Easy concepts in Docker & Kubernetes, page 2
Kubernetes DNS: How Pods Find Each Other
Kubernetes DNS gives services and pods stable, human-readable names so you don't have to track ephemeral IP addresses. It's how a frontend pod finds a backend service.
ConfigMap decouples config from container images
A ConfigMap is a key-value store that injects configuration into pods without rebuilding the image. Use it for feature flags, database hostnames, or any non-secret settings. Editing one does not restart existing pods, so stale config is the common footgun.
Kubernetes Secrets: Managing Sensitive Data in Pods
A Kubernetes Secret is a dedicated object for storing sensitive data like API keys, separating them from your application code. It's used to inject database credentials or TLS certificates into pods.
Kubernetes: Inject ConfigMaps & Secrets as Env Vars
Injecting ConfigMaps and Secrets as environment variables decouples your app from its configuration. Kubernetes passes these key-value pairs into your container at startup, perfect for things like API keys or feature flags.
PersistentVolumeClaim: How Pods Request Storage
A PersistentVolumeClaim (PVC) is a request for storage, like a claim check for a storage locker. Pods use it to mount durable storage for databases or file uploads. The footgun: a PVC is just a request; a matching PersistentVolume must exist to fulfill it.
Kubernetes RBAC: Roles vs. ClusterRoles
Think of Kubernetes RBAC Roles as permissions for a single room (a Namespace), while ClusterRoles grant access to the entire building (the cluster). Use Roles for namespaced apps and ClusterRoles for admin tasks.
The Three Pillars of Observability
Observability isn't one tool; it's a three-legged stool of metrics, logs, and traces. Metrics give the 'what' (CPU is high), logs the 'why' (an error loop), and traces the 'where' (which service is slow). The footgun is treating them as separate silos.
Kubernetes Events: The Cluster's Short-Term Memory
Think of Kubernetes Events as a cluster's temporary log, recording state changes like a Pod starting or a container failing. Use them with kubectl describe to debug issues in real-time.
GitOps Principles: Your Repo as the Source of Truth
GitOps treats infrastructure state like code, with your Git repo as the single source of truth. Automated agents pull declarative configs from the repo to reconcile the live system, making it ideal for Kubernetes.
Helm: The Package Manager for Kubernetes
Helm is like apt or Homebrew for Kubernetes. It bundles all your app's YAML files into a single manageable package called a Chart, solving "YAML sprawl." Use it to install complex apps with one command or to package your own for repeatable deployments.
Helm Repository: Your Private App Store for Kubernetes
A Helm repository is a private app store for your Kubernetes applications. It's just an HTTP server with a catalog file (index.yaml) pointing to your packaged charts. Use it to share reusable app templates across teams without using public registries.
Custom Resource Definitions (CRDs): Teach Kubernetes New Tricks
CRDs let you define your own resource types, teaching Kubernetes new nouns like Database or Backup. This is how operators manage complex apps declaratively. The footgun is that a CRD only defines the API; you still need a controller to act on the objects.
The Operator Pattern: A Robot SRE for Your App
The Operator pattern adds a custom, automated "robot SRE" to your Kubernetes cluster. It encodes human operational knowledge for a specific application, like a database, into software that handles complex tasks like upgrades, backups, and failovers…
kubectl Treats Custom Resources Like Native Ones
kubectl interacts with Custom Resources (CRs) using the same commands you know for built-in types like Pods. Once a CRD is installed, you can kubectl get, describe, and delete its objects.
Control Plane vs. Data Plane: The Brain and the Brawn
Think of a system as having a brain and a body. The Control Plane is the brain, making decisions and setting rules. The Data Plane is the body, executing those rules on actual data or traffic, like in a service mesh's network of proxies.
The Sidecar Pattern: Your App's Helper Container
The Sidecar pattern attaches a helper container to your main application, like a sidecar on a motorcycle. It handles peripheral tasks like logging or networking, letting you add features without changing the app's code.
Service Mesh Ingress: The Doorkeeper for Your Mesh
A Service Mesh Ingress Gateway is the dedicated entry point for external traffic into your mesh. It lets you apply advanced routing, security, and observability policies at the boundary, like TLS termination or traffic splitting.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles