Interview Questions & Answers
Kubernetes • AWS RDS (MySQL) • Security • Networking • K8s Networking
Kubernetes
Q: What is the difference between a Deployment and a StatefulSet?
Deployments are for stateless apps — pods are interchangeable. StatefulSets are for stateful
apps (like databases) where each pod has a stable identity, persistent storage, and ordered
startup/shutdown.
Q: How does a Kubernetes Service work?
A Service provides a stable IP and DNS name to a set of pods selected by labels. Types:
ClusterIP (internal), NodePort (exposes on node), LoadBalancer (cloud LB), ExternalName (DNS
alias).
Q: What is a ConfigMap vs a Secret?
ConfigMap stores non-sensitive config as key-value pairs. Secret stores sensitive data
(passwords, tokens) base64-encoded. Secrets can be mounted as volumes or env vars, and
should be encrypted at rest in production.
Q: What happens when a node goes down?
The controller manager detects the node is NotReady. After a timeout, pods on that node are
evicted and rescheduled on healthy nodes (if managed by a Deployment/ReplicaSet).
Q: What is a PodDisruptionBudget?
It limits how many pods of a deployment can be unavailable during voluntary disruptions (like
node drains). Ensures minimum availability during rolling updates or maintenance.
Q: How does HPA work?
Horizontal Pod Autoscaler watches metrics (CPU, memory, custom) via the metrics server and
scales the number of pod replicas up or down based on thresholds you define.
Q: What is the role of etcd in Kubernetes?
etcd is the distributed key-value store that holds all cluster state — nodes, pods, configs, secrets.
It's the source of truth for the control plane.
Q: Explain liveness vs readiness probes.
Liveness probe restarts a container if it fails (app is stuck/crashed). Readiness probe removes
the pod from Service endpoints if it fails (app not ready to serve traffic yet).
Q: What is a DaemonSet?
A DaemonSet ensures one pod runs on every node (or a subset). Used for node-level agents like
log collectors (Fluentd), monitoring (Prometheus node exporter), or CNI plugins.
Q: What is a Namespace in Kubernetes?
Namespaces provide logical isolation within a cluster. They scope resources like pods, services,
and secrets. Useful for separating environments (dev/staging/prod) or teams in the same cluster.
Q: What is RBAC in Kubernetes?
Role-Based Access Control. You define Roles (namespace-scoped) or ClusterRoles (cluster-
wide) with allowed verbs/resources, then bind them to users or service accounts via RoleBinding
or ClusterRoleBinding.
Q: What is a PersistentVolume and PersistentVolumeClaim?
PersistentVolume (PV) is a piece of storage provisioned in the cluster. PersistentVolumeClaim
(PVC) is a request for storage by a pod. The cluster binds a PVC to a matching PV based on size
and access mode.
AWS RDS with MySQL
Q: What is Multi-AZ in RDS and why use it?
Multi-AZ creates a synchronous standby replica in a different AZ. On failure, RDS automatically
fails over to the standby. Used for high availability, not for read scaling.
Q: What's the difference between Multi-AZ and Read Replicas?
Multi-AZ is for HA/failover (synchronous, same region). Read Replicas are for read scaling
(asynchronous replication, can be cross-region). Read Replicas can be promoted to standalone
instances.
Q: How do you secure an RDS instance?
Place it in a private subnet, use Security Groups to restrict access, enable encryption at rest
(KMS) and in transit (SSL/TLS), use IAM database authentication, and enable audit logging.
Q: What is RDS Parameter Group?
A container for MySQL engine configuration values (like max_connections , innodb_buffer_pool_size ).
You attach a parameter group to an RDS instance to tune behavior.
Q: How do you handle RDS backups?
RDS supports automated backups (point-in-time recovery up to 35 days) and manual snapshots.
Automated backups are stored in S3 and can restore to any second within the retention window.
Q: What is RDS Proxy and when would you use it?
RDS Proxy sits between your app and RDS, pooling and sharing database connections. Useful
for Lambda functions or microservices that open many short-lived connections, preventing
connection exhaustion.
Q: How do you migrate a MySQL database to RDS?
Use AWS DMS (Database Migration Service) for minimal downtime migrations, or mysqldump +
restore for smaller databases. For large datasets, use Percona XtraBackup with S3.
Q: What is the difference between RDS and Aurora MySQL?
Aurora is AWS's cloud-native MySQL-compatible engine. It offers up to 5x performance over
standard MySQL, auto-scaling storage, faster failover, and up to 15 read replicas vs 5 for
standard RDS MySQL.
Q: How do you monitor RDS performance?
Use CloudWatch metrics (CPU, FreeStorageSpace, DatabaseConnections), Enhanced
Monitoring for OS-level metrics, and Performance Insights for query-level analysis and wait event
visibility.
Security
Q: What is the principle of least privilege?
