Q: What are the most critical Kubernetes interview questions asked in senior DevOps and SRE interview loops? Walk me through the core architecture, pod lifecycle, service networking, and troubleshooting methodologies.

How the Kubernetes brain coordinates cluster state:

• kube-apiserver: The sole component that communicates with etcd. Validates, authenticates, mutates, and admits requests via admission webhooks.
• etcd Quorum & Raft: Distributed key-value store requiring an odd number of members (2N + 1). A 3-node cluster tolerates 1 node failure; a 5-node cluster tolerates 2 node failures.
• kube-scheduler: Two-phase scheduling algorithm: Filtering (predicates - finding nodes with resources/tolerations) and Scoring (priorities - ranking best nodes based on image locality and spread constraints).
• kube-controller-manager: Runs core reconciliation loops (DeploymentController, NodeController, EndpointsController) continuously driving actual state to desired state.

Understanding container initiation, health checks, and graceful shutdown:

• Startup Probe: Disables liveness and readiness checks during slow application boots (e.g. JVM warmup). If it fails after failureThreshold, container restarts.
• Readiness Probe: Determines if pod should receive traffic via Service endpoints. Failure removes pod from endpoint slices without restarting container.
• Liveness Probe: Detects deadlocks. Failure triggers Kubelet container kill and restart according to restartPolicy.
• Graceful Termination: Pod marked Terminating → removed from endpoints → preStop hook executes → SIGTERM sent → terminationGracePeriodSeconds (default 30s) → SIGKILL.

How packets flow across pods, services, and external ingress:

• Fundamental Network Model: Every pod receives a unique IP; all pods communicate without NAT; node-to-pod communication is flat.
• kube-proxy vs Cilium eBPF: Legacy kube-proxy translates Service ClusterIPs via iptables or IPVS rules (O(N) lookup degradation at high service counts). Cilium replaces iptables with eBPF maps for O(1) packet translation.
• CoreDNS Resolution: Queries follow the pattern ..svc.cluster.local. Beware the ndots:5 latency bug causing multiple trailing domain lookups.

The four classic Kubernetes production failures and their systematic diagnosis:

• CrashLoopBackOff: Check kubectl logs --previous to inspect why previous container crashed, followed by kubectl describe pod .
• ImagePullBackOff: Inspect pod Events for registry authentication errors, tag typos, or Docker Hub 429 rate limit errors.
• OOMKilled (Exit Code 137): Container exceeded cgroup memory limit; inspect kubectl describe pod Last State: Terminated Reason: OOMKilled and increase memory limits.
• Pending Pods: Scheduler cannot find a suitable node; check Events for Insufficient cpu/memory, untolerated node taints, or volume affinity conflicts.