Top OpenShift Interview Questions for Engineers

techhadoop OCP

For OpenShift Platform Architect / Senior OpenShift Engineer roles, below are the interview questions that are most commonly asked by banks, telecoms, and enterprise organizations. These questions range from intermediate to expert level.

1. OpenShift Architecture

Q1. What is OpenShift?

Answer

OpenShift is Red Hat’s enterprise Kubernetes platform.

It provides:

  • Kubernetes
  • CRI-O container runtime
  • Operators
  • Integrated image registry
  • OAuth authentication
  • Monitoring
  • Logging
  • Routes
  • RBAC
  • SCC (Security Context Constraints)
  • Machine API
  • GitOps (ArgoCD)
  • Pipelines (Tekton)

OpenShift focuses on enterprise security, automation and lifecycle management.

Q2. Describe OpenShift architecture.

A typical cluster contains:

                API VIP
                    |
          +----------------+
          | Load Balancer  |
          +----------------+
             |         |
     --------------------------
     |          |            |
 Master1    Master2     Master3
(control plane)

      etcd cluster
      Scheduler
      API Server
      Controller Manager

-------------------------------
 Worker1 Worker2 Worker3 Worker4

Pods
Services
Routes
Ingress
Operators
Q3. Why does OpenShift require three control plane nodes?

Because etcd uses quorum.

1 node
No HA
2 nodes
No quorum during failure
3 nodes
Majority = 2
5 nodes
Majority = 3

This allows one node failure without losing the cluster.

2. Control Plane

Q4. What components run on control plane?
  • kube-apiserver
  • scheduler
  • controller-manager
  • etcd
  • cloud-controller-manager (cloud)
  • ingress operator
  • authentication operator
  • openshift-apiserver
Q5. Explain etcd.

etcd stores:

  • Secrets
  • ConfigMaps
  • Pods
  • Deployments
  • Nodes
  • CRDs
  • Routes
  • Operators

Everything in Kubernetes ultimately resides in etcd.

Q6. How do you troubleshoot etcd latency?

Check:

oc adm top nodes
oc get co
oc logs etcd-xxxxx
etcdctl endpoint health
etcdctl endpoint status
iostat
sar
vmstat

Common causes:

  • slow disks
  • high fsync latency
  • network delay
  • overloaded control plane

3. Operators

Q7. What is an Operator?

Operators automate:

  • install
  • upgrades
  • backups
  • scaling
  • failover

using:

CRD
Controller
Reconciliation loop
Q8. Explain Operator Lifecycle Manager.

OLM installs Operators from catalogs.

Components:

  • CatalogSource
  • Subscription
  • InstallPlan
  • CSV
Q9. Difference between Operator and Helm?

Operator

  • continuously reconciles state
  • lifecycle aware
  • self-healing
  • upgrades automatically

Helm

  • installs templates
  • no reconciliation
  • no automation after installation

4. Machine Config Operator (MCO)

Q10. What is MCO?

Machine Config Operator manages:

  • OS configuration
  • kubelet configs
  • SSH keys
  • kernel arguments
  • registries.conf
  • chrony
  • ignition
Q11. Difference between MCO and CVO?

MCO

  • manages nodes

CVO

  • upgrades the entire OpenShift cluster
Q12. What happens during node reboot after MachineConfig?

Machine Config Daemon:

  • drains node
  • applies config
  • reboots
  • validates
  • rejoins cluster

5. Security

Q13. Explain SCC.

Security Context Constraints define:

  • privileged containers
  • hostPath
  • capabilities
  • runAsUser
  • SELinux
  • seccomp
Q14. Difference between SCC and Pod Security Admission?

OpenShift:

SCC

Kubernetes:

PSA

SCC provides finer-grained control and remains the primary security mechanism in OpenShift.

Q15. How do you check SCC?
oc get scc
oc describe scc restricted-v2
oc adm policy who-can use scc privileged
Q16. How do you troubleshoot “permission denied” in pods?

Check:

  • SCC
  • SELinux
  • runAsUser
  • fsGroup
  • volume permissions
  • SecurityContext

6. Networking

Q17. Explain OVN-Kubernetes.

OVN provides:

  • overlay networking
  • routing
  • ACLs
  • NetworkPolicies
  • EgressIP
  • EgressFirewall
  • GENEVE tunnels
Q18. Why GENEVE instead of VXLAN?

GENEVE supports:

  • extensible metadata
  • policy offload
  • modern SDN
  • flexible encapsulation
Q19. Difference between Route, Ingress and Service?

Service

Internal load balancing

Ingress

Kubernetes ingress

Route

OpenShift-native external access with integrated router, TLS termination options, and wildcard routing.

Q20. Explain Route termination.

Edge

Client HTTPS
Router terminates TLS
HTTP to backend

Passthrough

TLS end-to-end
Router passes encrypted traffic

Re-encrypt

Client HTTPS
Router decrypts
Router re-encrypts
Backend HTTPS

7. Storage

Q21. Difference between PV and PVC?

