Interview self-assessment
This interactive assessment covers Helm, Flux, GitOps security, and troubleshooting. Progress and answers are stored only in your browser's local storage.
Quiz results are saved to your browser's local storage and will persist between sessions.
Reset quiz
Helm
Inside with .Values.image, how do you access the release name?
with changes dot to the selected object, while $ retains the root context.
Which value has the highest precedence?
--set and --set-string override values files, parent values, and dependency defaults.
What does --atomic do during a Helm upgrade?
An atomic upgrade waits for readiness and rolls back when the operation fails.
Why add values.schema.json to a chart?
Schema validation catches invalid input before a release reaches the Kubernetes API.
Why add a ConfigMap checksum to a Pod-template annotation?
A changed checksum changes the Pod template, so the Deployment controller creates a rollout.
Which statement about Helm CRDs is correct?
Helm deliberately avoids normal automatic upgrade and deletion behavior for CRDs because their blast radius extends beyond one release.
Flux
Which controller fetches Git and OCI artifacts?
Source-controller acquires external content and publishes artifacts for downstream reconcilers.
What does prune: true do on a Flux Kustomization?
Pruning garbage-collects objects previously managed by the Kustomization but no longer declared in its source.
How are HelmRelease valuesFrom sources merged?
Order is significant. Inline values normally have the final precedence, while targetPath has special replacement behavior.
What does Flux Kustomization dependsOn guarantee?
dependsOn gates on the dependency's Ready condition. It cannot resolve a circular dependency.
An OCIRepository is non-Ready with HTTP 403. What should you investigate first?
Verify the OCI URL, source-controller identity, Workload Identity mapping, and repository-scoped Artifact Registry permissions.
Why can a manual helm rollback disappear under Flux?
Git remains the durable desired state. Correct or revert Git instead of relying on an out-of-band rollback.
When is ignoring /spec/replicas in drift detection commonly justified?
Ignore only intentionally shared fields. Broad drift exclusions can hide unauthorized changes.
Security and operations
Why prefer GKE Workload Identity over a service-account JSON key?
Workload Identity supports short-lived credentials, IAM auditability, and revocation without distributing a key file.
Is the value in a base64 Kubernetes Secret encrypted?
Base64 is reversible. Use SOPS/KMS or an external secret system for protected GitOps secret workflows.
Git contains the expected commit, but the application did not change. What is the strongest first diagnostic step?
Start with the earliest source and move downstream. This preserves evidence and identifies the owning controller.
The source and HelmRelease are Ready, but Pods are not. Which layer owns the immediate failure investigation?
Inspect Deployment and Pod conditions, events, scheduling, image pulls, probes, resources, and application logs.
Which action is a durable recovery for a nonexistent chart tag?
Repair the declared source reference and let reconciliation restore a valid state.
Which is the strongest production promotion signal?
Immutable references and reviewed desired-state changes make promotion reproducible and auditable.
Which answer style provides the strongest interview signal?
A structured diagnosis demonstrates mental models and engineering judgment, not command memorization.
Quiz Progress
0 / 0 questions answered
(0% )
0 correct
Quiz Complete!
0%
Reset quiz
Next step
For every incorrect response, explain why each alternative was wrong. Then answer the corresponding open question in the question bank before reading its model answer .
Answered: 0 / 0
Correct: 0 / 0
Reset