Kubernetes Container Orchestration CI/CD Integration 5 — Questions and Answers
Question 1: What does the maxSurge field in a Kubernetes Deployment's rolling update strategy control?
- The maximum number of Pods that can be unavailable during the update
- The maximum number of extra Pods that can exist above the desired replica count during the update (Correct answer)
- The maximum time to wait for a Pod to become ready before failing the rollout
- The maximum number of revisions retained in the rollout history
Correct answer: The maximum number of extra Pods that can exist above the desired replica count during the update
maxSurge specifies how many additional Pods (above the desired count) can be created during a rolling update, controlling update speed vs. resource usage.
Question 2: In a CD pipeline, a deployment is stuck waiting for Pods to become Ready. Which kubectl command gives real-time rollout status?
- kubectl describe pods
- kubectl rollout status deployment/my-app (Correct answer)
- kubectl get events --watch
- kubectl logs deployment/my-app
Correct answer: kubectl rollout status deployment/my-app
kubectl rollout status blocks and streams the rollout progress, exiting with a non-zero code if the rollout fails — ideal for CI/CD gating.
Question 3: What Kubernetes feature allows a CD pipeline to gate deployment to production on a manual approval step?
- Kubernetes itself has no built-in approval gate; this is implemented at the CD tool layer (e.g., Argo Rollouts, GitHub Environments) (Correct answer)
- PodDisruptionBudget
- ResourceQuota on the production namespace
- NetworkPolicy blocking the CD pipeline's ServiceAccount
Correct answer: Kubernetes itself has no built-in approval gate; this is implemented at the CD tool layer (e.g., Argo Rollouts, GitHub Environments)
Kubernetes has no native manual approval primitive; GitOps tools like Argo CD or CI platforms like GitHub Actions implement approval gates via their own mechanisms.
Question 4: When using Argo Rollouts for a canary deployment, what resource defines the traffic split percentage between stable and canary versions?
- Deployment spec.strategy.canary
- Rollout spec.strategy.canary.steps (Correct answer)
- Service spec.trafficPolicy
- Ingress spec.rules.canary
Correct answer: Rollout spec.strategy.canary.steps
Argo Rollouts uses the Rollout CRD with spec.strategy.canary.steps to define progressive traffic shifts and analysis gates for canary deployments.
Question 5: A pipeline needs to validate that deployed Kubernetes manifests follow organizational policies before applying them. Which tool performs this policy-as-code check against YAML files in the pipeline (not in-cluster)?
- kubectl diff
- conftest (with OPA/Rego policies) (Correct answer)
- helm lint
- kube-score
Correct answer: conftest (with OPA/Rego policies)
Conftest uses OPA Rego policies to validate Kubernetes YAML files against organizational standards as a pipeline step before any cluster interaction.
Question 6: What is the purpose of a Kubernetes PodDisruptionBudget (PDB) in a CI/CD deployment pipeline?
- To limit the number of Pods a pipeline ServiceAccount can create
- To ensure a minimum number of Pods remain available during voluntary disruptions like rolling updates (Correct answer)
- To set CPU and memory budgets for pipeline runner Pods
- To prevent Pods from being scheduled on nodes undergoing maintenance
Correct answer: To ensure a minimum number of Pods remain available during voluntary disruptions like rolling updates
A PDB specifies minAvailable or maxUnavailable to guarantee service continuity during rolling updates, drains, or other voluntary disruptions triggered by CD pipelines.
Question 7: Which security practice ensures that only images built and approved by your CI system can run in production Kubernetes clusters?
- Setting imagePullPolicy to Never on all production Deployments
- Enforcing image signing and verifying signatures at admission using tools like Cosign and Policy Controller (Correct answer)
- Using a private container registry with IP allowlisting
- Scanning images with Trivy in the CI pipeline
Correct answer: Enforcing image signing and verifying signatures at admission using tools like Cosign and Policy Controller
Image signing (Cosign) combined with an admission controller that verifies signatures (Sigstore Policy Controller, Kyverno) ensures only CI-approved images can be deployed.
Kubernetes Container Orchestration CI/CD Integration 5
What does the maxSurge field in a Kubernetes Deployment's rolling update strategy control?