Kubernetes Container Orchestration CI/CD Integration 4 — Questions and Answers
Question 1: What is the role of a Kubernetes admission webhook in a CI/CD security pipeline?
- It approves pull requests before merging
- It intercepts API requests and enforces policies before objects are persisted (Correct answer)
- It scans container images for CVEs at build time
- It rotates ServiceAccount tokens after each deployment
Correct answer: It intercepts API requests and enforces policies before objects are persisted
Admission webhooks (ValidatingAdmissionWebhook / MutatingAdmissionWebhook) intercept resource creation/update requests and can reject or modify them to enforce policies.
Question 2: A canary deployment in Kubernetes sends 10% of traffic to the new version. Which Ingress-level feature enables weighted traffic splitting?
- Ingress TLS termination
- Ingress canary annotations (e.g., nginx.ingress.kubernetes.io/canary-weight) (Correct answer)
- Ingress path-based routing rules
- Ingress defaultBackend configuration
Correct answer: Ingress canary annotations (e.g., nginx.ingress.kubernetes.io/canary-weight)
NGINX Ingress supports canary annotations that direct a configurable percentage of traffic to a canary Ingress/Service for staged rollouts.
Question 3: Which Kubernetes resource can a CD pipeline use to run a one-off database migration before the main application Pods start?
- CronJob
- Job (Correct answer)
- InitContainer
- ReplicaSet
Correct answer: Job
A Kubernetes Job runs a task to completion exactly once, making it ideal for pre-deploy database migrations in a CD pipeline.
Question 4: What does the --atomic flag do in a Helm upgrade command used in CI/CD?
- It locks the Helm release so no one else can upgrade simultaneously
- It automatically rolls back the release if the upgrade fails or times out (Correct answer)
- It signs the Helm chart before deploying
- It skips pre-upgrade hooks for faster deploys
Correct answer: It automatically rolls back the release if the upgrade fails or times out
helm upgrade --atomic rolls back the release automatically if the upgrade fails, ensuring the cluster stays in a known-good state.
Question 5: In a multi-stage CI/CD pipeline, which Kubernetes object stores non-sensitive pipeline configuration values (like feature flags or environment names) accessible to Pods?
- Secret
- ConfigMap (Correct answer)
- PersistentVolumeClaim
- ResourceQuota
Correct answer: ConfigMap
ConfigMaps store non-sensitive key-value data that Pods can consume as environment variables or mounted files, suitable for pipeline-injected configuration.
Question 6: What is image promotion in a Kubernetes CI/CD pipeline?
- Increasing the CPU limits of a running container
- Moving a tested image from a lower environment registry to a production registry with an approved tag (Correct answer)
- Updating the image tag in a Helm chart to trigger a redeployment
- Pushing an image to multiple registries simultaneously for redundancy
Correct answer: Moving a tested image from a lower environment registry to a production registry with an approved tag
Image promotion copies a validated image artifact (by digest) from a staging registry to a production registry, ensuring the exact same binary runs in prod.
Question 7: Which tool is purpose-built for Kubernetes-native CI/CD pipelines and runs pipeline steps as native Kubernetes Pods?
- Jenkins (classic)
- Tekton (Correct answer)
- CircleCI
- Travis CI
Correct answer: Tekton
Tekton is a Kubernetes-native CI/CD framework where every pipeline step runs as a Pod, using CRDs like Task and Pipeline to define workflows.
Kubernetes Container Orchestration CI/CD Integration 4
What is the role of a Kubernetes admission webhook in a CI/CD security pipeline?