Technology handbook
Kubernetes
Workloads, services, configuration, storage, scheduling, security and day-two operations.
- Topics
- 24
- Sections
- 4
Core objects
Pods
Understand the smallest deployable unit and why you rarely create one directly.
- A pod is the smallest deployable unit and shares a network namespace between its containers.
- Creating one directly leaves nothing to recreate it when its node disappears.
- Containers in a pod are co-scheduled, which is why a sidecar can reach localhost.
Deployments
Declare a replica count and a template, and let the controller maintain it.
- A replica count and a template are declared, and a controller keeps them true.
- Changing the template starts a rollout rather than editing running pods.
- Revision history is what makes returning to the previous template possible.
ReplicaSets
Recognize the object a deployment manages on your behalf during rollouts.
- A deployment manages replica sets on your behalf during a rollout.
- Two exist at once mid-rollout, which is why pod counts look wrong briefly.
- Editing one directly is undone by the deployment that owns it.
StatefulSets
Run workloads that need stable identity and ordered startup.
- Workloads that need stable identity and ordered startup use this instead.
- Each pod keeps its name and its volume across a reschedule.
- Scaling down removes the highest ordinal first, which is rarely the one you meant.
DaemonSets
Run one pod per node for agents and collectors.
- One pod runs per node, which is what agents and collectors need.
- New nodes get the pod automatically as they join.
- It scales with the cluster, so its resource requests are multiplied by node count.
Jobs and CronJobs
Run work that finishes, on demand or on a schedule.
- Work that finishes is run once or on a schedule rather than kept alive.
- A job tracks completions and retries, which a deployment does not.
- Overlapping schedules run concurrently unless the concurrency policy forbids it.
Networking & configuration
Services
Give a changing set of pods one stable address.
- A changing set of pods is given one stable address.
- Selection is by label, so membership follows the label rather than the pod name.
- A service with no matching endpoints resolves and then refuses the connection.
Service types
Choose ClusterIP, NodePort or LoadBalancer for how traffic arrives.
- ClusterIP, NodePort and LoadBalancer differ in how traffic reaches the service.
- ClusterIP is internal only, which is what most services should be.
- Every LoadBalancer is usually a separate provisioned address and its own cost.
Ingress
Route external HTTP traffic to services by host and path.
- External HTTP traffic is routed to services by host and path.
- One entry point serves many services rather than one address each.
- Ingress does nothing without a controller actually running in the cluster.
ConfigMaps
Supply non-secret configuration as environment variables or files.
- Non-secret configuration is supplied as environment variables or mounted files.
- A mounted file can update in place; an environment variable cannot.
- Changing one does not restart the pods that already read it.
Secrets
Hold sensitive values with restricted access and encryption at rest.
- Sensitive values are held with restricted access and encryption at rest.
- They are base64-encoded rather than encrypted in the manifest itself.
- Anyone able to create a pod in the namespace can usually read them.
Network policies
Restrict which pods may talk to which, instead of a flat network.
- Which pods may talk to which is restricted instead of leaving the network flat.
- Without any policy every pod can reach every other pod.
- The first policy selecting a pod switches it to deny by default.
Scheduling & resources
Requests and limits
Reserve CPU and memory, and cap what a container may consume.
- CPU and memory are reserved, and a ceiling is set on what a container may use.
- The request is what scheduling uses; the limit is what enforcement uses.
- Exceeding a memory limit kills the container; exceeding CPU only throttles it.
Quality of service
Understand which pods are evicted first when a node is pressured.
- The class a pod falls into decides how early it is evicted under pressure.
- Equal requests and limits is what earns the most protected class.
- A pod with no requests at all is the first one evicted.
Node selectors and affinity
Place pods on suitable nodes deliberately.
- Pods are placed on suitable nodes deliberately rather than wherever they fit.
- Affinity expresses preference; a selector expresses a hard requirement.
- A requirement no node satisfies leaves the pod pending indefinitely.
Taints and tolerations
Reserve nodes for workloads that explicitly accept them.
- A node is reserved for workloads that explicitly accept its taint.
- A taint repels pods; a toleration only permits, it does not attract.
- Tolerating a taint without affinity does not place the pod on that node.
Horizontal autoscaling
Scale replicas on a metric rather than by hand.
- Replicas scale on a metric rather than being set by hand.
- Scaling on CPU needs requests set, or there is no ratio to measure.
- Scaling reacts after load arrives, so a spike is served by the old count.
Pod disruption budgets
Keep a minimum available during voluntary disruption.
- A minimum stays available through voluntary disruption such as a node drain.
- It constrains drains and upgrades, not crashes or node failure.
- A budget that cannot be satisfied blocks the drain indefinitely.
Health, storage & security
Readiness probes
Remove a pod from service while it cannot serve traffic.
- A pod is removed from service while it cannot serve traffic.
- Failing readiness stops traffic without restarting the container.
- A rollout waits on readiness, so a wrong probe stalls the deploy.
Liveness and startup probes
Restart a genuinely stuck container without punishing a slow start.
- A genuinely stuck container is restarted without punishing a slow start.
- A liveness probe used as a readiness check turns slowness into a restart loop.
- The startup probe is what buys a slow boot time the others will not.
Rolling updates and rollback
Ship gradually and return to the previous revision quickly.
- Change ships gradually and the previous revision is one command away.
- Surge and unavailable settings decide how much capacity the rollout risks.
- A rollout that never becomes ready holds both revisions in place.
Persistent volumes and claims
Attach durable storage and understand reclaim behaviour.
- Durable storage is attached through a claim rather than to a pod directly.
- The reclaim policy decides whether the data outlives the claim.
- A volume bound to one zone pins every pod using it to that zone.
RBAC
Grant the least privilege a workload or operator actually needs.
- A workload or operator is granted the least privilege it actually needs.
- Roles are namespaced; cluster roles are not, which is the usual over-grant.
- A wildcard verb on a wildcard resource is administrative access by another name.
Security context
Drop capabilities, avoid root and enforce a read-only filesystem.
- Capabilities are dropped, root is avoided and the filesystem is made read-only.
- Running as root in a container is root on the node if anything escapes.
- A read-only filesystem needs writable volumes declared for the paths that need them.
Sources
- Kubernetes official documentation