Managed Kubernetes — Amazon EKS, Azure AKS and Google GKE — is one of the most-asked DevOps interview areas in 2026. Here are the questions that come up most, with concise answers.
What's the difference between EKS, AKS and GKE?
All three are managed Kubernetes control planes. GKE is the most 'batteries-included' (Autopilot, fast upgrades); EKS gives the most AWS-native integration (IAM, VPC CNI) but more setup; AKS is tightly integrated with Entra ID and Azure networking. The worker nodes and your workloads are your responsibility on all three.
Who manages the control plane?
The cloud provider manages the API server, etcd, scheduler and controller-manager (HA, patched, backed up). You manage node pools, workloads, networking policy and add-ons.
How does pod networking work on EKS?
EKS commonly uses the AWS VPC CNI, which assigns each pod a real VPC IP from the node's ENIs. This gives native VPC routing and security groups but means IP planning matters (pods consume VPC IPs).
How do you give a pod cloud permissions securely?
EKS: IAM Roles for Service Accounts (IRSA) / EKS Pod Identity. AKS: Microsoft Entra Workload Identity. GKE: Workload Identity. All map a Kubernetes service account to a cloud identity — no long-lived keys in pods.
How does cluster autoscaling work?
The Cluster Autoscaler (or Karpenter on EKS) adds/removes nodes based on pending pods; the Horizontal Pod Autoscaler scales pod replicas on CPU/memory/custom metrics. GKE Autopilot abstracts nodes entirely.
How do you upgrade a cluster with zero downtime?
Upgrade the control plane first, then node pools using a surge/rolling strategy, draining nodes with PodDisruptionBudgets so a minimum number of replicas stay available.
How do you expose a service externally?
A Service of type LoadBalancer provisions a cloud LB (NLB/ALB via AWS Load Balancer Controller, Azure LB/App Gateway, GCP LB). Ingress controllers (NGINX, cloud-native) handle L7 routing and TLS.
How do you handle secrets?
Kubernetes Secrets (encrypted at rest with a KMS/CMK), or external managers via CSI drivers — AWS Secrets Manager, Azure Key Vault, GCP Secret Manager — so secrets never live in manifests or images.
What's a PodDisruptionBudget and why use it?
A PDB sets the minimum pods that must stay available during voluntary disruptions (node drains, upgrades), preventing an upgrade from taking a whole service down.
How do you troubleshoot a Pending pod?
kubectl describe pod to read events: insufficient CPU/memory (scale nodes), unschedulable due to taints/affinity, PVC not bound, or image pull errors. Fix the root cause the events point to.
Want hands-on, job-ready training? Explore our courses, the APEX and FDE PRO programs, or call/WhatsApp +91 96660 19191 to book a free demo.
Kubernetes & DevOps training in Hyderabad — classroom in Ameerpet, Hyderabad or live online, with placement support until you're placed.
📞 Call +91 96660 19191💬 WhatsAppKubernetes course →