45 Kubernetes Interview Questions and Answers (2026)

Last updated: October 2026

Kubernetes interviews have a pattern. The first ten minutes are easy: what's a pod, what's a deployment, what's a service. Then the interviewer says, "Your pod is in CrashLoopBackOff. Walk me through what you'd do." That's where most candidates lose the round, not because they don't know Kubernetes, but because they've only read about it.

This guide covers 45 questions asked in DevOps, SRE, platform and cloud engineering interviews in India, from architecture basics to the troubleshooting scenarios that decide the outcome. The kubectl commands are included because interviewers often ask, "What command would you run?"

Kubernetes interview questions: the quick answer

• What gets tested: control plane and node components, pods, ReplicaSets and Deployments, Services and Ingress, ConfigMaps and Secrets, volumes and PVCs, StatefulSets and DaemonSets, probes, resource requests and limits, autoscaling (HPA), RBAC, network policies, Helm and troubleshooting.
• Typical format: concept questions, then 2–3 troubleshooting scenarios, sometimes a live task like "write a deployment YAML" or "expose this app".
• What wins: a methodical debugging approach: get → describe → logs → events, and explaining why.
• Platforms you'll hear about: EKS, AKS, GKE, OpenShift and self-managed clusters built with kubeadm.

Basics and architecture (1–12)

1. What is Kubernetes?

An open-source platform for running containers at scale. It schedules containers onto machines, restarts them when they fail, scales them up and down, rolls out new versions, and gives them stable networking and storage. Often written as K8s.

2. Why do we need Kubernetes if we already have Docker?

Docker builds and runs containers on one machine. Kubernetes manages many containers across many machines: self-healing, scaling, load balancing, rolling updates, service discovery, and config and secret management. Docker packages the app; Kubernetes runs it in production.

3. What are the main components of the control plane?

• kube-apiserver: the front door; every request goes through it.
• etcd: a distributed key-value store holding all cluster state.
• kube-scheduler: decides which node each new pod runs on.
• kube-controller-manager: runs controllers that keep actual state matching desired state (ReplicaSet, Node, Job controllers and others).
• cloud-controller-manager: talks to the cloud provider for load balancers, routes and nodes.

4. What runs on each worker node?

• kubelet: the agent that makes sure the containers described in pod specs are running and healthy.
• kube-proxy: sets up the network rules for Services (iptables or IPVS), though some CNIs like Cilium replace it.
• Container runtime: containerd or CRI-O, which actually runs the containers.

5. Kubernetes removed dockershim. Does that mean Docker images don't work anymore?

No. Since v1.24, Kubernetes no longer talks to the Docker Engine directly; it uses CRI runtimes like containerd. But images built with Docker follow the OCI standard and run perfectly. Only setups that depended on the Docker socket inside the cluster needed changes.

6. What is a pod?

The smallest deployable unit in Kubernetes: one or more containers that share a network namespace (one IP, can talk over localhost) and can share volumes. Pods are temporary; if one dies, a controller creates a new one with a new IP.

7. When would you run more than one container in a pod?

When containers are tightly coupled and must live together: a sidecar (log shipper, service mesh proxy), an adapter, or an ambassador. Init containers run to completion before the app container starts, for example to wait for a database or run migrations.

8. What is a namespace?

A way to divide one cluster into virtual groups, for teams, environments or apps. Names must be unique within a namespace; resource quotas, RBAC and network policies can be applied per namespace. Default namespaces: default, kube-system, kube-public and kube-node-lease.

9. What are labels and selectors?

Labels are key-value tags on objects (app: payments, env: prod). Selectors pick objects by label. That's how a Service finds its pods and how a Deployment knows which pods it owns.

10. What is the difference between declarative and imperative management?

Imperative: you tell Kubernetes exactly what to do (kubectl run, kubectl scale). Declarative: you describe the desired state in YAML and run kubectl apply, and Kubernetes works out the changes. Production setups are declarative and stored in Git (GitOps).

11. What happens when you run kubectl apply -f deployment.yaml?

1. kubectl sends the object to the API server, which authenticates, authorises and validates it.
2. The object is saved in etcd.
3. The Deployment controller creates a ReplicaSet, which creates pod objects.
4. The scheduler assigns each pod to a node.
5. The kubelet on that node tells the runtime to pull the image and start the containers.
6. Probes run, and the pod becomes Ready and is added to the Service's endpoints.

