Kubernetes fundamentals

The core objects

• Pod: one or more containers that run together and share a network identity. The smallest unit you deploy, and disposable.
• Deployment: declares how many replicas of a pod to run and how to roll out changes. A ReplicaSet underneath keeps the count.
• Service: a stable name and address that load-balances to the matching pods, which come and go.
• Ingress or Gateway: routes outside traffic by host and path to services.
• ConfigMap and Secret: configuration and sensitive values injected as environment variables or files. A Secret is encoded, not encrypted by default; protect it with encryption at rest and tight access.
• Namespace: a scope for names, quotas and access rules, used to separate teams or environments.
• The control loop: you declare desired state; controllers continuously make the actual state match.

A deployment worth running

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  replicas: 3
  selector:
    matchLabels: { app: api }
  strategy:
    rollingUpdate: { maxUnavailable: 0, maxSurge: 1 }
  template:
    metadata:
      labels: { app: api }
    spec:
      securityContext:
        runAsNonRoot: true
        seccompProfile: { type: RuntimeDefault }
      containers:
        - name: api
          image: registry.example.com/api@sha256:<digest>
          ports: [{ containerPort: 8080 }]
          resources:
            requests: { cpu: 100m, memory: 128Mi }
            limits: { memory: 256Mi }
          readinessProbe:
            httpGet: { path: /ready, port: 8080 }
          livenessProbe:
            httpGet: { path: /health, port: 8080 }
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: ["ALL"] }

Everyday commands

kubectl get pods -n prod -o wide
kubectl describe pod api-7c9d -n prod           # events explain most failures
kubectl logs deploy/api -n prod --tail=100 -f
kubectl rollout status deploy/api -n prod
kubectl rollout undo deploy/api -n prod          # roll back to the previous revision
kubectl top pods -n prod

Common mistakes

• No resource limits: one pod starves its neighbors.
• Liveness probes that depend on external services, restarting healthy pods during an outage.
• Using latest tags or mutable tags so a pod restart changes the version.
• Everything in the default namespace, with cluster-wide permissions for every workload.
• Treating the cluster as the thing you operate, instead of the platform your teams use.