Pods in one namespace cannot reach an external API by hostname, but the IP works. What is happening?
What they are really testing: Whether you can isolate DNS as a layer and know how cluster DNS actually resolves. Working by IP and failing by name is a precise clue most candidates skip past.
A real interview question
Pods in one namespace cannot reach an external API by hostname, but the IP works. What is happening?
What most people say
drag me
“I would hardcode the IP address in the config so it works.”
It removes the symptom and creates a time bomb: the external provider rotates that IP and the service breaks with no obvious cause. It also abandons the actual diagnosis, which will affect every other name in that namespace.
The follow-ups they ask next
Why does ndots cause intermittent slowness rather than failure?
Each search suffix is a query, so a name needing 5 attempts costs 5 round trips. Under DNS load or packet loss, those extra queries time out and latency spikes, while the name eventually resolves.
DNS works in every namespace but this one. What is the very first thing you check?
Network policies in that namespace. Namespace-scoped policy is the only common thing that differs, and forgetting UDP 53 egress in a default-deny policy is the classic error.
What the interviewer is listening for
- Uses IP-versus-name as a precise isolation clue
- Suspects namespace-scoped network policy
- Knows ndots and search domain behaviour
What sinks the answer
- Hardcodes the IP
- Tests resolution from their laptop
- No awareness DNS needs an egress rule
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“IP working and name failing [isolates it to DNS only]. One namespace failing [points at namespace-scoped network policy, usually a default-deny that forgot UDP 53 egress]. Otherwise [resolve from inside the pod], [check resolv.conf search domains and ndots], and [check DNS pod health]. Hardcoding the IP is [a future outage].”
Keep going with troubleshooting
Junior
A developer says the build passes locally but fails in CI. How do you debug that?
Junior
A production server is failing writes. Disk is 100% full. Walk me through what you do.
Junior
At midnight everything started failing with TLS errors. What happened and what do you do?
Mid
A pod is in CrashLoopBackOff after a deploy. Walk me through your debugging, command by command.
Mid
The deploy reports success, pods are Running, but users get 502s. Where do you look?
Mid
A Kubernetes node goes NotReady and pods are stuck Terminating. What is happening and what do you do?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free