More in DevOps & Cloud — page 21
CRDs and the Operator pattern
WHAT IT TESTS: extending Kubernetes declaratively. OUTLINE: CRDs add new API object types, an Operator pairs a CRD with a controller that runs a reconciliation loop encoding domain operational knowledge.
Scheduler filtering and scoring phases
WHAT IT TESTS: how Pods get placed on Nodes. OUTLINE: filtering eliminates infeasible Nodes via resources, taints, and affinity, then scoring ranks the survivors to pick the best, after which the Pod is bound.
Deployment versus StatefulSet
WHAT IT TESTS: choosing the right workload controller. OUTLINE: Deployments suit interchangeable stateless replicas, StatefulSets give stable identities, ordered rollout, and per-Pod persistent storage for stateful systems.
The Kubernetes reconciliation loop
WHAT IT TESTS: the declarative control loop pattern. OUTLINE: a controller continuously observes actual state, compares to desired state in the spec, and acts to close the gap, level-triggered not edge-triggered.
etcd as the cluster source of truth
WHAT IT TESTS: understanding the cluster state store. OUTLINE: etcd is the consistent key-value store holding all cluster state, accessed only via the apiserver, and uses Raft needing a quorum.
What happens after kubectl apply
WHAT IT TESTS: the request-to-running flow across components. OUTLINE: apiserver validates and persists to etcd, scheduler binds the Pod to a Node, kubelet pulls the image and starts the container via the runtime, status flows back.
Minimal objects to expose a stateless app
WHAT IT TESTS: mapping requirements to core objects. OUTLINE: a Deployment to run and self-heal replicas plus a Service to give a stable endpoint, exposed externally via type LoadBalancer or NodePort, or an Ingress.
Core control plane components
WHAT IT TESTS: knowledge of cluster brain components. OUTLINE: api-server as the front door, etcd as state store, scheduler placing pods, and controller-manager running reconciliation loops, plus cloud-controller-manager.
Node, Pod, and Container relationship
WHAT IT TESTS: the core scheduling unit hierarchy. OUTLINE: a Node is a machine, a Pod is the smallest deployable unit wrapping one or more containers that share network and storage, and the Pod abstraction enables co-location and lifecycle management.
Reducing cross-region image pull costs
WHAT IT TESTS: registry topology for multi-region pulls. OUTLINE: a per-region pull-through cache or geo-replicated registry serves pulls locally, cutting latency and egress, traded against consistency lag, storage cost, and cache management.
Vulnerability scanning as a deploy gate
WHAT IT TESTS: shift-left image security in CI/CD. OUTLINE: scan with Trivy or Clair, fail the build on high or critical severity above threshold, and enforce again at admission with signing and registry policies.
Manifest lists and multi-arch images
WHAT IT TESTS: how one tag serves multiple architectures. OUTLINE: a manifest list maps platform descriptors to per-arch image manifests, the client picks by os and architecture, and pulls only that variant.
Three techniques to shrink a Docker image
WHAT IT TESTS: practical image-size reduction with trade-offs. OUTLINE: multi-stage builds to drop build tooling, smaller base images like slim or distroless, and fewer or cleaner layers plus dockerignore.
Debugging ImagePullBackOff on a private registry
WHAT IT TESTS: registry auth and systematic debugging. OUTLINE: imagePullSecrets reference a dockerconfigjson Secret on the pod or service account, kubelet uses it to authenticate, and you inspect events to isolate auth versus name versus network errors.
Why :latest is a production anti-pattern
WHAT IT TESTS: deployment determinism and reproducibility. OUTLINE: latest is mutable so pods run different code, rollbacks and pull policy break, and you should use immutable version tags or digests.
Tag and push an image to a private registry
WHAT IT TESTS: tag-and-push workflow plus registry auth. OUTLINE: authenticate with docker login, retag the image to include the registry host and repo path, then docker push that full reference.
Docker Compose profiles for optional services
WHAT IT TESTS: gating optional services in one Compose file. OUTLINE: profiles tag services so they stay off by default, activate via --profile or COMPOSE_PROFILES, and unprofiled services always run.
Optimizing Dockerfile layer caching
WHAT IT TESTS: how layer caching invalidation works. OUTLINE: order instructions least-to-most volatile, copy dependency manifests and install before copying source, and understand any changed layer busts all later layers.
Structuring Compose files across environments
WHAT IT TESTS: Compose override and merge mechanics. OUTLINE: a base compose.yaml plus override files, the default override auto-merge, and explicit -f flags or extends per environment.
GitHub Copilot tunes context windows and routing
GitHub Copilot is improving how it handles context windows and routes requests between models. Better token efficiency and smarter routing mean faster, more relevant code suggestions for developers using the tool daily.