hardScenarioDesignSeniorStaff
A Kubernetes cluster admin account has been compromised for 45 minutes. Do you clean the cluster or burn it to the ground, and why?
2 min readUpdated 2026-08-15
Answer
Short answer
Evaluate the candidate's crisis management and technical recovery skills in a high-stakes scenario involving a total compromise of Kubernetes administrative control.
Was this answer helpful?
Likely follow-ups
- How would your response differ if the compromised account only had access to a single namespace rather than full cluster-admin?
- What compensating controls would you put in place so a single stolen kubeconfig can never grant cluster-admin again?
- How do you prove to auditors and customers that the rebuilt cluster is clean, given you cannot fully trust anything from the old environment?
Related questions
- Would you use iptables or eBPF for network policy enforcement in a massive multi-tenant Kubernetes cluster, and what are the operational trade-offs?hardAlso on kubernetes and security2 min
- A customer reports seeing another company's records in your admin console. Walk me through the first hour, and then tell me what you change so this class of bug cannot happen again.hardAlso on security4 min
- Pods are being evicted during node pressure even though your CPU dashboards look fine. Where do you look, and what would you change so it stops?hardAlso on kubernetes4 min
- An upstream feed resets ten thousand of your prices to a penny and orders start arriving. What should have stopped it, and what do you do with the orders that got through?hardAlso on incident-response6 min