Learn Kubernetes
Orchestrate containers at scale — the backbone of modern cloud-native platforms.
Kubernetes is an open-source platform, originally built by Google and now governed by the Cloud Native Computing Foundation, for automating the deployment, scaling, and management of containerized applications. It groups containers into logical units called Pods and continuously reconciles the cluster's actual state toward a declared desired state. Nearly every managed cloud offers it — EKS on AWS, AKS on Azure, and GKE on GCP — making it a near-universal skill for platform and DevOps engineers.
Kubernetes roadmap
- 1
Master containers first
Understand images, layers, and the container runtime before touching orchestration — Kubernetes assumes you already think in containers.
- 2
Core objects: Pods, ReplicaSets, Deployments
Learn how a Deployment manages ReplicaSets, which manage Pods, and why you almost never create bare Pods.
- 3
Networking: Services and Ingress
ClusterIP, NodePort, and LoadBalancer Services expose Pods; Ingress adds host/path-based HTTP routing on top.
- 4
Configuration: ConfigMaps and Secrets
Decouple config and credentials from images; know that Secrets are base64-encoded, not encrypted, unless you enable encryption at rest.
- 5
Storage: Volumes, PVs, and PVCs
PersistentVolumeClaims bind to PersistentVolumes so stateful workloads survive Pod rescheduling.
- 6
Scheduling and resilience
Requests/limits, liveness/readiness probes, taints, tolerations, and affinity control where and how Pods run.
- 7
Scaling and rollouts
Horizontal Pod Autoscaler, rolling updates, and rollbacks keep apps available under changing load.
- 8
Packaging and operations
Helm charts, RBAC, namespaces, and observability (metrics, logs, events) round out real-world cluster work.
Top Kubernetes interview questions
Real questions with concise, correct answers. Click to expand each.
What is a Pod, and why not deploy a single container directly?+
A Pod is the smallest deployable unit in Kubernetes and wraps one or more tightly-coupled containers that share a network namespace (same IP and port space) and storage volumes. You deploy Pods rather than raw containers because Kubernetes schedules, scales, and heals at the Pod level, and a Pod can co-locate helper (sidecar) containers alongside the main app.
What is the difference between a Deployment and a StatefulSet?+
A Deployment manages stateless, interchangeable Pods with random names and no stable identity or ordering. A StatefulSet gives each Pod a stable, ordinal identity (pod-0, pod-1), stable network name, and its own persistent volume, plus ordered, sequential rollout and scaling — needed for databases and clustered systems.
How do liveness and readiness probes differ?+
A liveness probe checks whether a container is still healthy; if it fails, Kubernetes restarts the container. A readiness probe checks whether a container is ready to serve traffic; if it fails, the Pod is removed from Service endpoints but not restarted. A slow-starting app that is alive but not yet ready needs both configured correctly.
How does a Service route traffic to Pods?+
A Service selects Pods by label and maintains a stable virtual IP (ClusterIP). Kubernetes keeps an Endpoints/EndpointSlice list of matching Pod IPs, and kube-proxy (via iptables or IPVS) load-balances traffic across them. ClusterIP is internal-only, NodePort opens a port on every node, and LoadBalancer provisions an external cloud load balancer.
What happens when you run 'kubectl apply'?+
kubectl sends the manifest to the API server, which validates it and persists the desired state in etcd. The relevant controller notices the difference between desired and actual state and creates/updates objects; the scheduler assigns new Pods to nodes, and the kubelet on each node instructs the container runtime to start them.
What is the difference between a ConfigMap and a Secret?+
Both inject configuration into Pods as environment variables or mounted files. A ConfigMap is for non-sensitive data stored in plain text. A Secret is for sensitive data and is base64-encoded — which is encoding, not encryption — so you should enable encryption at rest for etcd and restrict access with RBAC to protect Secrets properly.
Kubernetes cheat sheet
kubectl get pods -AList all Pods across every namespace.
kubectl describe pod <name>Show events, status, and config for debugging a Pod.
kubectl logs -f <pod>Stream a container's logs live.
kubectl apply -f file.yamlDeclaratively create/update resources from a manifest.
kubectl rollout undo deploy/<name>Roll a Deployment back to its previous revision.
kubectl exec -it <pod> -- shOpen an interactive shell inside a running container.
kubectl scale deploy/<name> --replicas=5Manually change the replica count.
kubectl get events --sort-by=.lastTimestampSee recent cluster events, newest last — key for triage.
Kubernetes certifications
CKA — Certified Kubernetes Administrator
The CNCF's hands-on, performance-based exam for cluster operations, networking, and troubleshooting.
CKAD — Certified Kubernetes Application Developer
Focuses on designing, building, and deploying apps on Kubernetes rather than cluster administration.
CKS — Certified Kubernetes Security Specialist
Advanced cluster-hardening cert; requires a current CKA as a prerequisite.
Ready to ace the interview?
This hub gets you started. Our Kubernetes interview kit goes deeper — hundreds of curated questions, model answers, and mock scenarios built to get you hired.