Platform engineer interview questions

As asked

Your company has 80 engineering teams and every team deploys services differently. How would you design a self-service platform that standardises the paved road?

Sample answer outline

Start with the most common service path: repository template, CI pipeline, container build, deployment, secrets, observability, and rollback. The platform should expose simple self-service APIs or portals while hiding Kubernetes, cloud IAM, and network details where possible. Strong answers balance golden paths with escape hatches, because forcing every workload into one shape creates shadow platforms. Adoption depends on migration support, clear docs, sensible defaults, and measuring developer lead time, failure rate, and support burden. The common mistake is building a portal before standardising the underlying runtime contracts.

Expect these follow-ups

• What should be configurable and what should be fixed?
• How do you migrate the first 20 teams?
• What metric proves the platform is helping rather than adding process?

As asked

You inherit a cloud estate where every team uses admin-like roles in a shared account. How would you redesign access without blocking delivery?

Sample answer outline

Start by separating environments and blast radii: production from non-production, shared platform from application accounts, and human access from workload identity. Define roles around actions people actually need, then enforce least privilege with permission boundaries, short-lived credentials, and break-glass access that is audited. Use infrastructure-as-code and policy-as-code so access changes are reviewed, repeatable, and testable. Strong answers mention migration sequencing because cutting everyone over in one move usually breaks deployments. Candidates often trip up by describing perfect IAM theory without a path from the current unsafe state.

Expect these follow-ups

• How do you handle a senior engineer who insists they need admin for debugging?
• Where would you use service control policies or organisation policies?
• What audit signals tell you the new model is working?

As asked

Your company has 40 data teams writing Airflow or Dagster jobs in different styles. How would you build a shared orchestration platform without becoming a ticket queue?

Sample answer outline

The platform should provide paved roads: project templates, deployment automation, secrets access, standard retries, alerting, and lineage out of the box. Teams should own their DAG code while the platform owns runtime reliability, conventions, and guardrails. Multi-tenancy needs isolation for dependencies, quotas, credentials, and noisy workloads. Adoption is won by making the easiest path the best path, not by banning all custom jobs on day one. Candidates often miss the product-management side of platform work: documentation, migration support, and measuring whether teams are actually faster.

Expect these follow-ups

• What should be centralised and what should remain team-owned?
• How do you prevent one team's job from starving everyone else?
• What platform metrics would you report after six months?

As asked

Walk me through exactly what happens inside the Kubernetes scheduler from the moment a pod is created until it is bound to a node. What are the two main phases, what plugins run in each, and where would you intervene if pods were stuck in Pending?

Sample answer outline

Strong answers cover the two-phase model: filtering (predicates) removes ineligible nodes, scoring (priorities) ranks the survivors. The scheduler uses a plugin framework so candidates name real plugins like NodeResourcesFit, PodTopologySpread, TaintToleration, and InterPodAffinity. For Pending pods they would check Events, describe the pod, inspect scheduler logs, and consider whether resource quotas, taints, or missing node selectors are blocking assignment.

Expect these follow-ups

• What is the extender mechanism, and when would you write a custom scheduler extender versus a custom scheduler plugin?
• How does descheduler complement the scheduler, and which eviction policies have you used?

As asked

Explain how Terraform implements state locking when using an S3 backend with DynamoDB. What happens if a lock is never released after a crash, how do you safely recover, and what design choices reduce the blast radius of a corrupted state file?

Sample answer outline

Candidates should describe that Terraform writes a lock entry to a DynamoDB table before any operation and deletes it when done. If the process crashes the lock remains; recovery requires terraform force-unlock with the lock ID. To reduce blast radius: separate state files per environment and per component so a corruption in one area does not affect others, enable S3 versioning to roll back, and use workspaces or directory-per-env patterns.

Expect these follow-ups

• What is the risk of running terraform apply with a partial state file, and how does the -refresh=false flag change the behavior?
• How do you move resources between state files without destroying and recreating them?

As asked

We have 15 product teams sharing a single cluster. Each team owns a set of namespaces. Developers should deploy workloads but not touch cluster-level resources. Platform engineers need cluster-wide read access. SREs need the ability to restart pods anywhere but not modify RBAC. Sketch the Role, ClusterRole, and binding strategy.

Sample answer outline

Strong answers distinguish Roles (namespaced) from ClusterRoles (cluster-wide) and show that ClusterRoles can be bound at namespace scope with RoleBindings. Developers get a ClusterRole with common verbs (get/list/watch/create/delete on pods, deployments, services, configmaps) bound per namespace via RoleBinding. Platform engineers get a ClusterRole with read-only verbs on all resources via ClusterRoleBinding. SREs get a ClusterRole with patch/delete on pods only, cluster-wide.

Expect these follow-ups

• How do you audit who has access to what across all namespaces? Which tools or commands help?
• What is impersonation in Kubernetes RBAC and what legitimate use case does it serve?