Kubernetes interview questions for freshers focus on the architecture (control plane and nodes), core objects such as Pods, Deployments, Services and ConfigMaps, scaling, networking, storage and basic troubleshooting with kubectl. Below are 30 questions with concise answers and YAML or command examples, grouped from basics to scenarios, so you can prepare for DevOps, cloud and SRE interviews in a structured way.
Key takeaways
- Kubernetes schedules and manages containers across a cluster; the control plane decides, and worker nodes run the Pods.
- You rarely create Pods directly: a Deployment manages ReplicaSets, which keep the right number of Pods running and handle rolling updates.
- A Service gives Pods a stable name and IP; ClusterIP is internal, NodePort and LoadBalancer expose apps outside the cluster.
- Keep configuration in ConfigMaps and sensitive values in Secrets, and remember Secrets are only base64-encoded unless encryption at rest is enabled.
- For troubleshooting, the usual order is kubectl get, kubectl describe, kubectl logs and then kubectl exec.
Kubernetes basics
1. What is Kubernetes?
Kubernetes, often written K8s, is an open-source container orchestration platform. It deploys containers across many machines, restarts them when they fail, scales them up and down and rolls out new versions without downtime. It was originally designed at Google and is now maintained under the Cloud Native Computing Foundation.
2. Why do we need Kubernetes if we already have Docker?
Docker builds and runs containers on one machine. Kubernetes manages many containers on many machines: scheduling, self-healing, service discovery, scaling and rolling updates. They solve different problems. If Docker is new to you, start with our Docker tutorial for beginners.
3. Explain the Kubernetes architecture.
The control plane has the kube-apiserver (front door for all requests), etcd (key-value store for cluster state), the kube-scheduler (chooses a node for each new Pod) and the kube-controller-manager (runs controllers that keep actual state equal to desired state). Each worker node runs the kubelet (starts and monitors Pods), kube-proxy (handles Service networking) and a container runtime such as containerd.
4. What is a Pod?
A Pod is the smallest deployable unit. It holds one or more containers that share a network namespace (same IP) and can share volumes. Most Pods have one main container, sometimes with a helper sidecar.
5. What is desired state?
You declare what you want in YAML, for example three replicas of an image. Controllers continuously compare that with what is actually running and fix any difference. This reconciliation loop is the core idea of Kubernetes.
6. What is a namespace?
A namespace is a logical partition inside a cluster used to separate teams or environments. Resource quotas and access rules can be applied per namespace. Some objects, such as nodes, are cluster-wide.
Workloads
7. What is the difference between a ReplicaSet and a Deployment?
A ReplicaSet keeps a set number of identical Pods running. A Deployment manages ReplicaSets and adds rolling updates and rollbacks. You normally create Deployments, not ReplicaSets.
8. Write a basic Deployment.
apiVersion: apps/v1
kind: Deployment
metadata:
name: web
spec:
replicas: 3
selector:
matchLabels:
app: web
template:
metadata:
labels:
app: web
spec:
containers:
- name: web
image: nginx:1.27
ports:
- containerPort: 809. How does a rolling update work, and how do you roll back?
When you change the Pod template, the Deployment creates a new ReplicaSet and shifts Pods gradually, controlled by maxSurge and maxUnavailable. To roll back:
kubectl rollout status deployment/web
kubectl rollout history deployment/web
kubectl rollout undo deployment/web10. What is a StatefulSet?
A StatefulSet runs Pods that need a stable identity and their own persistent storage, such as databases. Pods get ordered names (db-0, db-1) and each keeps its own volume across restarts.
11. What is a DaemonSet?
A DaemonSet runs one copy of a Pod on every node (or selected nodes). It is used for log collectors, monitoring agents and network plugins.
12. What are Jobs and CronJobs?
A Job runs Pods until a task completes successfully, such as a database migration. A CronJob creates Jobs on a schedule, such as a nightly backup.
Networking
13. What is a Service and why is it needed?
Pods are temporary and their IPs change. A Service gives a stable virtual IP and DNS name and load-balances traffic to the Pods that match its label selector.
14. Explain the Service types.
| Type | Reachable from | Typical use |
|---|---|---|
| ClusterIP | Inside the cluster only | Internal APIs and databases |
| NodePort | Each node IP on a fixed high port | Testing and simple setups |
| LoadBalancer | A cloud load balancer | Exposing an app on AWS, Azure or GCP |
| ExternalName | DNS alias to an outside name | Pointing to an external service |
15. What is an Ingress?
An Ingress defines HTTP and HTTPS routing rules, such as sending /api to one Service and / to another, often with TLS. It needs an Ingress controller such as ingress-nginx to work. The newer Gateway API is a more flexible successor that many clusters are adopting.
