Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. A Service has no endpoints, but the pods are Running. What are the two most likely causes?

   1. ADNS and disk
   2. BThe Service selector doesn't match the pod labels, or the pods aren't Ready (readiness probe failing)
   3. CThe Ingress class and TLS
   4. DToo many replicas
   Show answer

   B. Endpoints only include pods that match the selector AND are Ready.

   From lesson 17 · Deploy an app end to end

2. Q2. What's the difference between a Service's `port` and `targetPort`?

   1. ANone
   2. B`port` is what clients of the Service use; `targetPort` is the container port traffic is sent to
   3. C`targetPort` is for NodePorts only
   4. D`port` is the node's port
   Show answer

   B. Mixing them up is a classic cause of 'connection refused' behind a healthy-looking Service.

   From lesson 17 · Deploy an app end to end

3. Q3. Why does a readiness probe matter for zero-downtime rollouts?

   1. AIt restarts pods
   2. BNew pods only receive traffic (and old ones are only removed) once the new pods report Ready, so users never hit a pod that's still starting
   3. CIt speeds up image pulls
   4. DIt sets CPU limits
   Show answer

   B. Without readiness, Kubernetes sends traffic to pods the moment the container starts.

   From lesson 17 · Deploy an app end to end

4. Q4. An app in namespace shop-web needs the Service `postgres` in shop-data. Which hostname works?

   1. Apostgres
   2. Bpostgres.shop-data (or postgres.shop-data.svc.cluster.local)
   3. Cshop-data.postgres
   4. Dlocalhost:5432
   Show answer

   B. A bare name resolves only within the pod's own namespace; add the namespace to cross namespaces.

   From lesson 18 · Namespaces & an app with a database

5. Q5. The app in shop-web references a Secret `db-credentials` that exists only in shop-data. What happens?

   1. AIt works
   2. BThe pod fails to start (CreateContainerConfigError): Secrets are namespaced, so the app's namespace needs its own copy
   3. CKubernetes copies it automatically
   4. DThe Secret is read over DNS
   Show answer

   B. Each namespace needs the Secrets its pods use; tools like External Secrets can sync them from one source.

   From lesson 18 · Namespaces & an app with a database

6. Q6. Why run PostgreSQL as a StatefulSet rather than a Deployment?

   1. AIt's faster
   2. BEach replica gets a stable identity (postgres-0) and its own PersistentVolumeClaim that follows it across reschedules
   3. CDeployments can't mount volumes
   4. DStatefulSets don't need Services
   Show answer

   B. Stable identity and per-pod storage are exactly what databases need. For production, use an operator on top.

   From lesson 18 · Namespaces & an app with a database

7. Q7. In edge termination, where is the certificate and what happens inside the cluster?

   1. AOn the pod; traffic stays encrypted
   2. BOn the ingress controller, which decrypts TLS; traffic from the controller to the pod is plain HTTP (unless you re-encrypt or use a mesh)
   3. CNowhere
   4. DOn the DNS server
   Show answer

   B. Edge termination is the common default; add re-encryption or mTLS if in-cluster encryption is required.

   From lesson 19 · HTTPS & TLS termination

8. Q8. What does cert-manager do?

   1. AEncrypts etcd
   2. BRequests, stores (as Secrets) and renews certificates from issuers such as Let's Encrypt or your own CA, driven by Certificate resources or Ingress annotations
   3. CReplaces the ingress controller
   4. DScans images
   Show answer

   B. Automated renewal removes the classic 'certificate expired' outage.

   From lesson 19 · HTTPS & TLS termination

9. Q9. When would you use SSL passthrough?

   1. AAlways
   2. BWhen the application must terminate TLS itself (it holds the key, or needs client certificates end to end), accepting that the ingress can't route by path or inspect HTTP
   3. CTo make HTTP faster
   4. DFor NodePort Services only
   Show answer

   B. Passthrough routes by SNI hostname only; no path rules, headers or HTTP features at the ingress.

   From lesson 19 · HTTPS & TLS termination

10. Q10. What's the main advantage of the Gateway API over Ingress?

    1. AIt's faster
    2. BA role-oriented, expressive, portable API: platform teams own Gateways (listeners, TLS), app teams attach Routes (HTTP, gRPC, TCP…), with features like header matching and traffic splitting built in
    3. CIt needs no controller
    4. DIt replaces Services
    Show answer

    B. Ingress is frozen; new traffic features land in the Gateway API, which many controllers and meshes implement.

    From lesson 20 · Ingress & egress gateways

11. Q11. You apply a default-deny egress policy and every app breaks, even ones that only call in-cluster Services. Most likely cause?

    1. AThe CNI crashed
    2. BDNS: pods can no longer reach kube-dns on port 53, so no names resolve; allow DNS explicitly
    3. CToo many replicas
    4. DThe Ingress is wrong
    Show answer

    B. Always include a DNS allow rule with any default-deny egress policy.

    From lesson 20 · Ingress & egress gateways

12. Q12. A partner allow-lists one source IP for API calls. Your pods run on many nodes with changing IPs. What solves it?

    1. AAsk the partner to allow all IPs
    2. BAn egress gateway (or NAT gateway/proxy) so outbound traffic to the partner leaves from a fixed IP
    3. CA LoadBalancer Service
    4. DAn Ingress
    Show answer

    B. Egress gateways give a stable, auditable exit point; NetworkPolicy alone can't change source IPs.

    From lesson 20 · Ingress & egress gateways

13. Q13. What's the main advantage of blue-green over a rolling update?

    1. AIt uses fewer resources
    2. BThe new version is fully deployed and tested before any traffic moves, and switching back is instant (flip the selector), at the cost of running two full copies
    3. CIt needs no Service
    4. DIt can't fail
    Show answer

    B. Blue-green trades capacity for a clean switch and an instant rollback.

    From lesson 21 · Release strategies: rolling, blue-green, canary

14. Q14. What makes a canary release safer than switching everything at once?

    1. AIt's faster
    2. BOnly a small share of users gets the new version first; if error or latency metrics degrade, you abort before most users are affected
    3. CIt skips testing
    4. DIt needs no monitoring
    Show answer

    B. Canaries need good metrics and a clear abort rule, ideally automated.

    From lesson 21 · Release strategies: rolling, blue-green, canary

15. Q15. Which change is dangerous with any strategy that runs two versions at once?

    1. AA new log message
    2. BA database schema change that the old version can't handle (e.g. dropping a column the old code still reads); use expand/contract steps
    3. CA new label
    4. DA new replica count
    Show answer

    B. Rolling, blue-green and canary all mean old and new code overlap; data changes must be compatible with both.

    From lesson 21 · Release strategies: rolling, blue-green, canary