This is a favourite question to check whether you understand the architecture.

12. What is etcd, and why is it critical?

A consistent, distributed key-value store (using the Raft algorithm) that holds all cluster data. If etcd is lost without a backup, the cluster's state is gone. Back it up regularly (etcdctl snapshot save) and run 3 or 5 members for high availability.

Workloads (13–22)

13. What is a ReplicaSet?

A controller that keeps a specified number of identical pod replicas running. You rarely create one directly; Deployments manage ReplicaSets for you.

14. What is a Deployment?

A higher-level object for stateless apps that manages ReplicaSets and supports rolling updates and rollbacks.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
        - name: web
          image: nginx:1.27
          ports:
            - containerPort: 80
          resources:
            requests: { cpu: "100m", memory: "128Mi" }
            limits: { memory: "256Mi" }

15. How do rolling updates and rollbacks work?

When you change the pod template, for example the image tag, the Deployment creates a new ReplicaSet and shifts pods over gradually, controlled by maxSurge and maxUnavailable. If something goes wrong, roll back:

kubectl rollout status deployment/web
kubectl rollout history deployment/web
kubectl rollout undo deployment/web            # back to the previous version

16. What deployment strategies does Kubernetes support?

Deployments support RollingUpdate (the default) and Recreate (kill all old pods, then start new ones, which means downtime). Blue-green and canary releases are done with two Deployments plus Service or Ingress switching, or with tools like Argo Rollouts, Flagger or a service mesh.

17. What is a StatefulSet, and when do you use it?

A controller for stateful apps that need stable identities: databases, Kafka, Elasticsearch. Pods get stable names (db-0, db-1), stable network identities through a headless Service, their own persistent volumes, and ordered startup and shutdown.

18. What is a DaemonSet?

It runs one copy of a pod on every node (or on selected nodes). It's used for node-level agents: log collectors (Fluent Bit), monitoring agents (node-exporter), CNI plugins and storage drivers.

19. What are Jobs and CronJobs?

A Job runs pods until a task completes successfully, such as a database migration or a batch report. A CronJob creates Jobs on a schedule, such as a nightly backup at 2 a.m. (0 2 * * *).

20. What are liveness, readiness and startup probes?

• Liveness: "is the app still working?" If it fails, the kubelet restarts the container.
• Readiness: "is it ready for traffic?" If it fails, the pod is removed from Service endpoints but not restarted.
• Startup: "has it finished starting?" It holds off the other probes until the app is up, which is useful for slow-starting Java apps.

A common mistake: making the liveness probe check a database. If the database is slow, every pod restarts and makes things worse.

21. What are resource requests and limits?

Requests are what a container is guaranteed; the scheduler uses them to place pods. Limits are the maximum allowed. Going over the CPU limit gets the container throttled; going over the memory limit gets it OOMKilled. Setting requests correctly is the basis for stable clusters and good autoscaling.

22. What are QoS classes?

Kubernetes assigns each pod a Quality of Service class based on requests and limits: Guaranteed (requests equal limits for every container), Burstable (some requests set) and BestEffort (nothing set). Under memory pressure, BestEffort pods are evicted first and Guaranteed pods last.

Networking (23–29)

23. What is a Service, and why is it needed?

Pods come and go with changing IPs. A Service gives a stable virtual IP and DNS name (payments.prod.svc.cluster.local) that load-balances across the healthy pods matching its selector.

24. What are the Service types?

A headless Service (clusterIP: None) returns pod IPs directly; StatefulSets use it.

25. What is an Ingress?

An object holding HTTP/HTTPS routing rules (host and path based, TLS) that an Ingress controller like NGINX, Traefik or a cloud controller carries out. One load balancer can then serve many services: api.example.com/orders → orders service, /users → users service.

26. What is the Gateway API?

The newer, more expressive successor to Ingress, now generally available. It splits responsibilities into GatewayClass, Gateway and route types (HTTPRoute, GRPCRoute and others), and supports traffic splitting and header-based routing natively. Many teams are adopting it for new setups.

