OpenShift Interview Questions and Answers: Concepts, oc Commands and Troubleshooting

Key takeaways

• OpenShift is Kubernetes plus a built-in developer and security platform: routes, builds, image streams, SCCs, operators and a web console.
• Know the basic oc commands cold: new-project, new-app, get, describe, logs, rsh, debug, scale, expose.
• DeploymentConfig is deprecated in current OpenShift 4 releases; new work uses Deployment.
• Interviewers like troubleshooting scenarios: pending pod, ImagePullBackOff, CrashLoopBackOff, route not working.
• Security questions on SCCs, RBAC and running as non-root come up often because OpenShift is strict by default.

Fundamentals

What is the difference between OpenShift and Kubernetes?

OpenShift is Red Hat's Kubernetes distribution with extra built-in features: a web console, integrated builds (BuildConfig and Source-to-Image), image streams, Routes, stricter default security (security context constraints), an operator-based installation and update model and enterprise support. Kubernetes is the upstream orchestration project. See the Red Hat documentation for your OpenShift version.

What is a project?

A project is a Kubernetes namespace with extra annotations and default role bindings. It isolates resources and access for a team or application.

What are the main components of an OpenShift 4 cluster?

Control plane nodes run the API server, etcd, scheduler and controllers. Worker nodes run workloads with CRI-O as the container runtime. Cluster operators manage platform components, and you can list them with oc get clusteroperators.

What is an Operator?

An operator is a controller that encodes operational knowledge for an application: install, upgrade, backup and repair. OpenShift uses operators for itself, and the Operator Lifecycle Manager (OLM) installs optional ones from catalogs.

Everyday oc commands

How do you scale an application?

oc scale deployment/web --replicas=3. For automatic scaling, create a HorizontalPodAutoscaler with oc autoscale deployment/web --min=2 --max=5 --cpu-percent=70. Older answers use dc/ (DeploymentConfig), which is deprecated in recent OpenShift 4 releases, so say that in the interview.

How do you view logs and events?

oc logs pod/<name> for container output, oc logs -f to follow, oc logs --previous for a crashed container, and oc get events --sort-by=.lastTimestamp for cluster events.

How do you create a route and what is it?

A Route exposes a service to external clients through the OpenShift router (HAProxy-based) using a hostname. oc expose svc/web creates one. TLS can terminate at the edge, be passed through or be re-encrypted. Kubernetes Ingress is the upstream equivalent, and OpenShift can create routes from Ingress objects.

Builds and images

What is Source-to-Image (S2I)?

S2I builds a container image from source code using a builder image that knows the language, so developers do not write a Dockerfile. oc new-app with a Git URL can trigger it.

What is an ImageStream?

An ImageStream tracks image tags inside OpenShift and can trigger builds or deployments when a tag changes. It adds a layer between your workload and the external registry.

How do you import an existing image?

oc import-image myapp --from=registry.example.com/team/myapp:1.0 --confirm creates or updates an ImageStream tag from an external registry.

What is a BuildConfig?

It defines how to build an image: the source, strategy (Source, Docker, Custom), output image and triggers such as a webhook or config change. Newer clusters also offer Builds for Red Hat OpenShift based on Shipwright, so mention that you would check the version in use.

Security

What are Security Context Constraints (SCCs)?

SCCs control what a pod may do: which user IDs it runs as, whether it can be privileged, which volumes and capabilities it may use. By default OpenShift runs containers with an arbitrary non-root user ID, which is why many Docker Hub images that expect root fail. Check with oc get pod <name> -o yaml | grep scc, and fix the image rather than granting the anyuid SCC unless there is a reason.

What is RBAC in OpenShift?

Role-based access control gives users and service accounts permissions through roles and role bindings. Example: oc adm policy add-role-to-user edit alice -n demo.

How do you manage secrets and config?

Use Secrets for sensitive data and ConfigMaps for non-sensitive settings. Mount them as files or expose as environment variables. Remember base64 is encoding, not encryption.

Troubleshooting scenarios

A pod is stuck in Pending. What do you check?

oc describe pod and read the Events. Common causes: not enough CPU or memory on any node, an unbound PersistentVolumeClaim, node selectors or taints that no node satisfies, or a project quota.

ImagePullBackOff?

The node cannot pull the image. Check the image name and tag, registry reachability and whether a pull secret is linked to the service account.

CrashLoopBackOff?

The container starts and exits. Use oc logs --previous, check the command and environment variables, and test whether the app needs root or a writable path. A failing readiness or liveness probe also causes restarts.

The route returns 503. Why?

Usually the service has no ready endpoints. Check oc get endpoints web, confirm the service selector matches pod labels, the pod is Ready and the target port is right.

How do you debug a pod that will not start?

oc debug deployment/web starts a copy with a shell instead of the normal command. oc debug node/<node> gives a shell on a node for host-level checks.

Administration

How are cluster updates handled?

The Cluster Version Operator manages updates through channels. Admins review with oc adm upgrade and the web console, then trigger an update to a supported version.

What are MachineConfigs and MachineSets?

MachineConfigs manage operating system configuration on nodes (RHEL CoreOS) in a controlled way. MachineSets manage groups of worker machines on supported platforms, similar to a Deployment for nodes.

What is the difference between a Deployment and a StatefulSet?

Deployments run interchangeable pods. StatefulSets give each pod a stable identity and storage, used for databases.

How is storage provided?

Through PersistentVolumes and PersistentVolumeClaims, using StorageClasses for dynamic provisioning. OpenShift Data Foundation is Red Hat's storage option.

How to prepare

• Run OpenShift Local (formerly CodeReady Containers) or a trial cluster and break things on purpose.
• Practise explaining each answer in two sentences with one command.
• Learn the troubleshooting order: status, events, describe, logs, debug.
• Read the objectives for the Red Hat OpenShift Administration exam (EX280) if you are certifying.

More practice is in our posts on scenario-based OpenShift questions, 50 common OpenShift questions and another 50-question set.

Next steps

Next steps: to practise on a real cluster, see our DO280 | EX280 OpenShift Administration course, and try the scenario-based questions.

Related reading

• OpenShift DO280 | EX280 Real Exam Questions and Answers