Kubernetes essentials: 50 core objects and kubectl commands

All 50 cards

1. 1
   What is a Pod?
   The smallest deployable unit: one or more containers that share a network namespace (one IP) and volumes, and are scheduled together on one node
2. 2
   Deployment
   Keeps a set of identical Pods running through ReplicaSets, with rolling updates and rollbacks

   The usual choice for stateless apps.
3. 3
   ReplicaSet
   Keeps a specified number of Pod replicas running; normally managed by a Deployment rather than created directly
4. 4
   StatefulSet
   For stateful apps: Pods get stable names (db-0, db-1), start in order and each keep their own PersistentVolumeClaim
5. 5
   DaemonSet
   Runs one copy of a Pod on every node, or on selected nodes, e.g. log collectors and monitoring agents
6. 6
   Job vs CronJob
   A Job runs Pods until a task completes successfully; a CronJob creates Jobs on a cron schedule
7. 7
   Init containers
   Run to completion, one after another, before the app containers start

   Typical uses: waiting for a dependency, running migrations, fetching configuration.
8. 8
   What does a Service do?
   Gives a set of Pods, chosen by a label selector, a stable virtual IP and DNS name, and load-balances traffic across them
9. 9
   The four Service types
   ClusterIP (the default, internal only), NodePort (a port on every node), LoadBalancer (an external cloud load balancer), ExternalName (a DNS CNAME)
10. 10
    Default NodePort range
    30000–32767
11. 11
    Headless Service
    A Service with clusterIP: None: DNS returns the Pod IPs directly instead of one virtual IP

    StatefulSets use one to give each Pod its own DNS name.
12. 12
    A Service’s DNS name inside the cluster
    <service>.<namespace>.svc.cluster.local

    From the same namespace, the bare service name works.
13. 13
    Ingress
    Rules that route HTTP and HTTPS traffic to Services by host name and path; it does nothing without an ingress controller running in the cluster

    The newer Gateway API is its more expressive successor.
14. 14
    NetworkPolicy
    Rules for which traffic may reach or leave Pods, selected by labels, namespaces or IP ranges

    Only enforced if the cluster’s network plugin supports it, as Calico and Cilium do.
15. 15
    ConfigMap vs Secret
    Both inject configuration as environment variables or files; Secrets hold sensitive data but are only base64-encoded by default, not encrypted

    Turn on encryption at rest and limit who can read Secrets with RBAC.
16. 16
    Namespace
    A scope for names, resource quotas and access control inside a cluster

    Built in: default, kube-system, kube-public and kube-node-lease.
17. 17
    Labels vs annotations
    Labels are identifying key-value pairs that selectors match on; annotations hold non-identifying metadata for tools and people
18. 18
    PersistentVolume vs PersistentVolumeClaim
    A PV is a piece of storage in the cluster; a PVC is a request for storage that binds to a matching PV and is mounted by Pods
19. 19
    StorageClass
    Describes a kind of storage and lets PVCs provision PersistentVolumes dynamically, on demand
20. 20
    Volume access modes
    ReadWriteOnce (one node), ReadOnlyMany, ReadWriteMany and ReadWriteOncePod (a single Pod)
21. 21
    Liveness probe
    When it fails, the kubelet restarts the container
22. 22
    Readiness probe
    While it fails, the Pod is taken out of Service endpoints and gets no traffic; the container isn’t restarted
23. 23
    Startup probe
    Holds off liveness and readiness checks until it succeeds, so slow-starting apps aren’t killed during startup
24. 24
    An HTTP liveness probe in a container spec
    yaml

    livenessProbe:
      httpGet:
        path: /healthz
        port: 8080
      initialDelaySeconds: 5
      periodSeconds: 10

    Probes can also use tcpSocket, exec or grpc.
25. 25
    Resource requests vs limits
    Requests are what the scheduler reserves for a container on a node; limits are the most it may use

    Over its memory limit a container is OOM-killed; over its CPU limit it is throttled.
26. 26
    The three Pod QoS classes
    Guaranteed (every container has CPU and memory requests equal to limits), Burstable (some requests or limits set), BestEffort (none set)

    Under memory pressure, BestEffort Pods are evicted first.
27. 27
    HorizontalPodAutoscaler
    Scales a workload’s replica count up and down based on metrics such as CPU utilization

    It needs the metrics API, usually provided by metrics-server.
28. 28
    Rolling update settings of a Deployment
    maxSurge (extra Pods allowed during the update) and maxUnavailable (Pods that may be down), both 25% by default
29. 29
    Control plane components
    kube-apiserver, etcd, kube-scheduler and kube-controller-manager, plus cloud-controller-manager in cloud clusters
30. 30
    etcd
    The consistent, distributed key-value store that holds all cluster state

    Back it up: losing etcd means losing the cluster’s configuration.
31. 31
    kubelet
    The agent on each node that makes sure the containers in its Pods are running and healthy
32. 32
    kube-proxy
    Runs on each node and programs the network rules (iptables, IPVS or nftables) that make Services work
33. 33
    kube-scheduler
    Assigns each new Pod to a node, based on resource requests, affinity rules, and taints and tolerations
34. 34
    Taints and tolerations
    A taint on a node repels Pods unless they have a matching toleration

    bash

    kubectl taint nodes node1 gpu=true:NoSchedule

35. 35
    nodeSelector vs node affinity
    Both attract Pods to nodes with certain labels; nodeSelector is a simple exact match, while affinity adds operators and required or preferred rules
36. 36
    CrashLoopBackOff
    A container keeps crashing, and the kubelet restarts it with an increasing delay, up to five minutes

    Start with kubectl logs --previous and kubectl describe pod.
37. 37
    ImagePullBackOff
    The node can’t pull the image: a wrong name or tag, a private registry without credentials, or a network problem
38. 38
    Role vs ClusterRole
    A Role grants permissions in one namespace; a ClusterRole is cluster-wide or reusable across namespaces

    Grant them with a RoleBinding or a ClusterRoleBinding.
39. 39
    ServiceAccount
    The identity that processes in a Pod use to call the Kubernetes API
40. 40
    List Pods with their node and IP address
    bash

    kubectl get pods -o wide

    Add -A for every namespace, or -w to watch for changes.
41. 41
    See a Pod’s events and why it isn’t starting
    bash

    kubectl describe pod web-7d4b9c

42. 42
    Show the logs of a container’s previous, crashed run
    bash

    kubectl logs web-7d4b9c --previous

    -c name picks a container in a multi-container Pod; -f follows new output.
43. 43
    Open a shell inside a running Pod
    bash

    kubectl exec -it web-7d4b9c -- sh

44. 44
    Create or update resources from a manifest
    bash

    kubectl apply -f deployment.yaml

45. 45
    Watch a rollout, then roll it back
    bash

    kubectl rollout status deployment/web
    kubectl rollout undo deployment/web

46. 46
    Scale a Deployment to five replicas
    bash

    kubectl scale deployment web --replicas=5

47. 47
    Reach a Service from your machine without exposing it
    bash

    kubectl port-forward svc/web 8080:80

48. 48
    Generate a Deployment manifest without creating anything
    bash

    kubectl create deployment web --image=nginx --dry-run=client -o yaml > web.yaml

49. 49
    List cluster contexts and switch to another
    bash

    kubectl config get-contexts
    kubectl config use-context staging

50. 50
    Empty a node safely before maintenance
    bash

    kubectl drain node1 --ignore-daemonsets

    Then kubectl uncordon node1 lets Pods be scheduled there again.