More in Docker & Kubernetes — page 13
Kubernetes Probes: Liveness, Readiness, and Startup
Kubernetes probes ask your app about its health. Liveness asks 'are you alive?' (restart if not), readiness asks 'can you take work?' (pause traffic if not), and startup protects slow-starting apps. This is key for self-healing and zero-downtime deployments.
Imperative kubectl: Directly Command Your Cluster
Imperative `kubectl` is like giving direct orders to your cluster: 'run this,' 'scale that.' It's great for quick, one-off tasks like debugging a pod or handling an incident.
Recreate Deployment: Downtime for a Clean Slate
The Recreate strategy is like flipping a switch: it shuts down all old pods before starting new ones. This guarantees downtime but is necessary for breaking changes, like a database migration. The footgun is a failed deployment leaves you with no running app.
Kubernetes Jobs: For Tasks That Need to Finish
A Kubernetes Job runs a task to completion, unlike a Deployment which runs forever. Use it for one-off operations like database migrations or batch processing. The footgun is forgetting to set a retry limit, causing failed jobs to loop indefinitely.
Kubernetes Requests and Limits: Your Pod's Resource Contract
Kubernetes Requests and Limits are your pod's resource contract: `requests` guarantee a minimum for scheduling, while `limits` enforce a maximum at runtime. This prevents one greedy app from crashing others.
ReplicaSet: Kubernetes' Pod Thermostat
A ReplicaSet is Kubernetes' thermostat for pods, ensuring a specific number of replicas are always running. It replaces crashed pods or removes excess ones to maintain a stable state.
kube-controller-manager: The Cluster's Reconciliation Engine
The kube-controller-manager is Kubernetes' reconciliation engine, running multiple control loops to make the cluster's actual state match your desired state. It handles tasks like ensuring a Deployment has the correct pod count.
kube-scheduler: The Cluster's Matchmaker
The kube-scheduler is your cluster's matchmaker, assigning new Pods to the best possible Node based on their needs. This is the default workload placement engine. The footgun is thinking it runs Pods; it only *assigns* them to a Node.
Kubernetes Controllers: The Reconciliation Loop
A Kubernetes controller acts like a thermostat for your cluster, constantly working to make the actual state match your desired state. It's the engine behind Deployments and ReplicaSets, ensuring the right number of pods are always running.
Kubelet: The Node Agent of Kubernetes
The kubelet is the primary agent on each Kubernetes node, ensuring containers described in PodSpecs are running and healthy. It watches the API server for work and reports status back. The footgun is trying to manage it directly; always use the API server.
etcd: Kubernetes's Single Source of Truth
etcd is the distributed key-value store that acts as the brain for a Kubernetes cluster, storing its entire configuration and state. The API server uses it to persist all objects, from Pods to Secrets.
Labels and Selectors: The Glue of Kubernetes
Labels are key-value tags for organizing Kubernetes objects; selectors are queries to find them. This is how a Service finds its Pods. The main footgun is a mismatched selector, which orphans Pods from the Deployment that created them.
Kubernetes Pods: The Atomic Unit of Deployment
A Pod is the smallest deployable unit in Kubernetes, a wrapper for one or more containers that run together on one machine. It's used for tightly coupled 'sidecar' helpers, like a log shipper.
Container Image Signing: Verifying What You Run
Think of image signing as a digital "tamper-evident seal" on your containers. It proves who built an image and that it hasn't been altered. This is crucial for production systems to prevent running malicious code.
Harbor: A Private, Secure Artifact Registry
Think of Harbor as a private Docker Hub with built-in security. Use it to scan images for vulnerabilities, enforce role-based access control, and sign artifacts before deploying to Kubernetes.
OCI Image Manifest: The Recipe for a Container Image
An OCI Image Manifest is the recipe for a single container image, listing its configuration and filesystem layers for one specific architecture. It's what a runtime uses to assemble an image like `ubuntu:22.04` on your `linux/amd64` machine.
Docker Registry Mirror: A Local Cache for Faster Pulls
A registry mirror is like a CDN for Docker images, caching public images on your local network to speed up pulls and avoid rate limits. Use it in CI/CD pipelines to reduce build times. The footgun: you can't `docker push` to a mirror; it's a.
Image Digest: The Immutable Image Identifier
An image digest is a unique fingerprint for a container image, guaranteeing you get the exact version you expect. Use it in production to pin an image, preventing unexpected updates from mutable tags like `:latest`. The footgun is assuming a tag is immutable.
Artifact Registry: Google's Universal Package Manager
Artifact Registry is a private, universal package manager for all your software components, not just Docker images. Use it to store your company's Docker images, Java JARs, and Helm charts in one place, integrated with GCP CI/CD.
Amazon EC2: Rentable Virtual Servers on AWS
Amazon EC2 is like renting virtual computers, letting you run applications without buying physical hardware. It's used for scalable deployments where you can launch and terminate servers as needed, paying only for what you use.