OpenShift Interview Questions: Key Features, Security and Operators Explained

Key takeaways

• Be able to say what OpenShift adds to Kubernetes: security defaults, Routes, builds, Operators, a console and a managed upgrade path.
• SCCs and RBAC are separate. RBAC controls who can do what via the API, SCCs control what pods may do on the node.
• Operators automate day-two work. OpenShift itself is run by a set of cluster operators.
• Know the oc basics: login, projects, get, describe, logs, debug, rollout and adm commands.
• Check version details against Red Hat documentation, because OpenShift changes with each release.

What is OpenShift and what are its key features?

OpenShift is an enterprise Kubernetes platform from Red Hat. It packages Kubernetes with a hardened operating system, a web console, security policies, developer workflows and lifecycle management. Key features interviewers ask about: Operators, Routes, SCCs, S2I and build tooling, image streams, integrated monitoring and logging, over-the-air cluster updates and multi-tenant projects. Details are in the Red Hat documentation.

How does OpenShift differ from Kubernetes?

What is a project?

A project is a Kubernetes namespace with extra annotations and default roles. Users create resources in a project, and quotas and network policies apply per project. oc new-project demo creates one and switches to it.

What are Security Context Constraints?

SCCs control what a pod may do on the node: which user IDs, Linux capabilities, volume types, host namespaces and SELinux settings are allowed. A pod is admitted only if its service account may use an SCC that permits the request. The default restricted family runs containers with a random non-root user ID. A classic interview question: an image that runs as root fails on OpenShift. The right fix is to rebuild the image to run as non-root, not to grant the anyuid SCC without thinking about risk.

How do RBAC and SCCs differ?

RBAC decides what a user or service account may do through the API (create a deployment, read secrets). SCCs decide what the resulting pods are allowed to do on a node. You need both.

What are Operators and the Operator Lifecycle Manager?

An Operator is a controller that encodes operational knowledge for an application: install, configure, upgrade, back up and heal. OLM installs and updates Operators from catalogs, using resources such as Subscription, OperatorGroup and ClusterServiceVersion. OpenShift itself is managed by cluster operators, which you can see with oc get clusteroperators. A degraded or unavailable cluster operator is the first place to look in a platform problem.

What is a Route?

A Route exposes a service on a hostname through the cluster's router (HAProxy-based ingress). It supports edge, passthrough and re-encrypt TLS termination. oc expose svc/myapp creates one.

What are S2I and image streams?

Source-to-Image builds a container image from application source and a builder image without a Dockerfile. An image stream is an abstraction that tracks tags of an image, so deployments can trigger when an upstream image changes.

Which oc commands should you know?

oc login https://api.cluster.example.com:6443
oc new-project demo
oc new-app --image=registry.example.com/team/web:1.0
oc get pods, svc, routes
oc describe pod web-1-abcde
oc logs deployment/web
oc debug node/worker-1
oc adm top nodes
oc rollout status deployment/web
oc get clusteroperators
oc adm policy add-role-to-user view alice -n demo

How do you troubleshoot a pod stuck in CrashLoopBackOff or ImagePullBackOff?

1. oc get pods and oc describe pod: read the Events section.
2. CrashLoopBackOff: oc logs --previous for the last crash, then check the command, config, probes and resource limits.
3. ImagePullBackOff: check the image name and tag, the pull secret, registry reachability and image policy.
4. Permission errors on start: check which SCC admitted the pod (annotation openshift.io/scc) and whether the image expects root.
5. Pending pods: look for quota, node selectors, taints and PVC binding.

How does monitoring work?

OpenShift ships with a Prometheus-based monitoring stack, Alertmanager and Grafana-style dashboards in the console for platform components. User workload monitoring can be enabled for applications. Logging is deployed through Operators; check the current logging stack for your OpenShift version, because it has changed between releases.

How do cluster upgrades work?

The Cluster Version Operator reads a release image and coordinates updates of cluster operators and nodes, with update channels such as stable. The Machine Config Operator updates node configuration and operating system, draining nodes in sequence. Always read the release notes and check update paths first.

What does certification expect?

Red Hat's EX280 exam covers OpenShift administration, EX288 covers application development, and EX188 covers containers with Podman. Details and objectives are on the Red Hat Training and Certification site.

Next steps

To practise these on a real cluster, see WebAsha's OpenShift training. For more question sets, see top 50 OpenShift interview questions.

Related reading

• How to Prepare for OpenShift Interviews | Questions and Best Practices
• [2026] List of 50+ OpenShift Interview Questions and Answers
• [2026] Top 50+ Kubernetes Interview Questions and Answers