Lessons

Meet the cluster, run a container in a Pod, read its logs, and see what happens when you delete it.

Node · Pod · kubectl

Describe what you want in a manifest and let Kubernetes make it so. Apply, edit, re-apply.

Manifest · kubectl apply · Desired state

See the control loop that replaces lost Pods, and how labels decide which Pods a ReplicaSet owns.

ReplicaSet · Labels & selectors · Control loop

Give a set of Pods one stable address, load-balance across them, and reach them from outside.

Service · EndpointSlice · DNS · NodePort

Split one cluster into separate spaces for teams or environments.

Namespace · Scope · Context

Create a Deployment from the command line and scale it up and down.

Deployment · Scaling · Scheduling

Ship a new version with zero downtime, break a rollout on purpose, and undo it.

Rolling update · Revision history · Rollback

Tell Kubernetes how to check your app. Break a Pod on purpose and watch readiness take it out of the Service, then liveness restart a stuck container.

Readiness probe · Liveness probe · Startup probe · kubectl exec

Run work that finishes: one-off Jobs, parallel batches, retries that give up, and Jobs on a schedule.

Job · CronJob · completions & parallelism · backoffLimit

Reserve CPU and memory for containers, see a Pod that can't be scheduled, watch a container get OOMKilled, and measure real usage.

Requests & limits · QoS class · Insufficient cpu · OOMKilled · kubectl top

Keep settings out of your images: environment variables and files from ConfigMaps, passwords from Secrets, and what happens when one is missing.

ConfigMap · Secret · envFrom · Volumes · CreateContainerConfigError

Put one HTTP entrance in front of several Services and route by hostname and path, with the ingress-nginx controller.

Ingress · Ingress controller · Host & path routing

Firewall rules for Pods: deny everything, allow only what's needed, across namespaces, and remember DNS when you limit outgoing traffic.

NetworkPolicy · podSelector · namespaceSelector · Egress · DNS

Claim a volume, see why it waits for a Pod, and keep data when the Pod that wrote it is gone.

PersistentVolumeClaim · PersistentVolume · StorageClass · WaitForFirstConsumer

Run Pods that keep their identity: ordered start, stable names and DNS, and a volume each that follows them.

StatefulSet · Headless Service · volumeClaimTemplates · Stable DNS

Three things are broken. Use get, describe, logs and events to find and fix each one.

Debugging · ImagePullBackOff · CrashLoopBackOff · Selectors

Steer Pods onto the right Nodes with labels, keep them off with taints, and empty a Node safely before maintenance.

nodeSelector · Taints & tolerations · Cordon & drain · DaemonSet

The official HorizontalPodAutoscaler walkthrough: put CPU load on php-apache, watch it scale out, then scale back in.

HorizontalPodAutoscaler · metrics-server · Stabilization window

Give a CI pipeline its own identity, see it get Forbidden, then grant exactly what it needs with a Role and a RoleBinding.

ServiceAccount · Role · RoleBinding · kubectl auth can-i · Impersonation