Grant only the minimum permissions needed to perform a task. In AWS, this means scoped IAM
policies. In Kubernetes, use RBAC with minimal ClusterRole/Role bindings.
Q: What is the difference between authentication and authorization?
Authentication verifies identity (who are you?). Authorization determines what you're allowed to
do (what can you access?).
Q: What is a SQL injection and how do you prevent it?
Attacker injects malicious SQL via user input. Prevent with parameterized queries/prepared
statements, input validation, and ORMs that handle escaping.
Q: What is TLS and why does it matter?
TLS encrypts data in transit between client and server, preventing eavesdropping and MITM
attacks. Always enforce TLS for database connections and APIs.
Q: What is IAM Role vs IAM User in AWS?
IAM User has long-term credentials (access key/secret). IAM Role has temporary credentials
assumed by services, EC2, Lambda, etc. Roles are preferred — no static credentials to leak.
Q: What is a CVE?
Common Vulnerabilities and Exposures — a public identifier for known security vulnerabilities.
You track CVEs to patch vulnerable software versions in your containers and OS.
Q: What is secrets management and how do you handle it in Kubernetes?
Secrets management is securely storing and accessing sensitive data. In K8s, use Kubernetes
Secrets (encrypted at rest with KMS), or external tools like HashiCorp Vault or AWS Secrets
Manager with the CSI driver.
Q: What is a Pod Security Admission (PSA)?
PSA replaced PodSecurityPolicy in K8s 1.25+. It enforces security standards (privileged,
baseline, restricted) at the namespace level, controlling what pods are allowed to do (run as root,
host network, etc.).
Q: What is container image scanning?
Scanning container images for known CVEs before deploying. Tools: Trivy, Snyk, AWS ECR
image scanning. Best practice is to scan in CI/CD pipeline and block deployments with critical
vulnerabilities.
General Networking & AWS
Q: What is the difference between TCP and UDP?
TCP is connection-oriented, reliable, ordered delivery with handshake. UDP is connectionless,
faster, no guarantee of delivery. TCP for databases/APIs, UDP for DNS/video streaming.
Q: What is a VPC in AWS?
Virtual Private Cloud — an isolated network in AWS where you define IP ranges (CIDR), subnets,
route tables, internet gateways, and security groups.
Q: What is the difference between a Security Group and a NACL?
Security Groups are stateful (return traffic allowed automatically), applied at instance level.
NACLs are stateless (you must allow inbound and outbound explicitly), applied at subnet level.
Q: What is a NAT Gateway?
Allows instances in private subnets to initiate outbound internet traffic (e.g., pull updates) without
being directly reachable from the internet.
Q: What is DNS and how does Route 53 work?
DNS translates domain names to IPs. Route 53 is AWS's DNS service supporting routing policies
like simple, weighted, latency-based, failover, and geolocation.
Q: What is a CIDR block?
Classless Inter-Domain Routing — a notation like [Link]/16 that defines an IP range. /16 gives
65,536 addresses, /24 gives 256. Used to define VPC and subnet ranges.
Q: What is the difference between a public and private subnet?
Public subnet has a route to an Internet Gateway (instances can be internet-accessible). Private
subnet has no direct internet route — traffic goes through NAT Gateway or stays internal.
Q: What is VPC Peering?
A networking connection between two VPCs that allows traffic to route between them using
private IPs. It's non-transitive — if VPC A peers with B and B peers with C, A cannot reach C
through B.
Q: What is AWS Transit Gateway?
A hub that connects multiple VPCs and on-premises networks through a central gateway. Solves
the non-transitive limitation of VPC peering at scale.
Q: What is the difference between an ALB and NLB?
ALB (Application Load Balancer) operates at L7 — supports HTTP/HTTPS, path/host routing,
WebSockets. NLB (Network Load Balancer) operates at L4 — handles TCP/UDP, ultra-low
latency, preserves source IP.
Pod Networking
Q: How do pods communicate with each other in Kubernetes?
Every pod gets its own IP address. Pods can communicate directly using those IPs without NAT
— this is the flat network model enforced by the CNI plugin (Calico, Flannel, Cilium, etc.).
Q: What is the CNI (Container Network Interface)?
CNI is a spec that defines how networking plugins integrate with Kubernetes. When a pod is
created, kubelet calls the CNI plugin to assign an IP and set up network interfaces. Popular CNIs:
Calico, Flannel, Cilium, Weave.
Q: Can two pods on different nodes communicate directly?
Yes. The CNI plugin sets up an overlay network (or BGP routes) so pods across nodes can reach
each other using pod IPs directly, without NAT.
Q: What is a pause container (infra container)?
Every pod has a hidden pause container that holds the network namespace. All other containers
in the pod share that namespace — meaning they share the same IP and port space.
Q: What happens if two containers in the same pod use the same port?
They conflict and one will fail to start. Containers in the same pod share the network namespace,
so ports must be unique within a pod.
Services & DNS
Q: How does Kubernetes DNS work?
CoreDNS runs as a pod in the cluster. Every service gets a DNS entry like <service>.
<namespace>.[Link] . Pods resolve service names using this DNS automatically.
Q: What is a headless service?
A service with clusterIP: None . Instead of a single virtual IP, DNS returns the IPs of all backing
pods directly. Used with StatefulSets so clients can connect to specific pods.
Q: How does kube-proxy work?
kube-proxy runs on every node and maintains iptables (or IPVS) rules that forward traffic from a
Service's ClusterIP to one of the backing pod IPs. It watches the API server for endpoint changes.
Q: What is the difference between iptables and IPVS mode in kube-proxy?
iptables uses sequential rule matching — gets slow at scale. IPVS uses kernel-level load
balancing with hash tables, much faster for clusters with thousands of services.
Q: What is an Endpoints object?
When you create a Service, Kubernetes automatically creates an Endpoints object that lists the
pod IPs matching the service selector. kube-proxy uses this to route traffic.
Q: What is EndpointSlice?
A scalable replacement for Endpoints. Instead of one large Endpoints object, EndpointSlices split
pod IPs into smaller chunks (default 100 per slice), reducing API server load in large clusters.
Ingress & Load Balancing
Q: What is an Ingress and how is it different from a Service?
A Service exposes pods at L4 (TCP/UDP). Ingress operates at L7 (HTTP/HTTPS) and provides
host/path-based routing, TLS termination, and name-based virtual hosting — all through a single
LoadBalancer IP.
Q: What is an Ingress Controller?
The Ingress resource is just config — you need a controller to implement it. Popular ones: NGINX
Ingress Controller, Traefik, AWS ALB Ingress Controller, Istio Gateway. Without a controller,
Ingress does nothing.
Q: How does TLS termination work with Ingress?
You create a TLS Secret with the cert and key, reference it in the Ingress spec under tls . The
Ingress Controller handles the SSL handshake and forwards plain HTTP to backend pods.
Q: What is the difference between NodePort and LoadBalancer service types?
NodePort exposes a port on every node's IP (30000-32767 range) — you manage the external
LB yourself. LoadBalancer provisions a cloud load balancer automatically and routes to NodePort
under the hood.
Q: What is ExternalTrafficPolicy and why does it matter?
Cluster (default) routes to any pod but loses the client's source IP. Local preserves source IP
but only routes to pods on the same node — can cause uneven load.
Network Policies
Q: What is a NetworkPolicy in Kubernetes?
A NetworkPolicy is a firewall rule for pods. It controls ingress and egress traffic based on pod
selectors, namespace selectors, and IP blocks. Without any policy, all pod-to-pod traffic is
allowed.
Q: Are NetworkPolicies enforced by default?
No. You need a CNI plugin that supports NetworkPolicy (Calico, Cilium, Weave). Flannel alone
does NOT enforce NetworkPolicies.
Q: How do you deny all traffic to a namespace by default?
apiVersion: [Link]/v1
kind: NetworkPolicy
metadata:
name: deny-all
namespace: my-namespace
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
Empty podSelector matches all pods. No rules = all traffic denied.
Q: How do you allow only specific pods to talk to a database pod?
spec:
podSelector:
matchLabels:
app: mysql
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: backend
ports:
- port: 3306
Only pods with label app: backend can reach the mysql pod on port 3306.
Q: What is the difference between `from` with multiple list items vs combined selectors?
# OR logic — pod matches selector OR namespace matches
from:
- podSelector: ...
- namespaceSelector: ...
# AND logic — pod must match BOTH
from:
- podSelector: ...
namespaceSelector: ...
Separate list items = OR. Combined in one item = AND.
Service Mesh & Advanced
Q: What is a Service Mesh and why use it?
A service mesh (Istio, Linkerd) adds a sidecar proxy (Envoy) to every pod, handling mTLS, traffic
management, retries, circuit breaking, and observability — without changing app code.
Q: What is mTLS and how does Istio implement it?
Mutual TLS means both client and server authenticate each other. Istio's control plane (istiod)
issues certificates to each sidecar proxy. Traffic between pods is automatically encrypted and
authenticated.
Q: What is a ClusterIP and can you access it from outside the cluster?
ClusterIP is a virtual IP only routable inside the cluster via iptables rules. It's not accessible
externally by default. You need NodePort, LoadBalancer, or Ingress to expose it outside.
Q: How does pod-to-pod communication work across nodes with Calico?
Calico uses BGP to advertise pod CIDR routes between nodes. Each node knows the pod subnet
of every other node and routes traffic directly without an overlay tunnel (in BGP mode), making it
very efficient.
Q: What is a NetworkPolicy egress rule and when would you use it?
Egress rules control outbound traffic from pods. Use case: restrict a pod to only talk to specific
services or block internet access entirely — useful for security-sensitive workloads like databases
or payment services.