Platform Engineer interview questions
100 real questions with model answers and explanations for Senior Platform Engineer candidates.
See a Platform Engineer resume example →Practice with flashcards
Spaced repetition · Hunter Pass
Questions
I put a capability in the platform when several teams need the same safe, repeatable workflow and the platform can expose a stable contract.
- The platform owns shared interfaces such as service creation, deployment, identity, and observability defaults, not each service's business configuration.
- A product team keeps domain choices and may leave the golden path through a documented escape hatch when its workload genuinely differs.
- I validate the boundary with support volume and adoption data; a one-team need with no reuse usually remains local.
Why interviewers ask this: The interviewer is checking whether the candidate treats the platform as a bounded internal product instead of a collection of all infrastructure work.
A good platform API exposes the developer intent, returns observable status, and hides provider details without hiding important constraints.
- I prefer a small declarative contract such as service size and data class over dozens of cloud-specific fields.
- Validation should fail before provisioning with a field-level message and a link to the supported values.
- Long operations need an operation ID, idempotency key, status conditions, and a safe retry path rather than a synchronous timeout.
Why interviewers ask this: The interviewer wants practical API design that makes self-service predictable while preserving useful platform boundaries.
I would own a narrow capability, define its users and success signal, then iterate from observed workflow friction.
- For a database provisioning module, I might track successful self-service completion, median lead time, and support requests per 20 provisions.
- I would interview two or three consuming teams before changing the contract and publish a short compatibility plan.
- Requests that do not fit the capability become evidence for an extension point or an explicit non-goal, not automatic scope growth.
Why interviewers ask this: The interviewer is evaluating whether the candidate can own a reusable capability with measurable customer outcomes.
I would use Component for deployable services, API and Resource for their contracts and dependencies, then connect them to System, Domain, Group, and User ownership.
- The entity owner should be a real Group with an on-call or support route, not a free-form team name that cannot be resolved.
- Relations such as providesApi, consumesApi, dependsOn, and partOf let teams navigate impact without copying dependency lists into descriptions.
- I keep lifecycle and system boundaries small enough to be maintained by service owners during normal pull requests.
Why interviewers ask this: The interviewer is checking practical understanding of the Backstage catalog model and accountable ownership.
Locations tell Backstage where metadata originates, processors transform or validate entities, and annotations attach integration-specific references.
- I favor catalog-info.yaml beside the service so metadata changes follow the same review path as code.
- A GitHub annotation can point plugins to the repository, while TechDocs and Kubernetes annotations connect documentation and runtime views.
- Custom processors should normalize only stable company conventions and report rejected entities clearly rather than silently repairing bad metadata.
Why interviewers ask this: The interviewer wants to see that the candidate understands the catalog ingestion path beyond editing a YAML example.
I would make the template a thin orchestration layer that gathers intent, calls tested actions, and leaves the generated service in a verifiable state.
- Parameters should ask for owner, system, runtime, data classification, and size while deriving repository and namespace names consistently.
- Actions can create the repository, render the skeleton, register the catalog entity, and open a GitOps pull request with explicit outputs from each step.
- The final page should link to the repository, deployment request, documentation, and rollback or cleanup guidance if a later action fails.
Why interviewers ask this: The interviewer is assessing whether the candidate can build a usable and recoverable scaffolding workflow.
I would add a plugin only when the portal can simplify a recurring developer task through a supported backend contract.
- The frontend plugin should not receive cloud credentials; a backend plugin performs authorized calls and returns only the needed data.
- Permission rules should use catalog ownership and group membership so a user cannot act on another team's resources by changing a URL.
- I would define loading, empty, denied, and dependency-failure states because internal APIs are not always available.
Why interviewers ask this: The interviewer is checking plugin boundaries, authorization, and user experience under failure.
I would keep docs with the owning repository, build them in CI, and make freshness and ownership visible in the catalog.
- A service template should create a minimal MkDocs structure covering local run, deployment, dependencies, and support contact.
- The CI publisher avoids giving the Backstage instance broad repository credentials and produces the same artifact developers preview locally.
- A scorecard can flag missing or stale runbooks, but the owning team decides the content and reviews it with code changes.
Why interviewers ask this: The interviewer wants a practical TechDocs workflow with clear ownership and secure publishing.
I would score a small set of actionable platform expectations and show the evidence and next step for every result.
- A production-readiness check could verify an owner, SLO link, resource requests, and approved deployment workflow from authoritative systems.
- Checks should distinguish unknown from failed so an integration outage does not make every service appear noncompliant.
- I would first show scorecards privately to teams and measure completed remediations before considering any release gate.
Why interviewers ask this: The interviewer is evaluating whether scorecards drive improvement without becoming an arbitrary vanity ranking.
A golden path should provide the shortest supported route from service intent to a running, observable, owned workload.
- It can combine a repository template, reusable CI workflow, deployment manifests, workload identity, default dashboards, and catalog registration.
- Defaults must encode common safety requirements but expose bounded choices such as runtime version, service size, and whether a database is needed.
- The path includes upgrade and support mechanisms; generated code that is abandoned after day one is only a starter template.
Why interviewers ask this: The interviewer is checking whether the candidate understands a golden path as a maintained lifecycle, not code generation alone.
I would version every consumed contract and separate template creation version from the versions of maintained modules and workflows.
- New repositories pin a released template bundle such as 2.3, while reusable workflows and Terraform modules use explicit major or minor references.
- A changelog marks required migrations, and compatibility tests render representative service fixtures against the proposed release.
- I support the previous major version for a stated window and use automated pull requests to move consumers instead of silently changing them.
Why interviewers ask this: The interviewer wants a bounded versioning model that prevents central templates from unexpectedly breaking consumers.
I treat generated interfaces, workflow inputs, labels, file paths, and module outputs as contracts even when they are not formal APIs.
- Golden fixtures cover a minimal service, a database service, and a customized service so structural changes are caught before release.
- Additive fields get safe defaults, while removals use a deprecation period and a migration that can be run repeatedly.
- Consumer CI verifies the rendered result and its deployment plan, not just whether the template engine completed.
Why interviewers ask this: The interviewer is checking whether the candidate can recognize and test hidden contracts in platform templates.
I make the supported path easier than custom infrastructure, but I keep an explicit extension point for requirements the path cannot safely express.
- A team can supply bounded overlays or choose an approved advanced module without forking the whole template.
- An exception records owner, reason, risk, and review date so temporary deviations do not become invisible permanent platforms.
- I review repeated exceptions quarterly; three similar requests usually indicate a missing platform capability rather than user resistance.
Why interviewers ask this: The interviewer is evaluating whether the candidate can encourage adoption without blocking legitimate workload needs.
Onboarding should establish identity, ownership, delivery, runtime boundaries, and support signals before the first production deployment.
- The workflow creates the repository and catalog entity with the owning group, system, lifecycle, and contact route.
- It provisions a namespace or account boundary, least-privilege workload identity, deployment configuration, and observable status.
- Completion requires a successful test deployment, dashboard and SLO links, and a documented removal path for abandoned services.
Why interviewers ask this: The interviewer wants evidence that onboarding creates an operable platform customer, not only a repository.
I would make ownership transfer and retirement first-class catalog workflows with approval from both the current and receiving owners.
- The transfer updates the catalog Group relation, repository permissions, alerts, cost labels, and workload identity bindings in one reviewed change set.
- A retirement state blocks new production releases before resources are deleted and lists dependencies that must acknowledge the removal.
- Final cleanup verifies traffic is zero, retains required audit data, and removes catalog and infrastructure records without leaving orphaned costs.
Why interviewers ask this: The interviewer is checking lifecycle ownership across portal metadata and underlying platform resources.
I would use namespaces as the primary administrative boundary, then combine them with RBAC, quotas, network policy, and admission controls.
- Each team gets separate production and nonproduction namespaces with stable labels for ownership, cost, policy, and observability.
- Namespace isolation is not a hard security boundary by itself, so highly untrusted workloads may require separate clusters or accounts.
- The onboarding capability creates the full policy bundle consistently instead of asking every team to assemble it.
Why interviewers ask this: The interviewer is testing whether the candidate understands both the value and limitations of namespace tenancy.
I would grant groups permissions by role and namespace, while workloads receive separate service accounts with narrower runtime permissions.
- Developers may read workloads and logs in production but deploy through GitOps, while an on-call group gets time-bounded diagnostic access.
- RoleBindings reference centrally managed Roles so common permissions are reviewed once and reused consistently.
- I test permissions with authorization checks for allowed and denied actions because broad wildcard verbs and resources are easy to miss in review.