16. How do Pods find each other?
Through cluster DNS (CoreDNS). A Service named api in namespace shop is reachable at api.shop.svc.cluster.local, or simply api from the same namespace.
17. What is a NetworkPolicy?
A NetworkPolicy restricts which Pods can talk to which, like a firewall inside the cluster. It only takes effect if the network plugin supports it.
Configuration and storage
18. What is the difference between a ConfigMap and a Secret?
Both inject configuration as environment variables or files. ConfigMaps hold non-sensitive settings. Secrets hold passwords and tokens; they are base64-encoded, not encrypted by default, so enable encryption at rest and restrict access with RBAC, or use an external secrets manager.
19. What are PersistentVolumes and PersistentVolumeClaims?
A PersistentVolume (PV) is a piece of storage in the cluster. A PersistentVolumeClaim (PVC) is a request for storage by a Pod. With a StorageClass, PVs are created automatically when a PVC is made, for example as an EBS volume on AWS.
20. What happens to data in an emptyDir volume when a Pod is deleted?
It is lost. emptyDir lives only as long as the Pod. Use a PVC for data that must survive.
Scaling, health and scheduling
21. What are liveness, readiness and startup probes?
A liveness probe restarts a container that is stuck. A readiness probe removes a Pod from Service traffic until it is ready. A startup probe gives slow-starting apps time before liveness checks begin.
22. What is the Horizontal Pod Autoscaler?
The HPA changes the number of replicas based on metrics such as CPU usage. It needs the metrics server and resource requests set on the containers.
kubectl autoscale deployment web --cpu-percent=70 --min=2 --max=1023. What are resource requests and limits?
Requests are what the scheduler reserves for a container; limits are the maximum it may use. A container that exceeds its memory limit is killed with OOMKilled; one that exceeds its CPU limit is throttled.
24. What are taints, tolerations and node affinity?
A taint on a node repels Pods that do not tolerate it, for example to keep GPU nodes for GPU workloads. Node affinity attracts Pods to nodes with certain labels.
Security and operations
25. What is RBAC in Kubernetes?
Role-based access control defines who can do what. Roles and ClusterRoles list allowed actions on resources, and RoleBindings attach them to users, groups or service accounts. Follow least privilege.
26. What is Helm?
Helm is a package manager for Kubernetes. A chart bundles templated YAML with default values, so you can install, upgrade and roll back an application with one command.
27. What are managed Kubernetes services?
Amazon EKS, Azure AKS and Google GKE run the control plane for you, so you manage only workloads and nodes. Most companies use one of these rather than building clusters by hand.
Troubleshooting scenarios
28. A Pod is in CrashLoopBackOff. How do you debug it?
kubectl describe pod <pod-name>
kubectl logs <pod-name> --previousCheck the events and the logs of the last crashed container. Common causes are a bad command, a missing environment variable or Secret, a failing liveness probe or an app error on start-up.
29. A Pod is stuck in Pending. What do you check?
Run kubectl describe pod and read the events. Usually there is not enough CPU or memory on any node, a PVC cannot be bound, or taints and selectors prevent scheduling.
30. A Service is not reaching its Pods. What do you check?
Check that the Service selector matches the Pod labels, that kubectl get endpoints shows Pod IPs, that the targetPort matches the container port and that readiness probes are passing. Then test from inside the cluster with a temporary Pod.
How to prepare for a Kubernetes interview
- Run a local cluster with kind or minikube and deploy a small app with a Deployment, Service, ConfigMap and Ingress.
- Break things on purpose: a wrong image tag, a wrong selector, a missing Secret, and practise fixing them.
- Learn to explain one project end to end: Dockerfile, CI pipeline, Kubernetes manifests and monitoring.
- Revise the wider toolchain with our DevOps interview questions and DevOps roadmap.
Frequently asked questions
Is Kubernetes hard to learn for freshers?
It has many concepts, but it is manageable if you learn Linux, networking basics and Docker first. Most people can handle the core objects after a few weeks of hands-on practice.
Do I need a certification for Kubernetes jobs?
It is not required, but the CKA or CKAD exams are well respected because they are practical. Projects you can explain are just as important. Check the Linux Foundation website for current exam details.
Which kubectl commands should I know for interviews?
get, describe, logs, exec, apply, delete, rollout, scale, port-forward and top. Be ready to use them in a troubleshooting scenario.
Is Kubernetes replacing Docker?
No. Kubernetes stopped using Docker Engine as a built-in runtime and uses containerd or CRI-O instead, but images built with Docker run on Kubernetes without changes. Docker is still widely used to build images.
Explore more in our DevOps section.
