Intermediate everything in Docker & Kubernetes, page 5
Kubernetes' Declarative Model: Desired vs. Actual State
The declarative model is like telling Kubernetes your destination, not giving it turn-by-turn directions. You define the desired state in a file, and Kubernetes works to make it a reality. This enables self-healing and GitOps.
Private Container Registry: Own Your Image Pipeline
A private container registry is your own personal Docker Hub, giving you full control over image storage and access. It's crucial for secure, in-house CI/CD pipelines.
Retry and Timeout Policies: Handling Network Flakes
Retries and timeouts are automated patience for network requests. Instead of failing on a glitch, a service waits (timeout) and tries again (retry). This is key for microservice resilience, but beware of "retry storms" that can amplify failures.
Service Mesh Authorization: A Bouncer for Your Microservices
A service mesh authorization policy is a bouncer for your microservices. It moves access control from your app to the mesh, checking service identity and request details like HTTP method and path. Use it for fine-grained, Zero Trust security.
Content-Based Routing: Directing Traffic by Request Details
Content-based routing is a smart traffic cop for your services. It inspects request headers or URIs to direct traffic, enabling canary releases or A/B tests. The footgun is rule order: a broad rule placed first can shadow specific rules below it.
Traffic Splitting: Route Live Traffic Between Service Versions
Traffic splitting directs percentages of live user traffic to different versions of a service. It's key for canary releases, letting you test new code on a small user group before a full rollout.
Mutual TLS (mTLS): When Services Need to Trust Each Other
mTLS is a two-way ID check for services. Both parties exchange certificates to prove their identity before communicating. Service meshes like Istio use it to secure traffic between microservices.
SPIFFE: Cryptographic Identity for Services
SPIFFE gives every service a cryptographic passport instead of a static secret. It's used in zero-trust networks for services to authenticate each other, like in a Kubernetes service mesh.
Kubernetes Finalizers: The 'Do Not Delete Yet' Lock
A finalizer is a pre-deletion lock. It tells Kubernetes to block an object's deletion until a controller cleans up external resources, like a cloud database or storage bucket.
Operator SDK: Build Kubernetes Operators Faster
The Operator SDK is a developer toolkit that scaffolds the boilerplate for building, testing, and packaging Kubernetes Operators. Use it to automate complex application lifecycle management, like deploying a database cluster that can self-heal and perform…
Configuration Drift: When Live State Betrays Git
Configuration drift is when your live system's state no longer matches its Git source of truth. GitOps tools like Argo CD detect this by constantly comparing live resources to Git, flagging any discrepancies.
Helm Templates: Turning Static YAML into Dynamic Manifests
Think of Helm templating as a mail merge for Kubernetes. It combines static YAML templates with dynamic values to generate manifests for different environments. Use it to manage configurations for dev, staging, and prod.
cAdvisor: A Task Manager for Containers
cAdvisor is like a task manager for your containers, giving you a live view of their resource usage. It's used to track performance, historical usage, and network stats for every container on a host.
Prometheus Exporters: Translating Metrics for Monitoring
A Prometheus Exporter is a translator, converting metrics from third-party systems like databases or hardware into the format Prometheus can scrape. Use one when you can't modify an app's code directly.
Prometheus Architecture: A Pull-Based Monitoring System
Prometheus is a monitoring system that actively pulls metrics from your services, rather than waiting for them to push data. It's the standard for tracking performance in dynamic environments like Kubernetes.
Kubernetes Cluster-Level Logging
Cluster-level logging treats logs as a stream, not as files on ephemeral pods. It centralizes logs from all nodes before they disappear when a pod dies, which is essential for debugging any production application.
Kubernetes Metrics Server: The Engine for Autoscaling
Metrics Server is the dedicated speedometer for your cluster's pods, feeding CPU and memory usage to Kubernetes's autoscalers. It powers the Horizontal and Vertical Pod Autoscalers and the kubectl top command. The footgun: it's *only* for autoscaling.
Kubernetes Admission Controllers: The API's Gatekeepers
Think of admission controllers as bouncers for your Kubernetes API. They intercept requests before objects are saved, enforcing custom policies like security rules or required labels. The footgun: a broken controller can block all changes to your cluster.
Pod Security Admission: Kubernetes' Built-in Guardrails
Think of Pod Security Admission (PSA) as a bouncer for your namespaces, enforcing security rules before pods can run. It applies security standards (Privileged, Baseline, Restricted) via simple labels.
Pod Security Standards: A Security Checklist for Pods
Pod Security Standards are a built-in security checklist for your pods. You apply a level (Restricted, Baseline, Privileged) to a namespace to prevent risky configurations like running as root.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles