DevOps EngineerInterview Answers

I design pipelines that are fast, reliable, and secure. Stages typically include: source control trigger, dependency caching, static analysis (SAST, linting), unit and integration tests, build and containerisation, security scanning (container image scanning, dependency audit), staging deployment, smoke tests, and gated production deployment. I implement branch protection, require peer review, and enforce all checks passing before merge. Pipeline-as-code (Jenkinsfile, GitHub Actions YAML) ensures the pipeline is versioned alongside the application.

I've designed and operated Kubernetes clusters on EKS, GKE, and on-premises. I'm comfortable with core concepts (Pods, Deployments, Services, ConfigMaps, Secrets, Ingress), intermediate patterns (StatefulSets, HorizontalPodAutoscaler, PodDisruptionBudgets), and cluster operations (upgrading, node group management, RBAC). I use Helm for templated releases and ArgoCD for GitOps-based continuous deployment. I've also implemented network policies, pod security standards, and OPA Gatekeeper for policy enforcement.

I use Terraform as my primary IaC tool for cloud resources — writing modular, reusable code with remote state in S3/GCS, state locking via DynamoDB/GCS locks, and environment-specific variables. I version everything in Git, use pull requests for infrastructure changes, and require approval from a second engineer for production changes. I run terraform plan in CI before every merge to catch unintended changes. For configuration management I use Ansible. IaC is non-negotiable for reproducibility and disaster recovery.

I implement the three pillars of observability: metrics (Prometheus, Datadog, CloudWatch), logs (ELK stack, Loki, CloudWatch Logs), and traces (Jaeger, Zipkin, AWS X-Ray). I define SLOs for every critical service and create alerting based on those SLOs — not just on technical thresholds that may or may not correlate with user experience. I build runbooks for every alert so on-call engineers know how to respond. Good observability means answering "what's wrong and why" within minutes, not hours.

I follow a structured incident response process. I declare incident severity (P1-P4), assign an incident commander and communication lead. The engineering team focuses on mitigation — rolling back, scaling, or applying a hotfix — not root cause analysis during the incident. I communicate status updates at regular intervals to stakeholders. After resolution, we run a blameless post-mortem: timeline reconstruction, root cause analysis using 5-Whys, and action items with owners and due dates. Learning from incidents is how systems mature.

Security is shifted left — integrated into every stage of the pipeline, not added at the end. I implement SAST (Semgrep, SonarQube) in CI, SCA (Snyk, Dependabot) for dependency vulnerabilities, container image scanning (Trivy, Twistlock), and IaC scanning (Checkov, tfsec) in pull requests. I manage secrets through Vault or AWS Secrets Manager — never in environment variables or code. I enforce least-privilege IAM, use service accounts, and audit access regularly. Security is an engineering responsibility, not an InfoSec handoff.

Blue-green: I maintain two identical production environments. After deploying to the inactive environment and running smoke tests, I switch traffic via the load balancer. Rollback is a traffic switch — recovery is near-instant. Canary: I route a percentage of traffic (typically 5–10% initially) to the new version and monitor error rates, latency, and business metrics against a baseline. If thresholds are breached, I automatically rollback. I use feature flags alongside canary deployments for additional control. The right strategy depends on the risk of the change.

I audit resource utilisation regularly — idle instances, oversized databases, and unused reserved capacity are common waste sources. I implement autoscaling to match capacity to demand and use spot/preemptible instances for batch and development workloads. I tag every resource for cost allocation and review cost dashboards weekly with engineering leads. I use tools like AWS Cost Explorer, Infracost (in CI), and CloudHealth for visibility and anomaly detection. Cost optimisation is a continuous engineering practice, not a one-time project.