Kubernetes

The minimum syntax you need to read manifests.

What k8s does for you when a node goes down or traffic spikes.

Who talks to whom in the cluster. A large diagram and short descriptions of each component.

What a Pod manifest consists of, what phases it goes through, and two ways to create one.

How to override how a container starts, and what the cluster does after it finishes.

How to get a ready manifest skeleton with one command and find the field you need without internet access.

The set of commands that create resources without YAML, and when each one fits.

What you can change on a live Pod, what you can't, and how to work around the limit.

How a cluster is split into areas, which resources fall outside them, and the rules kubectl uses to pick a namespace.

The labels cluster objects use to find each other, and how to filter them with -l.

Tricks that save minutes in the terminal: a short alias, variables for flags, and vim set up for YAML.

The three families of local clusters, a straight-talking table of versions and licenses, and what to pick on macOS, Windows, and Linux.

How to install the right kubectl version, where the connection config lives, and how to avoid running a training command against prod.

How kind brings up Kubernetes inside Docker, how to go multi-node, expose ports to the outside, and get a working Ingress.

The fastest local cluster you can get, what comes bundled with k3s out of the box, and why it's worth watching the project's release pace.

How minikube differs from kind and k3d, which Kubernetes version it actually gives you, and why ports deserve their own section here.

Docker Desktop, Rancher Desktop, OrbStack, colima, and Podman Desktop: which cluster is inside, and where they stand on ports and licensing.

metrics-server for kubectl top, the status of the archived ingress-nginx, Gateway API, and StorageClass.

A cluster on your own server or VPS: what to install, which ports to open, and why kubeadm is worth touching only to understand the control plane.

The controller that restores the right number of Pod copies on its own, and why it's almost never written by hand.

How Deployment manages a ReplicaSet, what the READY and UP-TO-DATE columns mean, and which fields real manifests set.

How Deployment shifts traffic from the old ReplicaSet to the new one, what maxSurge and maxUnavailable do, and where revisions come from.

Where Kubernetes keeps the release history, and what kubectl rollout undo actually does to a ReplicaSet.

The controller for agents that must run on every machine: how it counts replicas, and where nodeSelector and taints fit in.

The controller for migrations and backups: completions, backoffLimit, restartPolicy, and why you can't clean up a Job by deleting its Pod.

The schedule runs in UTC, concurrencyPolicy, history limits, and other spots where a CronJob catches you off guard.

The four guarantees of StatefulSet, per-pod DNS through clusterIP None, and how volumeClaimTemplates gives every replica its own disk.

How HPA calculates the replica count it needs, why it stays silent without resources.requests, and what the behavior block does.

Two environments and one Service acting as a switch: how to get an instant rollback, and what it costs you.

Traffic share through a replica ratio: how it works on a plain Service, where the precision breaks down, and when it's time for a service mesh.

The env field in a container spec: literals, valueFrom, $(VAR) substitution, and why env doesn't update on the fly.

Three ways to pass settings into a Pod from a ConfigMap, and how they differ when the data changes.

How a Secret differs from a ConfigMap, the types it comes in, and what actually protects secrets in the cluster.

What the immutable flag does on a Secret or ConfigMap, why it's useful, and how to rotate data when edits are blocked.

How command and args override the image's ENTRYPOINT and CMD, and why a container sometimes goes Completed in a second.

Containers that run before the main ones: start order, common scenarios, and turning an init container into a native sidecar.

A second container next to the main one: a shared emptyDir, tail -F, and the difference between the legacy form and a native sidecar.

Three roles for containers sharing a Pod, and the signal that tells you which one to pick.

How a group of Pods gets one stable address and DNS name inside the cluster.

The most straightforward way to let traffic into the cluster from outside, and its cost.

How resolv.conf, search domains, and ndots turn curl http://web into a Service address.

Where a Service gets its address list, why Endpoints gave way to EndpointSlice, and what empties the list.

What changes when a Service hands the client a list of Pod addresses instead of one virtual IP.

How to lock a Pod down from unwanted traffic with label-based rules, and where the one-dash mistake hides.

One entry point on 80/443, with rules that route traffic to Services by domain and path.

Why routing got split across GatewayClass, Gateway, and HTTPRoute, and how that differs from Ingress.

How a PVC and a PV give an app a persistent disk, what accessModes means, and why a PVC stays Pending without a Pod.

provisioner, reclaimPolicy, and volumeBindingMode: the three fields that decide how and when a PVC gets a real disk.

How requests differ from limits, where the m and Mi units come from, why CPU gets throttled while memory kills the Pod.

What the spec.nodeName field does, why it's risky in prod, and what this has to do with the control plane's static Pods.

How labels on nodes and spec.nodeSelector split the cluster by purpose, and why a typo sends the Pod to Pending.

Hard and soft placement rules, the matchExpressions operators, and where the OR hides in nodeSelectorTerms.

How a node fences off Pods that don't belong, how NoSchedule, PreferNoSchedule and NoExecute differ, and what to write in tolerations.

Why a toleration without affinity doesn't keep a Pod pinned to a dedicated node, and why affinity without a toleration leaves it stuck Pending.

How a controlled eviction differs from an emergency one, and how minAvailable and maxUnavailable stop kubectl drain.

The securityContext fields that turn an ordinary container into a non-root process with trimmed permissions and a read-only root.

Which identity the code inside a Pod uses to call the cluster API, where its token comes from, and why automount is worth turning off.

The four RBAC objects, a field-by-field look at Role and RoleBinding, and kubectl auth can-i as a way to stop guessing at a 403.

Where kubectl gets logs from, which flags people actually use, and why --previous sometimes returns nothing.

Where kubectl top gets its numbers, how to read millicores, and why the command doesn't work without metrics-server.

How readiness differs from liveness, why you need a startupProbe, and what the minimal probe fields look like in a manifest.

How kustomization.yaml assembles scattered YAML into one unit, and why Kustomize isn't a templating engine.

namePrefix, labels, namespace, and image swaps: edits that cover the whole group of resources at once.

A targeted edit to a single resource: strategic merge patch, the JSON 6902 format, and how to pick a target.

The base plus overlays pattern: one source of manifests and different environment configs without copy-paste.

configMapGenerator builds a ConfigMap from literals and files, and the hash in its name forces the Pod to restart on a change.

secretGenerator, and an honest look at how base64 in a Secret protects nothing.

What a chart is made of, what Helm 3 stores in the cluster after install, and how to configure a release with --set.

The order values are layered in, how several files get merged, and the rules Helm uses to merge dicts and lists.

Release revisions, the history stored in a Secret, rolling back with one command, and why upgrade sometimes drops values you set earlier.

Why a Pod can't pull its image, where the real error text sits in describe, and what to do about it.

How to tell a crashed app from a badly configured probe, and why you need to read logs with the --previous flag.

What FailedScheduling means, how requests differ from limits, and why a node with 4 cores won't give you 4 cores.

Breaking down CreateContainerConfigError: where a Pod references external objects, and why it doesn't need a restart once the ConfigMap exists.

How to read a 403 from the apiserver word by word and check permissions with kubectl auth can-i instead of guessing.

Why an empty endpoints list is the main symptom, how to check the selector against the Pod's labels, and which side to fix.

An incident where the Pod is healthy but the Service forwards traffic to a closed port.

How to tell a general DNS outage from a single Service's problem, and the chain to follow to find the cause.

Why the rollout went green while the service went down, and how to set up the probe so the next rollout catches itself.

CreateContainerConfigError, restoring a config, and why Pods don't fix themselves.

Why the service crashes with no load at all, and how to tune probe settings for a cold start.

How to read Forbidden errors from a pipeline, reproduce permissions with auth can-i, and build a minimal Role for a deploy.

How the cluster learns about a new kind, how a type definition differs from an object of that type, and why a CRD without a controller is just a record in a database.

Why you can't change a namespace on the fly, which fields to clean out of an export, and in what order to move objects so the service doesn't go down.

Where Deployment's capabilities end, what work an operator takes over, which operators show up in production, and why you shouldn't put one on every application.

Why an application must shut down cleanly on SIGTERM, how to finish serving in-flight requests, and how to avoid dropped connections during a deploy.

How liveness differs from readiness, why an app needs a separate /healthz, and how both connect to load balancing and the orchestrator.

Why config lives in the environment, what 'one artifact for every environment' means, and which 12-factor principles are about operations.

How services survive other services' failures: timeouts, safe retries with backoff, and a circuit breaker against cascading failures.

Why a repeated request shouldn't create a duplicate: idempotent methods, the idempotency key, and safe retries.