27. How does pod-to-pod networking work?

Kubernetes requires every pod to get its own IP and to be reachable from every other pod without NAT. A CNI plugin (Calico, Cilium, Flannel, or AWS VPC CNI on EKS) implements this. CoreDNS provides DNS names for Services.

28. What is a NetworkPolicy?

A firewall rule for pods: it controls which pods or namespaces can talk to which, on which ports. By default, all pods can talk to each other. A common practice is a "default deny" policy per namespace, then allowing only needed traffic. It needs a CNI that enforces policies, such as Calico or Cilium.

29. How would you expose an app to the internet securely?

Use an Ingress (or Gateway) behind a cloud load balancer, with TLS certificates managed by cert-manager (Let's Encrypt) or the cloud provider, a WAF where needed, network policies limiting which pods are reachable, and the app pods behind a ClusterIP Service rather than exposing them directly.

Config, storage and security (30–37)

30. What are ConfigMaps and Secrets?

ConfigMaps hold non-sensitive configuration (feature flags, URLs). Secrets hold sensitive data (passwords, tokens). Both can be mounted as files or injected as environment variables, so you don't bake config into images.

31. Are Kubernetes Secrets secure?

Not by default: they're only base64-encoded, not encrypted. Secure them by enabling encryption at rest for etcd (preferably with a cloud KMS), restricting access with RBAC, and using an external secret manager (AWS Secrets Manager, HashiCorp Vault) through the External Secrets Operator or the Secrets Store CSI driver.

32. What are PersistentVolumes and PersistentVolumeClaims?

A PersistentVolume (PV) is a piece of storage in the cluster (an EBS volume, Azure Disk or NFS share). A PersistentVolumeClaim (PVC) is a pod's request for storage of a certain size and access mode. Kubernetes binds the claim to a matching volume, so pods don't need to know storage details.

33. What is a StorageClass?

A template for dynamically provisioning storage: the provisioner (such as the EBS CSI driver), volume type, reclaim policy and whether volumes can be expanded. When a PVC asks for a StorageClass, a PV is created automatically.

34. What are the access modes for volumes?

ReadWriteOnce (mounted read-write by one node), ReadOnlyMany (read-only by many nodes), ReadWriteMany (read-write by many nodes, needs shared storage like NFS or EFS) and ReadWriteOncePod (exactly one pod).

35. What is RBAC in Kubernetes?

Role-Based Access Control. A Role (namespaced) or ClusterRole (cluster-wide) lists allowed verbs on resources. A RoleBinding or ClusterRoleBinding gives that role to users, groups or ServiceAccounts. Follow least privilege: for example, CI can only deploy to its own namespace.

36. What is a ServiceAccount?

An identity for processes running in pods, used to talk to the Kubernetes API, and on clouds also to get cloud permissions (IRSA or EKS Pod Identity on AWS, Workload Identity on GKE and AKS). Don't use the default ServiceAccount for apps that need permissions.

37. How do you harden a Kubernetes cluster?

Keep it updated, enforce Pod Security Admission (the "restricted" profile: no privileged containers, run as non-root, read-only root filesystem where possible), use RBAC and network policies, scan images, use trusted registries and signed images, encrypt Secrets, limit API server access, and enable audit logs. PodSecurityPolicy was removed in v1.25, so mention Pod Security Admission or tools like Kyverno and OPA Gatekeeper instead.

Scaling, tooling and scheduling (38–41)

38. What is the Horizontal Pod Autoscaler (HPA)?

It changes the number of pod replicas based on metrics, such as CPU at 70% or custom metrics like queue length, using metrics-server or a metrics adapter. KEDA extends this to event-driven scaling, including scaling to zero.

kubectl autoscale deployment web --cpu-percent=70 --min=3 --max=20

39. HPA vs VPA vs Cluster Autoscaler?

HPA adds or removes pods. VPA (Vertical Pod Autoscaler) adjusts a pod's CPU and memory requests. The Cluster Autoscaler, or Karpenter on AWS, adds or removes nodes when pods can't be scheduled or nodes sit idle. They work together: HPA creates pods, and the node autoscaler finds room for them.

40. What are taints, tolerations and node affinity?

Taints on a node repel pods; only pods with a matching toleration can run there, for example dedicated GPU nodes. Node affinity attracts pods to nodes with certain labels. Pod anti-affinity spreads replicas across nodes or zones so one failure doesn't take them all down. Topology spread constraints do this more precisely.

