluster, and say the debugging steps out loud before the interview does it for you.
Related: system design interview prep, what is MLOps, system design for agentic AI.
Questions readers ask
-
Do I need a certification like CKA to pass?
No interviewer we know of requires it. It helps if you have no production Kubernetes on your CV, because it proves you have at least run kubectl under a clock.
Link to this answer -
How deep should a backend developer go?
Pods, deployments, services, probes, resource requests and how a rollout fails. Leave etcd internals and scheduler plugins to platform roles.
Link to this answer -
Which version should I study?
Whatever your target company runs, usually one or two minor versions behind the latest. Know that native sidecars went stable in 1.33 and in-place resize in 1.35.
Link to this answer -
Will they ask me to write YAML from memory?
Sometimes a short manifest, more often 'find what is wrong with this one'. Practise reading broken manifests more than writing perfect ones.
Link to this answer -
How do I practise without a cluster at work?
kind or minikube on a laptop is enough for every question in this list. Break things on purpose: wrong selector, failing probe, memory limit too low.
Link to this answer
Sources
- Kubernetes blog: v1.34 release, Dynamic Resource Allocation graduates to GA
- Kubernetes blog: v1.35, in-place Pod restart
- Kubernetes documentation: Sidecar containers
- Kubernetes documentation: Resize CPU and memory resources assigned to containers
Figures were checked against these pages in October 2026. Pay and dates change; the links show where to recheck.