Intermediate everything in DevOps & Cloud, page 20
Prometheus Exporters: Translating Metrics for Monitoring
A Prometheus Exporter is a translator, converting metrics from third-party systems like databases or hardware into the format Prometheus can scrape. Use one when you can't modify an app's code directly.
Prometheus Architecture: A Pull-Based Monitoring System
Prometheus is a monitoring system that actively pulls metrics from your services, rather than waiting for them to push data. It's the standard for tracking performance in dynamic environments like Kubernetes.
Kubernetes Cluster-Level Logging
Cluster-level logging treats logs as a stream, not as files on ephemeral pods. It centralizes logs from all nodes before they disappear when a pod dies, which is essential for debugging any production application.
Kubernetes Metrics Server: The Engine for Autoscaling
Metrics Server is the dedicated speedometer for your cluster's pods, feeding CPU and memory usage to Kubernetes's autoscalers. It powers the Horizontal and Vertical Pod Autoscalers and the kubectl top command. The footgun: it's *only* for autoscaling.
Kubernetes Admission Controllers: The API's Gatekeepers
Think of admission controllers as bouncers for your Kubernetes API. They intercept requests before objects are saved, enforcing custom policies like security rules or required labels. The footgun: a broken controller can block all changes to your cluster.
Pod Security Admission: Kubernetes' Built-in Guardrails
Think of Pod Security Admission (PSA) as a bouncer for your namespaces, enforcing security rules before pods can run. It applies security standards (Privileged, Baseline, Restricted) via simple labels.
Pod Security Standards: A Security Checklist for Pods
Pod Security Standards are a built-in security checklist for your pods. You apply a level (Restricted, Baseline, Privileged) to a namespace to prevent risky configurations like running as root.
Pod Security Context: Set Security Rules for Pods
A Pod Security Context defines security settings for all containers in a Pod, like setting permissions for a user group before adding users. Use it to enforce non-root execution or manage shared volume permissions.
Kubernetes LimitRange: Setting Guardrails for Pod Resources
LimitRange acts like a bouncer for Pod resources, setting min/max CPU and memory rules for each Pod in a namespace. It's used to prevent resource hogging and apply sensible defaults.
Node Affinity: Tell Your Pods Where to Go
Node affinity is like giving pods a 'preferred seating' list for nodes. You guide the scheduler to nodes with specific labels, like those with GPUs or in a certain zone. The footgun is confusing 'required' (a hard rule) with 'preferred' (a suggestion).
Kubernetes Taints and Tolerations: Repelling Pods
Taints act like 'No Trespassing' signs on Kubernetes nodes, repelling pods. Tolerations are the keys that let specific pods ignore those signs. Use this to reserve nodes for special hardware or critical workloads, preventing general pods from landing there.
Dynamic Volume Provisioning: Storage on Demand
Dynamic Volume Provisioning lets you request storage by its type (e.g., "fast-ssd") instead of pre-provisioning a disk. Kubernetes automatically creates a matching volume. This is standard for stateful apps.
Kubernetes StorageClass: A Menu for Your Data
A StorageClass is an admin-defined 'menu' of storage options, abstracting the provider. Developers request storage by name (e.g., 'fast-ssd') via a PersistentVolumeClaim, and Kubernetes dynamically provisions it.
Kubernetes ServiceAccounts: Identity for Pods
A ServiceAccount is an ID badge for a Pod, letting it securely talk to the Kubernetes API. It's used when your app needs to list other Pods or read Secrets.
Kustomize: Template-Free Kubernetes Configuration
Kustomize is a patch tool for Kubernetes YAML, letting you manage environment-specific configurations without complex templates. Use it to define a base config and apply overlays for dev, staging, and prod. The footgun is treating it like a templating engine.
Immutable Secrets & ConfigMaps: Write-Once Configuration
Treat your Kubernetes configuration like a container image: create it once, then create a new version to update it. The immutable flag enforces this "write-once" pattern for Secrets and ConfigMaps, reducing API server load and preventing accidental updates.
The Kubernetes Downward API: Pod Self-Awareness
The Downward API gives a container self-awareness, injecting Pod metadata like its name or IP address as environment variables or files. Use it so apps can self-configure without calling the main K8s API.
Projected Volumes: Mount Config as Live Files
A projected volume mounts ConfigMaps and Secrets as files inside your Pod, which update automatically when the source object changes. Use this for apps that can hot-reload config, avoiding restarts. The footgun: updates aren't instant; there's a delay.
Kubernetes LoadBalancer: Your App's Public Entry Point
A Kubernetes LoadBalancer Service automatically provisions a cloud provider's load balancer to expose your app externally. It's the simplest way to get a public IP, but creating one per service is expensive and inflexible. Use an Ingress for more control.
Ingress Controller: Your Cluster's Smart Reverse Proxy
An Ingress Controller is the traffic cop for your Kubernetes cluster, directing external HTTP/S requests to the correct internal services. It exposes multiple services under a single IP, handling host and path routing.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles