Kubernetes Container Orchestration CI/CD Integration 3 — Questions and Answers
Question 1: In a Kubernetes CI/CD pipeline, what is the primary advantage of using Kustomize overlays?
- It replaces Helm entirely for all use cases
- It allows environment-specific configuration patches without duplicating base manifests (Correct answer)
- It encrypts secrets before pushing to Git
- It automatically generates Dockerfiles from source code
Correct answer: It allows environment-specific configuration patches without duplicating base manifests
Kustomize overlays let you maintain a single base manifest and apply environment-specific patches (dev, staging, prod) without duplication.
Question 2: What Kubernetes mechanism prevents a CI/CD pipeline from deploying to a namespace it is not authorized to access?
- NetworkPolicy
- PodSecurityAdmission
- RBAC (Role-Based Access Control) (Correct answer)
- LimitRange
Correct answer: RBAC (Role-Based Access Control)
RBAC restricts which service accounts (used by CI/CD pipelines) can create, update, or delete resources in specific namespaces.
Question 3: A pipeline robot needs to deploy to a Kubernetes cluster. What is the recommended way to authenticate the pipeline?
- Use the cluster admin kubeconfig file directly
- Create a dedicated ServiceAccount with minimal RBAC permissions and use its token (Correct answer)
- Hard-code the cluster admin password in pipeline environment variables
- Use a shared developer kubeconfig rotated monthly
Correct answer: Create a dedicated ServiceAccount with minimal RBAC permissions and use its token
A dedicated ServiceAccount with least-privilege RBAC is the secure, auditable method for CI/CD pipeline authentication to Kubernetes.
Question 4: Which kubectl rollout command is used to immediately pause a deployment that is mid-rollout in a CD pipeline?
- kubectl rollout stop deployment/my-app
- kubectl rollout pause deployment/my-app (Correct answer)
- kubectl rollout undo deployment/my-app
- kubectl rollout freeze deployment/my-app
Correct answer: kubectl rollout pause deployment/my-app
kubectl rollout pause halts the rolling update in place, allowing investigation without fully rolling back.
Question 5: What is a 'blue-green deployment' strategy in Kubernetes CI/CD?
- Deploying updates to nodes labeled blue before propagating to green nodes
- Running two identical environments (blue=live, green=new) and switching traffic via a Service selector update (Correct answer)
- Splitting traffic 50/50 between two Deployments using Ingress weights
- Using two separate clusters for canary and production traffic
Correct answer: Running two identical environments (blue=live, green=new) and switching traffic via a Service selector update
Blue-green deployment keeps two full environments live; traffic switches instantly by updating the Service selector from the blue to the green Deployment.
Question 6: In a CI/CD pipeline using Flux v2, which custom resource defines what Git repository and path to sync from?
- HelmRelease
- GitRepository (Correct answer)
- Kustomization
- ImagePolicy
Correct answer: GitRepository
The GitRepository resource tells Flux where to fetch the desired state from (URL, branch, interval), which other Flux resources then reference.
Question 7: When using Kaniko to build Docker images inside Kubernetes, what problem does it solve compared to Docker-in-Docker (DinD)?
- It eliminates the need for a container registry
- It builds images without requiring a privileged container or Docker daemon (Correct answer)
- It builds images faster by caching layers in etcd
- It automatically signs images with Cosign after build
Correct answer: It builds images without requiring a privileged container or Docker daemon
Kaniko builds container images inside a Kubernetes Pod without needing Docker daemon access or privileged mode, improving cluster security.
Kubernetes Container Orchestration CI/CD Integration 3
In a Kubernetes CI/CD pipeline, what is the primary advantage of using Kustomize overlays?