JPJobPrepfull-stack interview
RoadmapsJS CompilerStar on GitHub
Career Roadmaps · Kubernetes

Career roadmap

Kubernetes Engineer

Run, secure and debug clusters that other people bet their production traffic on.

Time
6-9 months part-time
Entry bar
Linux, networking and container fundamentals.
Stages
5 · 25 topics
0/25 studied0%
All roadmaps

Before you start Kubernetes

  • Docker and container fundamentals
  • Linux administration
  • YAML fluency and basic networking

Core objects and the control plane

4-6 weeks · 0/5 topics

Understand Kubernetes as a reconciliation engine rather than a deployment tool.

  1. API server, etcd, scheduler, controller manager, kubelet — and what breaks when each does.

    • Control plane components and their jobs
    • etcd as the single source of truth
    • kubelet, container runtime and CRI
    • The reconciliation loop model

  2. Deployments, StatefulSets, Jobs — and choosing correctly between them.

    • Deployments and rollout strategies
    • StatefulSets, ordering and stable identity
    • DaemonSets, Jobs and CronJobs
    • Pod lifecycle, probes and init containers

  3. ConfigMaps, Secrets and the volume system, including their sharp edges.

    • ConfigMaps and Secrets injection
    • Persistent volumes, claims and storage classes
    • CSI drivers and dynamic provisioning
    • Volume expansion and reclaim policies

  4. Why a pod is Pending is the most common Kubernetes support question there is.

    • Requests, limits and QoS
    • Node selectors, affinity and anti-affinity
    • Taints, tolerations and topology spread
    • Priority, preemption and eviction

  5. Certification exams and interviews are time-boxed. Speed here is worth real marks.

    • Imperative commands and dry-run
    • JSONPath and custom columns
    • Contexts, namespaces and kubeconfig
    • Debug containers and port-forward

BuildBootstrap a cluster the hard way once, then run a stateful and a stateless workload on it.

Networking and service delivery

5-6 weeks · 0/5 topics

Cluster networking is the least understood and most interviewed area.

  1. How a request actually finds a pod, including kube-proxy and endpoint slices.

    • ClusterIP, NodePort, LoadBalancer
    • kube-proxy modes and iptables/IPVS
    • EndpointSlices and readiness
    • CoreDNS and service discovery

  2. Gateway API is replacing Ingress. Knowing both, and why, is current.

    • Ingress controllers and annotations
    • Gateway API resources and roles
    • TLS termination and cert-manager
    • Path and host routing rules

  3. The plugin layer that decides how packets move between pods.

    • CNI plugin responsibilities
    • Overlay vs routed networking
    • Cilium and eBPF dataplanes
    • IP address management

  4. Default-allow is the Kubernetes default and the finding on every audit.

    • NetworkPolicy semantics
    • Default-deny and progressive tightening
    • Egress control and DNS policy
    • Testing policies safely

  5. Powerful and expensive. The senior answer includes when not to adopt one.

    • Sidecar vs ambient mesh
    • mTLS and identity
    • Traffic splitting and retries
    • Operational cost and complexity

BuildExpose services through an ingress controller with TLS, then enforce a default-deny network policy.

Security and multi-tenancy

5-6 weeks · 0/5 topics

Clusters are shared. Isolation failures are security incidents.

  1. Roles, bindings and service accounts. Frequently misconfigured, always audited.

    • Roles vs ClusterRoles and bindings
    • Service accounts and token projection
    • Workload identity federation to cloud IAM
    • Auditing effective permissions

  2. Running as root in a privileged pod is still depressingly common.

    • Pod Security Standards and admission
    • securityContext, capabilities, read-only root
    • seccomp and AppArmor profiles
    • Preventing host mounts and hostNetwork

  3. The enforcement point where standards become non-negotiable.

    • Validating and mutating webhooks
    • Kyverno and OPA Gatekeeper policies
    • Image signature verification
    • Failure modes when the webhook is down

  4. What is running, where it came from, and whether it has known holes.

    • Image scanning in the registry and cluster
    • Signing and verifying with Sigstore
    • SBOM and provenance
    • Base image lifecycle

  5. Namespaces alone are not a security boundary, and interviewers check you know that.

    • Soft vs hard multi-tenancy
    • Quotas, limit ranges and fair sharing
    • Virtual clusters
    • Noisy neighbour mitigation

BuildHarden a cluster against a CIS benchmark and document each control you applied.

Operations at scale

5-6 weeks · 0/5 topics

Upgrades, capacity and cost — the things that make cluster ownership a real job.

  1. Upgrades are the highest-risk recurring operation on any cluster.

    • Version skew policy and deprecations
    • Control plane and node pool upgrades
    • Drain, PodDisruptionBudgets and surge
    • API deprecation migration

  2. Three different autoscalers that interact, and often fight.

    • HPA and custom metrics
    • VPA and its conflicts with HPA
    • Cluster autoscaler and Karpenter
    • Scale-to-zero patterns

  3. Databases on Kubernetes: possible, popular, and full of sharp edges.

    • Operators for databases
    • Backup and restore of persistent data
    • Storage performance and IOPS
    • When to use a managed service instead

  4. Monitoring the platform itself, not only the workloads on it.

    • kube-state-metrics and node exporter
    • Control plane and etcd metrics
    • Event collection and correlation
    • Alerting on cluster health

  5. Over-requested resources are the biggest source of cloud waste in Kubernetes shops.

    • Request right-sizing from real usage
    • Bin packing and node shapes
    • Spot and preemptible nodes
    • Cost attribution per namespace

BuildPerform a zero-downtime cluster upgrade and publish the runbook you followed.

Certification and interviews

4-5 weeks · 0/5 topics

CKA and CKS are hands-on, time-pressured, and directly respected by employers.

  1. A practical exam with a terminal and a clock. Speed and muscle memory decide it.

    • Exam domains and weighting
    • Time management across tasks
    • Fast manifest generation with dry-run
    • Killer.sh style practice

  2. The security specialisation, and a strong differentiator in the market.

    • Cluster hardening tasks
    • Runtime security with Falco
    • Supply chain and admission tasks
    • Audit logging configuration

  3. The core interview: a broken cluster and a shared screen.

    • Pod stuck Pending, CrashLoop, ImagePull
    • Service with no endpoints
    • DNS resolution failures
    • Node NotReady investigation

  4. Design a platform cluster topology for a company, with isolation and upgrade strategy.

    • Cluster per environment vs per tenant
    • Regional topology and failure domains
    • Upgrade and maintenance strategy
    • Cost and operational overhead

  5. Public evidence: a cluster bootstrap repo, hardening notes, an operator.

    • Cluster bootstrap repository
    • CIS hardening write-up
    • Debugging case studies
    • Contributions to Kubernetes ecosystem projects

BuildPass CKA, then CKS, and keep a personal runbook of every failure mode you hit.

Kubernetes tools on your CV

  • Kubernetes
  • kubectl
  • Helm
  • Cilium
  • Kyverno
  • cert-manager
  • Argo CD
  • Prometheus
  • Falco

What Kubernetes employers ask to see

  • CKA, and ideally CKS
  • A cluster bootstrap repository someone else can run
  • A CIS hardening write-up with applied controls
  • A documented zero-downtime cluster upgrade

Kubernetes is the default deployment substrate, and genuine cluster-level expertise is scarce. Certifications are recognised and consultancies hire on them directly.

Content last reviewed 2026-08-31. Guidance only — no institute or paid placement is endorsed anywhere in this book.