🌐 DevOps Networking — 20 Interview Questions (Cloud + K8s + Production)
✅ Q1 — Explain full request flow from user → app in Kubernetes behind ALB.
User hits domain → DNS resolves to ALB → ALB routes to target group → node/pod IP → Ingress/Service → pod container port. TLS may terminate at ALB or ingress. Each hop must allow security group + network policy. Most failures happen at SG or health check layer.
✅ Q2 — Difference between ALB and NLB in real use?
ALB is Layer 7 — supports HTTP routing, path rules, TLS offload. NLB is Layer 4 — TCP/UDP, faster, static IP support. ALB for web apps, NLB for gRPC, TCP services, or when source IP preservation is needed.
✅ Q3 — What is east-west vs north-south traffic?
North-south = external client to cluster/service traffic. East-west = internal service-to-service traffic. East-west is usually handled by service mesh or cluster networking. Security rules differ for both.
✅ Q4 — What breaks if DNS fails inside Kubernetes?
Service discovery fails — pods cannot resolve service names. Apps fail even if pods are healthy. CoreDNS outage causes cascading failures. That’s why CoreDNS needs HA replicas.
✅ Q5 — How does Kubernetes service routing work technically?
Service gets virtual ClusterIP. kube-proxy programs iptables/IPVS rules. Traffic to ClusterIP is redirected to pod endpoints. It’s node-level NAT routing.
✅ Q6 — NodePort vs LoadBalancer vs Ingress — when use which?
NodePort exposes service on every node port — mostly for internal/testing. LoadBalancer creates cloud LB per service. Ingress routes many services via single LB — preferred for HTTP apps.
✅ Q7 — What is SNAT and where do you see it in Kubernetes/cloud?
SNAT rewrites source IP on outbound traffic. Happens when pods access internet via node. In EKS VPC CNI, pod IP may be SNATed depending on config. Affects logging and firewall rules.
✅ Q8 — How do security groups interact with EKS pod traffic?
By default, SG applies at node ENI level. With Security Groups for Pods feature, SG can attach to pod ENI. That allows pod-level network control. Useful for DB access isolation.
✅ Q9 — Why do readiness probes affect load balancer routing?
If readiness fails, pod is removed from endpoints. Load balancer stops sending traffic. Without readiness probes, traffic may hit unhealthy pods. That causes partial outages.
✅ Q10 — What is MTU and why can it break containers?
MTU defines max packet size. Overlay networks reduce MTU. If mismatched, packets fragment or drop. Causes weird connection resets. Seen in VPN + K8s combos.
✅ Q11 — How do you debug pod cannot reach external API?
Exec into pod → curl API → check DNS resolve → check NetworkPolicy → check NAT gateway → check route table. Work from inside outward. Never guess — test path.
✅ Q12 — Difference between proxy vs reverse proxy?
Proxy acts for client outbound requests. Reverse proxy sits in front of servers and routes inbound traffic. Ingress controllers are reverse proxies.
✅ Q13 — What is service mesh solving in networking?
Service mesh handles east-west traffic control — retries, mTLS, routing, observability. It moves networking logic out of app code. Example: Istio, Linkerd.
✅ Q14 — How does mTLS work in service mesh?
Both client and server present certificates. Traffic is encrypted and identity-verified both ways. Prevents spoofing inside cluster. Certificates are rotated automatically by mesh control plane.
✅ Q15 — Why do we use private subnets for nodes?
Nodes don’t need public IP exposure. Reduces attack surface. Outbound access via NAT gateway. Only load balancers are public.
✅ Q16 — What is NAT Gateway role in cloud networking?
Allows private subnet resources to access internet outbound. No inbound allowed. Required for pulling images, updates, external APIs.
✅ Q17 — Why can health checks pass but app still fail?
Health check endpoint may be shallow. Only checks process alive, not dependency health. Real readiness should test critical dependencies.
✅ Q18 — What is connection draining / deregistration delay?
Load balancer waits before removing target to allow in-flight requests to finish. Prevents request drops during rollout. Important in zero-downtime deploys.
✅ Q19 — DNS TTL — why does it matter in failover?
TTL controls cache time. High TTL delays failover routing. Low TTL increases DNS query load. TTL tuning is part of DR planning.
✅ Q20 — Most common real-world networking misconfig in DevOps?
Security group or NetworkPolicy blocking traffic silently. People debug app layer first — but packet never arrives. Always verify network path early.