DevOps L1 Interview Pitch & Architecture Studio Capgemini L1 Prep

STAR Answer: In our AWS environment, we configure Terraform remote backend using Amazon S3 for state storage with versioning and encryption enabled, coupled with an Amazon DynamoDB table for state locking via LockID string primary key. When terraform apply runs, Terraform acquires a lock in DynamoDB, rejecting concurrent executions with Error: Error acquiring the state lock until the active mutation is safely committed.

STAR Answer: EKS managed node groups are provisioned across private subnets without public IPv4 addresses to minimize attack surfaces. Internet egress (e.g., pulling container images from public registries or sending CloudWatch metrics) is strictly routed through an AWS NAT Gateway situated in a public subnet with an Elastic IP and Internet Gateway attached.

STAR Answer: Amazon EKS utilizes the amazon-vpc-cni-k8s plugin by default. Unlike overlay networks like Flannel, AWS VPC CNI allocates real secondary private IP addresses directly from the node's host VPC subnet to each Kubernetes Pod. This enables direct, unencapsulated VPC-native latency and native AWS Security Group enforcement at the Pod level.

STAR Answer: We monitor node CPU/Memory utilization and disk pressure via CloudWatch Container Insights and Prometheus node_exporter. On the Kubernetes control plane side, we track API server request latency and Pod restart loops (CrashLoopBackOff). Ingress latency and HTTP 5xx spikes are caught at the AWS ALB Ingress Controller layer.