PV

Storage resource

PVC

Storage request

Q22. Static vs Dynamic provisioning?

Static

Admin creates PV manually.

Dynamic

StorageClass provisions storage automatically when a PVC is created.

Q23. Explain CSI.

CSI enables storage vendors to integrate with Kubernetes without modifying Kubernetes core. CSI drivers handle provisioning, attachment, mounting, snapshots, and expansion.

8. Monitoring

Q24. Describe OpenShift monitoring.

Components:

  • Prometheus
  • Alertmanager
  • Grafana (optional)
  • Thanos
  • kube-state-metrics
  • node-exporter
Q25. Difference between cluster monitoring and user workload monitoring?

Cluster Monitoring

Monitors OpenShift components.

User Workload Monitoring

Monitors application namespaces.

Q26. How do you debug missing metrics?

Check:

oc get servicemonitors
oc get podmonitors
oc get prometheus
oc logs prometheus

9. Upgrades

Q27. How does OpenShift upgrade work?

CVO:

  • downloads release image
  • upgrades operators
  • upgrades masters
  • upgrades workers
  • verifies health
Q28. Pre-upgrade checklist?
  • etcd backup
  • Operators healthy
  • ClusterOperators healthy
  • PDB review
  • API deprecations
  • MachineConfig pools updated
  • Sufficient node capacity
Q29. What blocks upgrades?

Examples include:

  • degraded ClusterOperators
  • unavailable MachineConfigPool
  • unsupported operators
  • insufficient disk space
  • incompatible API usage
  • pending certificate issues

10. Troubleshooting

Q30. Cluster Operator degraded.

Commands:

oc get co
oc describe co
oc logs deployment/<operator>
oc adm inspect
Q31. Node NotReady.

Check:

oc get nodes
oc describe node
journalctl -u kubelet
journalctl -u crio
systemctl status kubelet
systemctl status crio
Q32. Pod Pending.

Possible causes:

  • insufficient CPU/memory
  • PVC unavailable
  • taints/tolerations
  • node selectors
  • affinity rules
  • image pull issues
Q33. Pod CrashLoopBackOff.

Check:

oc logs
oc describe pod
Events
Liveness probe
Readiness probe
OOMKilled
Exit code
Q34. API Server unavailable.

Possible causes:

  • etcd unhealthy
  • load balancer issues
  • certificates expired
  • network failure
  • control plane resource exhaustion

11. Disaster Recovery

Q35. How do you back up OpenShift?

Control plane:

etcd backup

Applications:

  • OADP
  • Velero
  • CSI snapshots
  • Object storage backups
Q36. How do you restore etcd?

Typical high-level process:

  1. Stop cluster services as documented.
  2. Restore from a verified snapshot.
  3. Restart the control plane.
  4. Validate ClusterOperators and node health.
  5. Confirm application functionality.

12. GitOps

Q37. Explain GitOps in OpenShift.

Git is the source of truth.

Flow:

Git
↓
ArgoCD
↓
Cluster
↓
Reconciliation
↓
Drift correction
Q38. Why GitOps?
  • version control
  • rollback
  • auditability
  • repeatability
  • self-healing

13. Real Scenario Questions

Q39. Your API server latency suddenly increases. What do you check?
  • API server metrics
  • etcd latency and health
  • CPU and memory usage on control plane
  • Disk IOPS and fsync latency
  • Network latency
  • Audit logs
  • Recently deployed operators or workloads
Q40. A MachineConfigPool is stuck updating.

Check:

oc get mcp
oc describe mcp
oc get machineconfig
oc describe node
oc logs machine-config-daemon

Common causes include a node failing to drain, configuration errors, or degraded Machine Config Daemon.

Q41. Pods cannot communicate across nodes.

Check:

  • OVN pods
  • GENEVE tunnel health
  • MTU mismatch
  • NetworkPolicies
  • Node routing
  • Firewall rules
Q42. ImagePullBackOff.

Verify:

  • ImagePullSecret
  • Registry credentials
  • DNS resolution
  • Proxy configuration
  • Image name/tag
  • Registry availability

Expert-Level Questions

  1. Explain the complete OpenShift boot sequence from power-on to running pods.
  2. How does the Cluster Version Operator coordinate a zero-downtime upgrade?
  3. How does OVN-Kubernetes program Open vSwitch flows?
  4. Describe the reconciliation loop of an Operator in detail.
  5. Explain certificate rotation in OpenShift.
  6. How do you perform a full disaster recovery after losing all control plane nodes?
  7. Design an OpenShift platform for 5,000 worker nodes across multiple regions.
  8. How would you secure a regulated banking OpenShift environment (RBAC, SCC, NetworkPolicies, image signing, secrets management, audit logging, compliance)?
  9. Compare OpenShift virtualization with VMware for VM lifecycle management.
  10. How would you troubleshoot intermittent API latency caused by etcd disk contention?

These topics frequently appear in senior platform engineering and architect interviews because they test both conceptual understanding and real-world operational experience.

Leave a Reply