Interview › Infrastructure as Code (Terraform, Ansible)
Why does the config hash suffix help trigger rolling updates?
Infrastructure as Code (Terraform, Ansible) · Advanced level
Answer
The hash suffix helps trigger rolling updates because a Deployment that references the generated ConfigMap or Secret sees its Pod template reference change when the config content changes. That changes the ReplicaSet template hash and causes Kubernetes to roll new Pods.
Technical explanation
Kubernetes rolls a Deployment when spec.template changes.
A generated config name change updates the volume or envFrom reference in the Pod template.
This avoids stale Pods continuing to use old mounted config.
Keep source manifests or IaC definitions readable enough that reviewers can understand the final desired state.
Use overlays, modules, or roles for reuse, but keep environment-specific differences explicit and reviewable.
Validate generated output in CI before applying it through kubectl, Argo CD, Terraform, or Ansible.
Hands-on example
1. Create a Kustomize base and overlay for: Why does the config hash suffix help trigger rolling updates?
2. Base files:
base/deployment.yaml
base/service.yaml
base/kustomization.yaml
base/kustomization.yaml:
resources:
- deployment.yaml
- service.yaml
commonLabels:
app.kubernetes.io/name: payments
3. prod overlay:
resources:
- ../../base
namePrefix: prod-
namespace: payments-prod
images:
- name: ghcr.io/company/payments
newTag: 1.8.4
configMapGenerator:
- name: app-config
literals:
- LOG_LEVEL=info
patches:
- path: replica-patch.yaml
4. Render and apply:
kubectl kustomize overlays/prod
kubectl diff -k overlays/prod
kubectl apply -k overlays/prod
5. In GitOps, point Argo CD at overlays/prod and let it render, compare, and sync the desired state.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Infrastructure as Code (Terraform, Ansible) interview questions
- What is Infrastructure as Code, and what problems does it solve over click-ops?
- What is the difference between declarative and imperative IaC, and where do Terraform and Ansible fall?
- What is the difference between configuration management and provisioning?
- What is Terraform, and what is the core plan/apply workflow?
- What does terraform init do?
- What is the Terraform state file, and why is it critical?
- Why should state be stored remotely, and what backend would you use on AWS?
- What is state locking, and why does it matter for teams?