Why interviewers ask this: The interviewer wants a practical least-privilege model that still supports developer workflows.
ResourceQuota caps aggregate namespace consumption, while LimitRange supplies or constrains requests and limits for individual objects.
- A quota might allow a team 20 CPU and 40 GiB memory across all pods, preventing one namespace from consuming the cluster.
- A LimitRange can default each container to 100 millicores and 256 MiB so a missing request does not bypass scheduling and cost data.
- I set them together and expose current usage in the portal because defaults without visible headroom cause confusing deployment failures.
Why interviewers ask this: The interviewer is checking that the candidate can apply both controls without confusing their scopes.
I would start with default-deny ingress and egress, then add explicit rules for DNS, ingress traffic, required dependencies, and observability endpoints.
- Selectors use stable namespace and workload labels managed by the platform rather than pod names or mutable release labels.
- Egress rules account for DNS and external endpoints, otherwise a secure-looking policy can break service discovery or certificate checks.
- The template includes connectivity tests so teams see which contract is blocked before production.
Why interviewers ask this: The interviewer wants practical network isolation that remains debuggable and compatible with service needs.
Pod Security Admission enforces broad workload security profiles, while admission policy handles organization-specific requirements and exceptions.
- I label application namespaces with the restricted profile and use warn or audit mode before enforce during adoption.
- A Gatekeeper or Kyverno rule can require approved registries, resource requests, or workload identity labels that Pod Security does not cover.
- Exceptions are namespace-scoped, owned, and expiring rather than a global bypass for one incompatible workload.
Why interviewers ask this: The interviewer is checking the candidate's ability to layer standard and custom admission controls safely.
Locked questions
- 21
When would you choose Gatekeeper, Kyverno, or native Kubernetes admission policies?
kubernetespolicy-as-code - 22
What PodDisruptionBudget contract would you expose through a shared workload capability used by multiple internal teams?
- 23
How would you define the autoscaling contract of a shared workload capability used by multiple internal teams?
autoscalingscaling - 24
How would you expose workload identity through a platform capability?
- 25
What is a sound secret-management contract for application teams?
secretsconfiguration - 26
What should the public contract of a reusable Terraform module contain?
terraform - 27
How would you version a Terraform module used by multiple teams?
terraform - 28
Why use a remote Terraform backend with state locking?
terraformlocking - 29
How should a shared Terraform capability used by multiple internal teams handle adoption of existing resources and module refactoring?
decision-makingrefactoringterraform - 30
How should provider aliases be handled in reusable Terraform modules?
terraform - 31
When is Terragrunt useful, and when is it unnecessary?
- 32
How would you test a Terraform module and a service template before release?
terraformtemplates - 33
What are the main Crossplane concepts for exposing a database capability?
iacdatabase - 34
How would you make a Crossplane composition understandable to its consumers?
iacoop - 35
What does GitOps reconciliation provide beyond running kubectl from CI?
kubernetesgitopskubectl - 36
When would you use Argo CD app-of-apps versus ApplicationSet?
gitops - 37
What ordering and hook defaults would you put in a shared Argo CD delivery capability used by multiple internal teams?
gitopshooks - 38
How would you add progressive delivery to a GitOps platform?
gitops - 39
How would you design a reusable CI workflow as a platform API?
designapi - 40
How do you choose between hosted and self-hosted CI runners?
- 41
What cache and artifact contract should a shared CI capability provide to multiple internal teams?
cachingartifacts - 42
How should concurrency be controlled in reusable delivery workflows?
formsconcurrency - 43
What supply-chain basics should a platform build workflow provide?
- 44
How do Helm and Kustomize serve different platform needs?
helmkuberneteskustomize - 45
When should a platform offer a service mesh capability?
service-mesh - 46
How would you design an OpenTelemetry capability for application teams?
observabilitydesign - 47
How do you control Prometheus cardinality and use recording rules?
monitoring - 48
How would you define reliability goals for a platform capability?
reliability - 49
How should a platform team use DORA metrics?
platform-engineeringmonitoring - 50
How would you add cost allocation and right-sizing to a self-service platform?
self-service - 51
A repository contains valid catalog-info.yaml, but its Backstage Component disappeared after the team moved it to a new GitHub organization. What do you inspect?
yamlbackstagecomponents - 52
Two teams report a Backstage Component named payments-api, and its links appear to lead to different owners. How do you determine whether this is an ingestion conflict?
