Kubernetes Container Orchestration CI/CD Integration 4

Question 1

What is the role of a Kubernetes admission webhook in a CI/CD security pipeline?

Accepted Answer

It intercepts API requests and enforces policies before objects are persisted

Answer

Admission webhooks (ValidatingAdmissionWebhook / MutatingAdmissionWebhook) intercept resource creation/update requests and can reject or modify them to enforce policies.

Question 2

A canary deployment in Kubernetes sends 10% of traffic to the new version. Which Ingress-level feature enables weighted traffic splitting?

Accepted Answer

Ingress canary annotations (e.g., nginx.ingress.kubernetes.io/canary-weight)

Answer

NGINX Ingress supports canary annotations that direct a configurable percentage of traffic to a canary Ingress/Service for staged rollouts.

Question 3

Which Kubernetes resource can a CD pipeline use to run a one-off database migration before the main application Pods start?

Accepted Answer

Job

Answer

A Kubernetes Job runs a task to completion exactly once, making it ideal for pre-deploy database migrations in a CD pipeline.

Question 4

What does the --atomic flag do in a Helm upgrade command used in CI/CD?

Accepted Answer

It automatically rolls back the release if the upgrade fails or times out

Answer

helm upgrade --atomic rolls back the release automatically if the upgrade fails, ensuring the cluster stays in a known-good state.

Question 5

In a multi-stage CI/CD pipeline, which Kubernetes object stores non-sensitive pipeline configuration values (like feature flags or environment names) accessible to Pods?

Accepted Answer

ConfigMap

Answer

ConfigMaps store non-sensitive key-value data that Pods can consume as environment variables or mounted files, suitable for pipeline-injected configuration.

Kubernetes Container Orchestration Practice Test

Kubernetes Container Orchestration Practice Test

Kubernetes Container Orchestration CI/CD Integration 4