Top 10 CKAD interview questions and how to answer them in 2026

The 10 questions

1. What’s the difference between CKA and CKAD — and why did you pick CKAD?

CKA is for cluster operators: etcd snapshot/restore, kubeadm upgrades, node troubleshooting, RBAC design, NetworkPolicy enforcement, CNI details. CKAD is for developers shipping code into an existing cluster: manifests, ConfigMaps, Secrets, health probes, resource requests, multi-container patterns, Services. Same $445 fee, same 66% pass score, but CKAD skips everything cluster-admin and doubles down on kubectl fluency for the app-side workflow. The honest answer to “why CKAD” is: “because I ship code, not clusters. If I ever own an on-call rotation for the cluster itself, I’ll add CKA.”

2. What’s the difference between a readiness probe and a liveness probe?

Liveness tells kubelet when to restart a broken container. Readiness tells the Endpoints controller when to route traffic to it. A pod that returns readiness=false is pulled from Service endpoints without being killed — exactly what you want during warm-up or when a downstream dependency is briefly unavailable. Using liveness for a slow-starting JVM app causes restart loops that hide the real error. Add a startupProbe for anything that legitimately takes > 30 seconds to boot — it gates the other two probes until it succeeds.

3. How do you pass a value from a ConfigMap into a container?

Three shapes, pick by rotation needs. Env var, single key: env: [{name: DB_URL, valueFrom: {configMapKeyRef: {name: db, key: url}}}]. Env vars, all keys: envFrom: [{configMapRef: {name: db}}]. File in a volume: mount spec.volumes[].configMap under a mountPath. The catch: env vars are frozen at container start, so a ConfigMap edit does not re-inject them — the pod has to restart. Volume-mounted keys, on the other hand, update on kubelet’s next sync (typically under a minute). Use the volume shape when the app can reload config on file change.

4. How do you keep a Secret out of a git repo when the manifest that references it lives in git?

The manifest that references a Secret is safe to commit — it names the Secret, it does not embed its value. The Secret itself never goes in git in plain form. Real options: SealedSecrets (Bitnami controller decrypts on-cluster), ExternalSecrets Operator (pulls from Vault / AWS Secrets Manager / GCP Secret Manager), SOPS-encrypted YAML committed via GitOps, or the cloud CSI driver mounting a Secret Manager entry as a volume. Base64 is encoding, not encryption — any candidate who calls a base64-encoded Secret “secure” is done.

5. Sidecar, init container, ambient container — when do you use which?

Init container runs to completion before the main container starts — schema migrations, warmup fetches, waiting on a dependency. Runs once. Sidecar runs alongside the main container for the pod’s life — log shipper, envoy proxy, secret rotator. Since v1.29 the sidecar pattern has first-class support via restartPolicy: Always on an init container, which fixes the old shutdown-ordering bug where the main container exited before the log shipper flushed. Ambient is the newer Istio mesh model that removes per-pod sidecars entirely — not a CKAD topic yet, but hiring managers ask about it if the team runs a mesh.

6. Requests, limits, and QoS classes — what does an app developer need to set and why?

Set both requests and limits for every container. Requests drive scheduling: kubelet only places the pod on a node with that much CPU/memory free. Limits cap runtime: CPU above the limit is throttled, memory above triggers OOMKill. If request == limit for both, the pod is Guaranteed QoS — last to be evicted under node pressure. If limits > requests, it’s Burstable. If neither is set, it’s BestEffort — first to die. For a stateful backend that must not lose in-flight requests, always Guaranteed. For a batch job that can tolerate a restart, Burstable is fine and packs the cluster better.

7. Deployment, StatefulSet, Job, CronJob — how do you pick from a developer’s POV?

Deployment for stateless services with rolling updates — the default for an HTTP API. StatefulSet when you need ordered, named replicas with stable per-pod persistent volumes — databases, brokers, quorum systems (Kafka, etcd, ZooKeeper). Job for one-shot work — a data backfill, a migration, an image build. CronJob for scheduled Jobs — nightly export, hourly cleanup. Common trap: candidates reach for StatefulSet “because I want stable DNS names” when a Deployment plus a headless Service would already give per-pod DNS without the ordered-scaling overhead. Pick the smallest primitive that covers the requirement.

8. Write a rolling-update spec with zero downtime, then explain how you’d roll back.

Under spec.strategy.rollingUpdate: maxSurge: 25% (extra pods during rollout) and maxUnavailable: 0 (never drop below the desired count). Add a readiness probe so kubelet only counts a pod as ready once it can actually serve. Rollback: kubectl rollout undo deployment/api reverts to the previous ReplicaSet (Kubernetes keeps the last revisionHistoryLimit defaults to 10). Watch progress with kubectl rollout status. Fast-forward on stuck rollouts: kubectl rollout restart deployment/api triggers a new ReplicaSet without any manifest edit.

9. How do you debug a pod stuck in CrashLoopBackOff?

In order. kubectl describe pod for events and last termination state (Reason: OOMKilled, Reason: Error, ExitCode: 137). kubectl logs <pod> --previous for the last dead container’s stdout — the current container is usually a fresh corpse with nothing useful. If the container never starts long enough to log, kubectl run debug --image=<same-image> --command -- sleep 3600 and kubectl exec in to reproduce. Common causes: OOMKill from too-low memory limit, wrong image tag, missing ConfigMap/Secret, ImagePullBackOff (private registry credentials), or a health probe that fails immediately because the port is wrong. kubectl debug with an ephemeral container is the current-generation alternative when the image has no shell.

10. What CKAD-anchored roles pay in 2026, and what’s the typical progression?

Cloud-native and platform-adjacent backend developer roles in the US pay $130,000–$160,000 mid-level and $170,000–$210,000 senior base at FAANG and well-funded startups. The most common offer profile in 2026 is CKAD plus 2–4 years shipping into production Kubernetes plus a primary backend language (Go, Python, Java, TypeScript). Progression from junior backend developer to platform-engineer-adjacent senior typically takes 3–5 years, and CKAD is what unlocks the pivot. The official CNCF CKAD page covers the current curriculum. BLS reports a 2024 median of $104,420 for all computer occupations; Kubernetes-fluent developer roles consistently exceed that by 30–55%.

What these questions test

Every one has a book answer and an operational answer. The interviewer wants the operational one — the version that mentions the v1.29 sidecar restartPolicy fix, the “env vars are frozen at container start” ConfigMap trap, the base64-is-not-encryption Secret trap, the readiness-vs-liveness restart-loop mistake. Passing the CKAD proves you can complete 15 hands-on tasks under a clock. Answering these correctly proves you actually operate the services you ship.

Frequently asked questions