Kubernetes
293 bites tagged Kubernetes — interview questions with model answers, and 60-second explainers.
kube-controller-manager: The Cluster's Reconciliation Engine
The kube-controller-manager is Kubernetes' reconciliation engine, running multiple control loops to make the cluster's actual state match your desired state. It handles tasks like ensuring a Deployment has the correct pod count.
kube-scheduler: The Cluster's Matchmaker
The kube-scheduler is your cluster's matchmaker, assigning new Pods to the best possible Node based on their needs. This is the default workload placement engine. The footgun is thinking it runs Pods; it only *assigns* them to a Node.
Kubernetes Controllers: The Reconciliation Loop
A Kubernetes controller acts like a thermostat for your cluster, constantly working to make the actual state match your desired state. It's the engine behind Deployments and ReplicaSets, ensuring the right number of pods are always running.
Kubelet: The Node Agent of Kubernetes
The kubelet is the primary agent on each Kubernetes node, ensuring containers described in PodSpecs are running and healthy. It watches the API server for work and reports status back. The footgun is trying to manage it directly; always use the API server.
etcd: Kubernetes's Single Source of Truth
etcd is the distributed key-value store that acts as the brain for a Kubernetes cluster, storing its entire configuration and state. The API server uses it to persist all objects, from Pods to Secrets.
Labels and Selectors: The Glue of Kubernetes
Labels are key-value tags for organizing Kubernetes objects; selectors are queries to find them. This is how a Service finds its Pods. The main footgun is a mismatched selector, which orphans Pods from the Deployment that created them.
Kubernetes Pods: The Atomic Unit of Deployment
A Pod is the smallest deployable unit in Kubernetes, a wrapper for one or more containers that run together on one machine. It's used for tightly coupled 'sidecar' helpers, like a log shipper.
Container Image Signing: Verifying What You Run
Think of image signing as a digital "tamper-evident seal" on your containers. It proves who built an image and that it hasn't been altered. This is crucial for production systems to prevent running malicious code.
Harbor: A Private, Secure Artifact Registry
Think of Harbor as a private Docker Hub with built-in security. Use it to scan images for vulnerabilities, enforce role-based access control, and sign artifacts before deploying to Kubernetes.
OCI Image Manifest: The Recipe for a Container Image
An OCI Image Manifest is the recipe for a single container image, listing its configuration and filesystem layers for one specific architecture. It's what a runtime uses to assemble an image like `ubuntu:22.04` on your `linux/amd64` machine.
Image Digest: The Immutable Image Identifier
An image digest is a unique fingerprint for a container image, guaranteeing you get the exact version you expect. Use it in production to pin an image, preventing unexpected updates from mutable tags like `:latest`. The footgun is assuming a tag is immutable.
Artifact Registry: Google's Universal Package Manager
Artifact Registry is a private, universal package manager for all your software components, not just Docker images. Use it to store your company's Docker images, Java JARs, and Helm charts in one place, integrated with GCP CI/CD.
Container Lifecycle: From Create to Remove
A container is a state machine: created, running, paused, stopped, and removed. You manage this with commands like `docker run`, while orchestrators automate it. The footgun: `stop` doesn't delete a container; you must `rm` it to free up disk space.
Container Runtime Shim: Decoupling the Container Lifecycle
A runtime shim is a small process that decouples the container daemon (like containerd) from the container itself. This lets the daemon restart without killing running containers.
OCI Runtime Spec: The 'How to Run' Standard for Containers
The OCI Runtime Spec is the universal instruction manual for executing a container. It defines a standard `config.json` and lifecycle actions, ensuring a container runs the same way across different runtimes like `runc` or `crun`.
Container Runtime: The Engine That Runs Your Containers
A container runtime is the low-level engine that executes containers. Kubernetes uses a runtime like containerd or CRI-O on each node to pull images and manage container lifecycles.
Linux cgroups: Resource Fences for Processes
Cgroups are resource fences for processes, letting the Linux kernel enforce CPU and memory limits. Container runtimes use them to isolate containers, which is how Kubernetes enforces Pod resource limits.
Linux Namespaces: A Virtual Slice of the OS
Linux namespaces give a process a virtualized slice of OS resources, like its own process tree or network stack. This is the core magic behind containers, providing the illusion of a separate machine without the overhead of a full virtual machine.
The Sidecar Pattern: Offload and Isolate Application Logic
The Sidecar Pattern attaches a helper container to your main application, like a sidecar on a motorcycle. It offloads tasks like logging or proxying, letting you add features without changing the main app's code. The footgun is over-engineering a solution.
What is Cloud Native Architecture?
Cloud Native refers to a collection of practices and open-source projects, like Kubernetes, governed by the CNCF. It's used by enterprises to build modern products and services.
Horizontal Pod Autoscaler (HPA): Scale on Demand
A Horizontal Pod Autoscaler (HPA) is a thermostat for your app's capacity, adding or removing pods based on load. It's used to handle traffic spikes by watching metrics like CPU, but a common footgun is setting aggressive thresholds that cause flapping.
Managed Kubernetes: Your Cloud's K8s Control Plane
A managed Kubernetes service (EKS, AKS, GKE) runs the complex K8s control plane for you, letting you focus on deploying apps, not managing infrastructure. Use it to run containers without the overhead of maintaining masters.
Kubernetes StatefulSet: Pods with Stable Identity
A StatefulSet gives Kubernetes pods a stable identity and dedicated storage, like assigning a permanent desk and locker to an employee. Use it for databases or clustered apps where nodes need to find each other and retain data across restarts.
Kubernetes Node: The Cluster's Worker Machine
A Kubernetes Node is a worker machine that runs your applications. Think of it as an employee receiving tasks (Pods) from the control plane manager. The common footgun is confusing the Node with the Pod; a Node is the server, while a Pod is the.
Get Kubernetes bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.