Advanced everything in Docker & Kubernetes, page 4
Kubernetes Audit Logging: Your Cluster's Black Box Recorder
Kubernetes audit logging is the security camera for your API server, recording every API call to answer "who did what, and when?". It's essential for security forensics and compliance, but a common footgun is using a weak default or logging everything.
Kubernetes API Server Authorization Modules
Kubernetes API server authorization is like a chain of security guards. A request must get a "yes" from at least one configured module (like RBAC) to pass. This is fundamental to securing any cluster. The footgun is that the chain stops at the first "allow."
K8s Authentication: Proving Who You Are to the API Server
The K8s API Server is a vault door; authentication is proving your identity to the guard. It tries a chain of methods—like OIDC for users or tokens for pods—until one succeeds. The footgun: unauthenticated requests become system:anonymous, a major risk.
Kubernetes Scheduler Framework: A Plugin System for Pod Placement
The Kubernetes Scheduler Framework is a plugin pipeline for pod placement. Use it to add custom logic—like co-scheduling ML jobs or avoiding specific nodes—without forking Kubernetes. The footgun: a slow plugin can bottleneck your entire cluster's scheduling.
Kubernetes CPU Management: Static vs. None Policy
K8s CPU policies control if your pod gets a dedicated CPU core or just a time-slice of a shared one. The default none policy maximizes utilization, while static gives exclusive cores to latency-sensitive apps.
Pod Priority: Deciding Who Gets Evicted in Kubernetes
Pod Priority is a VIP pass for your critical workloads, telling the scheduler which pods can bump others off a node. This ensures system-critical services run even on a full cluster. The footgun: high-priority pods can cause cascading evictions if not planned.
Kubernetes Volume Snapshots: A Save Point for Data
A Volume Snapshot is a point-in-time copy of your persistent data in Kubernetes, like a game save. Use it to back up a database before an upgrade or clone a prod environment. The footgun: it's not a true backup; a storage failure can lose both.
Container Storage Interface (CSI): The Universal Adapter for K8s Storage
CSI is a universal adapter for storage in Kubernetes, letting any storage system speak a common language. This allows providers to create plugins for their systems without touching core Kubernetes code.
Sealed Secrets: Safely Commit K8s Secrets to Git
Sealed Secrets lets you commit encrypted Kubernetes secrets to a public Git repo. In a GitOps workflow, this allows all configuration to live in version control. The footgun: a SealedSecret is a one-way street; only the target cluster can decrypt it.
External Secrets Operator: Sync Secrets into Kubernetes
Treat your cloud's secret manager as the source of truth. The External Secrets Operator (ESO) fetches secrets from external APIs like AWS Secrets Manager or Vault and injects them into native Kubernetes Secrets, keeping them in sync.
kube-proxy: The Plumber for Kubernetes Services
kube-proxy is the network plumber on each node, making Kubernetes Services work. It translates a Service's virtual IP into routes to real pods using iptables or IPVS. The name is a footgun: it's a Layer 4 packet forwarder, not a Layer 7 application proxy.
Kubernetes NetworkPolicy: A Firewall for Pods
NetworkPolicy is a firewall for pods, locking down traffic in a cluster where everything can talk to everything by default. Use it to isolate services, like preventing a web frontend from directly accessing a database.
Pod Affinity: Grouping or Separating Your Pods
Pod affinity tells Kubernetes to place pods together for performance or apart for high availability. Use it to co-locate a web server and cache for low latency, or spread database replicas across nodes to prevent a single point of failure.
Pod Disruption Budgets: Stop Upgrades From Killing Your App
A Pod Disruption Budget (PDB) is a contract with Kubernetes to maintain minimum availability. It limits how many pods can be voluntarily terminated at once during node drains or cluster upgrades, preventing self-inflicted outages.
kube-controller-manager: The Cluster's Reconciliation Engine
The kube-controller-manager is Kubernetes' reconciliation engine, running multiple control loops to make the cluster's actual state match your desired state. It handles tasks like ensuring a Deployment has the correct pod count.
kube-scheduler: The Cluster's Matchmaker
The kube-scheduler is your cluster's matchmaker, assigning new Pods to the best possible Node based on their needs. This is the default workload placement engine. The footgun is thinking it runs Pods; it only *assigns* them to a Node.
Kubernetes Controllers: The Reconciliation Loop
A Kubernetes controller acts like a thermostat for your cluster, constantly working to make the actual state match your desired state. It's the engine behind Deployments and ReplicaSets, ensuring the right number of pods are always running.
Container Image Signing: Verifying What You Run
Think of image signing as a digital "tamper-evident seal" on your containers. It proves who built an image and that it hasn't been altered. This is crucial for production systems to prevent running malicious code.
Harbor: A Private, Secure Artifact Registry
Think of Harbor as a private Docker Hub with built-in security. Use it to scan images for vulnerabilities, enforce role-based access control, and sign artifacts before deploying to Kubernetes.
OCI Image Manifest: The Recipe for a Container Image
An OCI Image Manifest is the recipe for a single container image, listing its configuration and filesystem layers for one specific architecture. It's what a runtime uses to assemble an image like ubuntu:22.04 on your linux/amd64 machine.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles