Kubernetes

Kubernetes is an open-source container orchestration platform for deploying and managing containerized applications.

It automates scheduling, scaling, self-healing, and service discovery for containers.

A set of machines (nodes) running Kubernetes control plane and workloads.

A worker machine (VM or physical) where pods run.

Smallest deployable Kubernetes unit; one or more containers sharing network and storage namespace.

They are designed to be replaceable; higher-level controllers maintain desired state.

Controller managing stateless replicated pods with rolling updates/rollbacks.

Controller ensuring specified number of pod replicas are running.

Deployment manages ReplicaSets and rollout strategy; ReplicaSet only maintains replica count.

Controller for stateful apps needing stable identities and ordered deployment/scaling.

Ensures one (or selected) pod runs on each node.

Runs pods to completion for finite tasks.

Schedules Jobs at specified times (cron syntax).

Stable network abstraction exposing a set of pods.

Pods are ephemeral; Service provides stable endpoint and load balancing.

ClusterIP, NodePort, LoadBalancer, ExternalName.

Internal-only service reachable within cluster.

Exposes service on static port on each node.

Requests external load balancer from cloud/provider integration.

Maps service to external DNS name.

API object for HTTP(S) routing into cluster, typically via Ingress Controller.

No, it defines rules; controller implements behavior.

Component that watches Ingress resources and configures actual proxy/load balancer.

Logical cluster partition for resource organization and policy scope.

Multi-team isolation, naming boundaries, and policy/quota management.

Stores non-sensitive configuration as key-value data.

Stores sensitive data (base64-encoded; secure handling still required).

Purpose and handling: Secret intended for sensitive values with stricter controls.

Control plane API front door for all cluster operations.

Distributed key-value store holding cluster state/configuration.

Assigns unscheduled pods to nodes based on constraints/resources.

Runs controllers reconciling desired vs actual cluster state.

Node agent managing pods/containers on each node.

Implements service networking rules on nodes.

Declarative target configuration submitted to Kubernetes.

Controllers continuously adjust actual state toward desired state.

Define desired YAML state, let controllers enforce it.

Imperative runs commands directly; declarative applies manifests.

Creates/updates resources to match manifest desired state.

Lists resources.

Shows detailed resource state/events.

Fetches container logs from pod.

Runs command inside container.

Forwards local port to pod/service port temporarily.

Key-value metadata for organizing/selecting resources.

Query mechanism matching labels to target objects.

Services/controllers use them to select pods/resources.

Non-identifying metadata for tools/humans/controllers.

Rules controlling when kubelet pulls image (Always/IfNotPresent/Never).

Indicates pod ready to receive traffic.

Detects unhealthy container needing restart.

Gives slow-start apps time before liveness checks begin.

Enable self-healing and prevent routing traffic to broken pods.

Guaranteed minimum CPU/memory used for scheduling.

Maximum CPU/memory container may use.

Predictable scheduling, fairness, and node stability.

Container killed for exceeding memory limit.

Repeated container failures with backoff restarts.

No resource limits/probes on production workloads.

Using latest image tags in deployments.

Namespaces, least-privilege RBAC, non-root containers, trusted images.

Replicas, probes, rolling updates, and PodDisruptionBudgets.

Metrics, logs, events, and health dashboards.

Use Deployments with versioned immutable image tags.

Treat manifests as code and keep everything declarative/versioned.

Gradual replacement of old pods with new pods minimizing downtime.

Controls rollout pace and temporary extra pods.

Revert Deployment to previous ReplicaSet revision.

How many old ReplicaSets retained for rollback.

Horizontal Pod Autoscaler scales pod replicas based on metrics.

CPU/memory and custom/external metrics (with adapters).

Vertical Pod Autoscaler adjusts pod resource requests (with operational caveats).

HPA scales replica count; VPA scales per-pod resources.

Scales node pool size based on unschedulable pods/utilization.

Node marker repelling pods unless tolerated.

Pod rule allowing scheduling onto tainted nodes.

Simple pod constraint selecting nodes by label.

Advanced scheduling rules/preferences based on node labels.

Rules to co-locate or separate pods relative to other pods.

Improve high availability by spreading replicas across nodes/zones.

Evenly distributes pods across topology domains.

Limits voluntary disruptions to maintain availability.

Voluntary: drains/upgrades; involuntary: node crash/outage.

Controlled pod termination due to resource pressure/policies.

Pod quality-of-service tier (Guaranteed/Burstable/BestEffort) based on requests/limits.

Container run before app containers for setup tasks.

Helper container running alongside main app container in same pod.

Log shipping, proxying, cert refresh, metrics export.

Debug container injected into running pod for troubleshooting.

Container Network Interface plugin model for Kubernetes networking.

Container Storage Interface for pluggable storage drivers.

PersistentVolume: cluster storage resource.

PersistentVolumeClaim: user request for storage.

PVC binds to matching PV dynamically or statically.

Defines storage provisioner and parameters for dynamic provisioning.

How volume can be mounted (RWO, ROX, RWX, etc.).

Point-in-time storage copy (driver support required).

Service with no cluster IP, often used by StatefulSets for stable DNS.

Persistent pod names and stable network/storage identities.

DNS-based resolution via CoreDNS for services/pods (as configured).

Cluster DNS service resolving Kubernetes service names.

Rules controlling pod-to-pod/network traffic at L3/L4.

Typically allow-all (depends on CNI and policies).

Reduce lateral movement and enforce least-privilege connectivity.

Role-Based Access Control for Kubernetes API authorization.

Role is namespace-scoped; ClusterRole is cluster-scoped.

Binds roles to subjects at namespace vs cluster scope.

Identity for pods/processes to access Kubernetes API/resources.

May be overly broad for sensitive workloads.

Plugin intercepting API requests for validation/mutation/policy enforcement.

Mutating can change objects; validating accepts/rejects requests.

Policy-as-code tools enforcing governance/security constraints.

Package manager templating/deploying Kubernetes applications via charts.

Parameterized package of Kubernetes manifests.

Native manifest customization tool using overlays/patches.

Helm is templating/package ecosystem; Kustomize is overlay-based customization.

Managing cluster state from Git as single source of truth with reconciliation.

Auditability, reproducibility, safer rollbacks, drift detection.

GitOps controllers syncing cluster state from Git repos.

Manual kubectl edits in production bypassing Git history.

Pull requests + automated policy checks + GitOps sync.

Gradual traffic shift to new version with monitoring gates.

Parallel environments with controlled traffic cutover.

Cluster/pod metrics, logs, traces, events, and alerting.

Multi-zone spread, PDBs, autoscaling, and tested rollback playbooks.

Pod security standards, network policies, RBAC least privilege, image scanning.

Right-size resources, autoscale, and monitor idle overprovisioning.

Team can explain scheduling, rollout, and failure behavior end-to-end.

Events → describe → logs → metrics → network/storage/auth checks.

Engineer for failure: assume pods/nodes/networks will break regularly.

Running redundant control plane components to avoid single-point failure.

Majority of etcd members required for consistent writes/cluster health.

Optimizes quorum fault tolerance.

Network partitions causing inconsistent leadership/state views.

Mechanism protecting API responsiveness under heavy request load.

Customizing scheduling decisions with plugins/extenders.

Rebalances pods post-scheduling to improve placement over time.

Steering traffic to nearer endpoints for latency/cost improvements.

Dedicated data plane/control plane for service-to-service traffic policies/telemetry/security.

mTLS, retries, traffic shaping, detailed observability without app code changes.

Operational complexity and resource overhead.

Mutual TLS authenticating and encrypting pod/service communications.

Standardized workload identity framework for zero-trust environments.

Authenticate/authorize every workload connection regardless of network location.

Encrypting Kubernetes secrets in etcd using KMS/providers.

Base64 is encoding only; not cryptographic protection.

Sync secrets from vault/cloud secret manager into Kubernetes resources.

Securing source, build, image, registry, deploy, and runtime.

Admission-time verification of signed images before allowing deployment.

Artifact metadata used for vulnerability/compliance tracking.

Detect suspicious process/network/syscall behavior in running containers.

Low-overhead kernel observability/network/security instrumentation.

Soft/hard isolation strategies for teams/apps/customers in shared clusters.

Insufficient isolation for strong security/compliance requirements.

Separate clusters/node pools, strict policies, workload isolation.

Independent workload cells reducing blast radius.

Aligning replicas across zones/nodes/racks to tolerate localized failures.

Too strict blocks maintenance; too loose harms availability.

Coordinated pod termination during node shutdown events.

Defines pod scheduling/eviction priority under contention.

Higher-priority pods evict lower-priority pods when resources scarce.

Can destabilize lower-priority workloads if overused.

Allocating requested resources below physical capacity assumptions.

Better utilization vs higher contention/OOM risk.

Packing improves utilization; spreading improves resilience/perf isolation.

Coordinating HPA, VPA, and Cluster Autoscaler without oscillations.

Noisy metrics, aggressive thresholds, slow startup, conflicting policies.

Prevents premature restarts of slow-boot applications.

Ignoring IOPS/throughput/latency characteristics per workload profile.

Ordered rolling updates may require partitioned/canary updates for safety.

Custom controller managing domain-specific applications via CRDs.

CustomResourceDefinition extending Kubernetes API with new resource types.

Automate complex lifecycle tasks (backup, failover, scaling, upgrades).

Buggy reconciliation can cause large-scale unintended changes.

Canary/blue-green/analysis-driven rollout with automated promotion/rollback.

Operate workloads based on availability/latency/error objectives.

Defines acceptable unreliability and release pace tradeoffs.

Metrics (Prometheus), logs, traces, events, profiling, and topology views.

Events reveal scheduling, probe, image pull, and policy failures quickly.

Backup/restore etcd, manifests, secrets, PV snapshots, and tested runbooks.

Use multiple clusters for isolation, scale, DR, or regional presence.

Consistent policy, upgrades, and visibility across many clusters.

Treating cluster as VM replacement without platform engineering discipline.

Design workloads cloud-native: stateless where possible, resilient where stateful.

Kubernetes excellence is secure, observable, automated operations at scale.