componentsapibackstage - 53
A Scaffolder run creates a repository and cloud database, then fails before opening the GitOps pull request; three abandoned databases appeared this week. What do you change?
gitopsdatabasecode-review - 54
A custom Scaffolder action can create repositories, but any signed-in developer can use it to create one in the security team's GitHub organization. How do you fix authorization?
auth - 55
A Backstage cost plugin works for admins but returns 403 through the proxy for ordinary service owners, while calling the cost API directly with the backend token succeeds. How do you debug it?
tokensapiproxy - 56
TechDocs says a service has a current runbook, but the readiness scorecard still fails it for 18 hours after publication. How do you find the drift?
health-checksiacrunbooks - 57
A golden-path update moves the reusable workflow from version 3 to 4, and 6 of 24 services fail because they still pass the removed deploy_region input. How do you roll it out safely?
deploymentci-cd - 58
Four teams copied and forked the deployment chart to add one sidecar, and platform support tickets rose from 2 to 11 per month. What escape hatch would you design?
designworkloadsdeployment - 59
A namespace has a 10 CPU quota, current requests total 9 CPU, and a new Pod requesting 500 millicores is rejected even though nodes are idle. LimitRange also defaults 1 CPU for a missing sidecar request. What do you fix?
workloadsnamespaceskubernetes-workloads - 60
A team sets minAvailable to 3 on a three-replica workload, and a node drain has been blocked for 40 minutes; they say the PDB guarantees zero downtime. What do you do?
replication - 61
Request rate doubles, HPA raises a service from 4 to 12 replicas, but 8 Pods stay Pending for 7 minutes and latency remains high. How do you debug HPA with cluster autoscaler?
latencyautoscalingscaling - 62
A new admission rule requiring owner labels rejects every Deployment from the shared Helm chart, including emergency rollbacks. How do you recover and improve the policy?
deploymentrollbackhelm - 63
Developers can deploy through Argo CD, but their Pods receive AccessDenied from object storage after a platform RBAC cleanup. How do you isolate Kubernetes RBAC from workload identity?
kubernetesdeploymentgitops - 64
After enabling default-deny egress, Pods can reach a database by IP but fail to resolve its hostname, and 14 services report lookup timeouts. What do you change?
databaseresilience - 65
A generated workload is denied under the restricted Pod Security profile because it runs as UID 0; a separate admission report also recommends a read-only root filesystem. How do you preserve the platform guardrail?
workloadskubernetes-workloadsguardrails - 66
A rollout with 6 replicas stalls at 3 updated Pods because the new readiness check fails, while maxUnavailable is 0 and maxSurge is 50 percent. What do you do?
replicationhealth-checks - 67
After a KMS key rotation, Terraform plans for 11 services fail because the remote backend can list state objects but cannot decrypt them. How do you restore the shared state capability?
terraform - 68
A nightly Terraform plan from the shared infrastructure workflow wants to remove a public tag and restore an old security-group rule across services owned by the checkout and search teams. How do you handle drift?
terraformiacsoft-skills - 69
A shared Terraform module renames and removes the deployment_role_arn output, and 18 consuming pipelines fail with unsupported attribute errors. How do you restore and evolve the module contract?
terraformdeploymentci-cd - 70
A reusable Terraform module creates a replica in eu-west-1, but its KMS key is planned in the default us-east-1 account after a refactor. What do you inspect?
terraformreplicationrefactoring - 71
Upgrading a shared network module from 2.8 to 3.0 makes the plan replace 12 route-table associations. How do you handle the module upgrade?
soft-skills - 72
After moving aws_s3_bucket.logs into module.logging, Terraform plans to destroy and recreate the bucket containing audit logs. What is the correct refactor?
terraformloggingrefactoring - 73
Terraform can read remote state in CI but fails to write the updated state after creating resources, leaving the job red. Which backend permissions and recovery steps do you investigate?
terraform - 74
A database module marks password as sensitive, but a reusable CI workflow prints it while serializing all Terraform outputs to deployment.json. What do you change?
terraformdeploymentserialization - 75
A Crossplane database claim has stayed Synced=False for 22 minutes, and its event says a composed subnet selector matched zero resources. How do you debug the composition?
iacdatabaseoop - 76
A Crossplane claim reports Synced=True but Ready=False because the managed database is available while its connection secret never appears. What do you inspect?