41. What is Helm?

A package manager for Kubernetes. A chart bundles templated YAML with default values; you install it as a release and override values per environment. It supports upgrades and rollbacks (helm upgrade, helm rollback). Kustomize is the template-free alternative built into kubectl, and Argo CD or Flux are used for GitOps deployment.

Troubleshooting scenarios (42–45)

42. A pod is in CrashLoopBackOff. How do you debug it?

The container keeps starting and crashing, and Kubernetes waits longer between restarts.

kubectl get pods -n prod
kubectl describe pod <pod> -n prod          # events, exit code, last state
kubectl logs <pod> -n prod --previous       # logs from the crashed container

Common causes: an app error at startup (missing config, a bad env var, can't reach the database), a wrong command or arguments, a failing liveness probe that kills it too early, or OOMKilled (exit code 137, so raise the memory limit or fix the leak). Fix the root cause, not the symptom.

43. A pod is stuck in Pending. Why?

The scheduler can't place it. Run kubectl describe pod and read the events. Usual reasons: not enough CPU or memory on any node (requests too high, or the cluster needs more nodes), taints with no matching toleration, node selector or affinity rules no node satisfies, a PVC that can't bind (wrong StorageClass, or a volume stuck in another AZ), or the namespace's resource quota is used up.

44. A pod shows ImagePullBackOff. What do you check?

The image name and tag (typos, a tag that doesn't exist), registry credentials (imagePullSecrets, or the node's IAM role for ECR), network access from nodes to the registry, and rate limits on public registries like Docker Hub. kubectl describe pod shows the exact pull error.

45. The Service is up but the app isn't reachable. How do you debug it?

Work layer by layer:

1. Are the pods Running and Ready? Readiness failures remove them from the Service.
2. Does the Service selector match the pod labels? kubectl get endpoints <svc> should list pod IPs; an empty list means a selector mismatch.
3. Do port and targetPort match the container port?
4. Test from inside the cluster: kubectl run tmp --rm -it --image=busybox -- wget -qO- http://<svc>:<port>.
5. Check Ingress rules, the Ingress controller logs, TLS, DNS and the cloud load balancer health checks.
6. Check that no NetworkPolicy is blocking the traffic.

Common mistakes candidates make

• Saying "I'd restart the pod" as the first troubleshooting step.
• Confusing liveness and readiness probes.
• Not setting resource requests in YAML answers.
• Thinking Secrets are encrypted by default.
• Exposing every service as a LoadBalancer instead of using an Ingress.
• Not knowing what happens behind kubectl apply.

A 7-day Kubernetes prep plan

The CKA (Certified Kubernetes Administrator) and CKAD exams are hands-on and well respected. Even if you don't take them, their practice tasks are great interview prep.

Which roles ask Kubernetes, and what they pay

Kubernetes is core for DevOps engineers, SREs, platform engineers and cloud engineers, and increasingly expected of senior backend developers. See the DevOps engineer salary guide and Weekday's salary pages for 2026 pay.

Related prep: DevOps interview questions, AWS interview questions, Azure DevOps interview questions, Linux interview questions, microservices interview questions and DevOps engineer resume examples.

Frequently asked questions

Is Kubernetes hard to learn?

The concepts take a few weeks; being comfortable troubleshooting takes months of hands-on use. Start with a local cluster (kind or minikube) and deploy a real app end to end.

Should I learn Docker before Kubernetes?

Yes. Understand images, containers, Dockerfiles, ports and volumes first. Kubernetes interviews assume you know them.

Is the CKA certification worth it?

Yes, especially for DevOps and platform roles. It's hands-on, so passing it shows practical skill, and many recruiters use it as a shortlisting filter.

What kubectl commands should I know for interviews?

get, describe, logs (with -f and --previous), exec -it, apply -f, delete, rollout status/undo, scale, port-forward, top, get events --sort-by=.lastTimestamp and explain.

Do backend developers need Kubernetes?

Increasingly, yes, at least the basics: Deployments, Services, ConfigMaps, probes, resource limits and reading logs. In many teams developers own their service's Helm chart or manifests.

Ready for DevOps and platform roles? Find Kubernetes and DevOps jobs on Weekday, and check your resume with our free ATS resume checker first.