iacdatabasesecrets - 77
Deleting a service claim starts deleting a production database that the data team expected to retain. How do you correct Crossplane ownership semantics?
iacdatabaseownership - 78
Argo CD repeatedly syncs Deployments from the shared GitOps workflow every three minutes because a platform operator rewrites one annotation, disrupting three application teams. How do you stop the loop?
deploymentgitopskubernetes-deployment - 79
A Custom Resource from the shared cluster-bootstrap workflow is applied before its CRD during Argo CD sync, so first deployment fails for every team onboarding a new cluster. How do you fix ordering?
workloadsoperatorscluster - 80
A PreSync schema-migration hook in the shared deployment workflow times out after applying half its data changes, and every Argo CD retry restarts it for two product teams. How do you make the hook safe?
deploymentgitopsschema - 81
An ApplicationSet merge adds a new cluster label, and 27 preview Applications are suddenly marked for deletion. What do you do before reconciling it?
cluster - 82
External Secrets rotates a value every hour, but Argo CD continuously reports the generated Secret OutOfSync and replaces it with an encrypted Git value. How do you resolve ownership?
gitgitopssecrets - 83
The platform's shared Argo Rollouts workflow passes staging but pauses checkout at 25 percent in production after p95 latency rises from 180 to 260 ms, affecting the payments team. What do you do?
latencygitops - 84
A called GitHub Actions workflow fails to publish an image because packages: write is absent, so a team changes permissions to write-all. What do you put in the reusable workflow contract?
ci-cd - 85
A shared CI cache makes Java builds fast, but 9 percent of runs fail after switching from JDK 21 to 23 because old compiled classes are restored. How do you fix the cache?
caching - 86
A test job in the shared build workflow uploads reports, but the deploy job downloads an app artifact from the wrong matrix leg and ships the wrong architecture to teams using the platform. How do you fix artifact flow?
deploymentartifactsarchitecture - 87
Two repositories share a persistent self-hosted runner, and a pull-request build can read a deployment credential left in the workspace by the previous job. What do you change?
deploymentci-cdworkloads - 88
Two production deployment runs for the same service overlap, and the older run finishes last, restoring the previous image. How do you configure concurrency?
deploymentconfigconcurrency - 89
A release image has an SBOM, but its package list differs from the image because the SBOM was generated from the source directory before the final build stage. What do you change?
supply-chain - 90
Cosign verification succeeds for images from an engineer's personal workflow as well as the protected release workflow. How do you tighten signature policy?
discovery - 91
A Kustomize production overlay patches a field that a newly upgraded Helm chart renamed, so the patch matches nothing and replicas fall back from 4 to 1. How do you prevent this?
helmkuberneteskustomize - 92
After enabling retries in the platform mesh capability, checkout sends three times more payment requests during 503s and duplicate attempts rise to 2 percent for the payments team. What do you change?
- 93
A service from the orders team gets TLS handshake errors only when calling a newly meshed dependency owned by inventory, while plaintext calls from a debug Pod work. How do you debug the shared mTLS capability?
tlsmtlsworkloads - 94
HTTP requests keep one trace across checkout services, but Kafka messages consumed by the fulfillment team start new traces, disconnecting 38 percent of checkout traces. What do you fix in the shared telemetry capability?
kafkaobservabilityhttp - 95
During a 12-minute telemetry-backend outage, the shared OpenTelemetry Collector queue fills, memory reaches 90 percent, and telemetry disappears for six application teams. How do you stabilize the platform capability?
observabilitymemorydata-structures - 96
A new request_path label emitted by the shared telemetry SDK grows Prometheus active series from 1.2 million to 4.8 million, and dashboards used by eight teams take 19 seconds. What do you do?
monitoringdashboardsobservability - 97
A platform provisioning SLO reports 99.9 percent success, but 320 invalid form submissions are counted in the denominator while 14 valid requests failed. What denominator would you use?
sloforms - 98
A team is charged 40 percent of a shared cluster because its CPU requests are high, but p95 usage is only 18 percent of those requests. How do you improve cost allocation and right-sizing?
cluster - 99
Platform adoption is stuck at 46 percent, and the team spends 18 hours a week answering the same namespace and CI questions. What do you prioritize?
prioritizationproblem-solvingdecision-making - 100
Internal teams need preview environments: most need one for 24 hours, but two teams require private datasets and seven-day debugging. What capability would you design first?
design