Kubernetes

See how containers package and isolate applications, how they differ from virtual machines, and how runtimes start them. Run containers locally and inspect their processes, files, networking, and resource use.

Create reproducible OCI images with Dockerfiles or equivalent build tools, then tag, scan, and publish them to a registry. Image layers, digests, architectures, and pull policies explain what Kubernetes eventually runs.

Write YAML manifests and compare imperative commands with declarative desired state. Practice labels, annotations, selectors, namespaces, and safe configuration changes.

Trace the path from physical servers and virtual machines through containers, cluster schedulers, and Kubernetes. This history explains the platform’s design, governance, standard interfaces, and place in cloud-native computing.

Map the API server, etcd, scheduler, controllers, kubelet, container runtime, and network components. Follow a workload request through the control plane and see how reconciliation loops move actual state toward desired state.

Create a local cluster and use kubectl to inspect resources, apply manifests, view events, read logs, and open temporary shells. Contexts, namespaces, output formats, and command completion establish a safe daily workflow.

Work with API groups, versions, kinds, metadata, specifications, status fields, and resource schemas. Use discovery, explain, server-side validation, and API conventions to read unfamiliar resources confidently.

Define single-container and multi-container Pods, shared volumes, ports, environment variables, and init containers. Inspect Pod phases and restart behavior while building a small runnable workload.

Manage stateless applications with ReplicaSets, Deployments, rolling updates, rollbacks, and revision history. Practice scaling and releasing a new image without unnecessary downtime.

Run finite work with Jobs and scheduled work with CronJobs. Configure retries, parallelism, completion rules, deadlines, concurrency policies, and cleanup for reliable batch execution.

Place one Pod on every eligible node for log agents, monitoring agents, storage helpers, and other node-level services. Compare DaemonSet rollout behavior with ordinary Deployments.

Separate application settings from container images with ConfigMaps, environment variables, command arguments, and mounted files. Apply configuration changes while accounting for rollout and reload behavior.

Use startup, readiness, and liveness probes without creating restart loops or premature traffic. Add graceful shutdown, lifecycle hooks, termination periods, and disruption-aware application behavior.

Set CPU and memory requests and limits, then examine scheduling, throttling, out-of-memory termination, and Quality of Service classes. Size a workload from observed use rather than guesswork alone.

Control Pod placement with node selectors, affinity, anti-affinity, taints, tolerations, topology spread, priorities, and preemption. Build placement rules that balance availability, cost, hardware needs, and isolation.

Follow Pod traffic across nodes and examine the flat cluster network model implemented through CNI plugins. Address IP allocation, packet paths, MTU concerns, and common connectivity failures.

Provide stable addressing with ClusterIP, NodePort, LoadBalancer, headless Services, EndpointSlices, and internal DNS. Connect front-end and back-end workloads and verify service discovery from inside the cluster.

Restrict east-west traffic with ingress and egress NetworkPolicies. Design default-deny rules, permit required DNS and application paths, and verify whether the chosen network plugin enforces them.

Expose HTTP and HTTPS applications through Ingress controllers, routing rules, TLS certificates, and external load balancers. Diagnose the boundary between Kubernetes resources, controllers, DNS, and cloud networking.

Model modern traffic routing with GatewayClass, Gateway, HTTPRoute, GRPCRoute, and policy attachment. Compare Gateway API’s role-based design and portability with traditional Ingress resources.

Use ephemeral volumes, PersistentVolumes, PersistentVolumeClaims, StorageClasses, snapshots, and CSI drivers. Match access modes, reclaim policies, binding behavior, and storage topology to application needs.

Run stable, ordered replicas with persistent identity, headless Services, and per-replica storage. Handle scaling, updates, failure recovery, and operational limits for databases and other stateful systems.

Scale Pods with resource, custom, and external metrics through the Horizontal Pod Autoscaler. Relate vertical sizing and node autoscaling to HPA behavior so that multiple control loops do not work against one another.

Follow requests through certificates, tokens, authentication proxies, authorization, and admission. This creates the security model needed to reason about users, workloads, and API access.

Grant least-privilege access with Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings. Test permissions with impersonation and authorization checks, then avoid common wildcard and namespace mistakes.

Give Pods identities through ServiceAccounts, projected tokens, and external workload identity systems. Separate human credentials from workload credentials and reduce reliance on long-lived secrets.

Store sensitive values with Secret resources while accounting for base64 encoding, etcd exposure, RBAC, rotation, and auditability. Connect external secret stores through operators or CSI-based delivery when stronger controls are required.

Reduce container privileges with security contexts, Linux capabilities, seccomp, read-only filesystems, and non-root execution. Enforce namespace-level standards with Pod Security Admission.

Validate or modify API requests with built-in admission controls, validating admission policies, and policy engines such as Gatekeeper or Kyverno. Turn organizational rules into tested guardrails without blocking legitimate delivery.

Collect Kubernetes and application metrics, logs, traces, events, and audit records. Build dashboards and alerts around workload health, control-plane health, saturation, latency, errors, and service objectives.

Use describe output, events, logs, exec, port forwarding, ephemeral containers, node diagnostics, and network tests to isolate failures. Work through Pending Pods, image-pull errors, crash loops, DNS failures, and unreachable Services.

Package reusable applications with Helm charts, values, templates, dependencies, hooks, and release state. Install, upgrade, test, roll back, and safely review rendered manifests.

Create environment-specific manifests with bases, overlays, patches, generators, and replacements. Use Kustomize when direct YAML composition is preferable to a templating system.

Validate manifests, build and scan images, run tests, publish artifacts, and promote releases through automated pipelines. Apply immutable image digests, environment approvals, rollout checks, and rollback signals.

Operate clusters from version-controlled desired state using reconciliation-based delivery. Structure repositories, manage promotion, detect drift, protect secrets, and use tools such as Argo CD or Flux without making manual cluster changes the source of truth.

Extend the Kubernetes API with CustomResourceDefinitions, schemas, status fields, finalizers, and controllers. Build a small reconciler and apply operator patterns to automate lifecycle work for complex applications.

Add service-to-service identity, encrypted transport, traffic policy, retries, telemetry, and progressive delivery through a service mesh. Evaluate sidecar and sidecar-free data planes against their operational cost.

See how eBPF supports high-performance networking, policy enforcement, load balancing, tracing, and runtime visibility. Inspect where eBPF-based implementations replace or complement traditional proxies and kernel packet paths.

Assemble a cluster with kubeadm and configure control-plane nodes, worker nodes, networking, certificates, and node registration. This reveals the responsibilities hidden by local and managed cluster products.

Operate Kubernetes through a cloud provider while accounting for shared responsibility, identity, networking, load balancers, storage, node pools, and control-plane limits. Compare managed defaults without tying architecture to one provider.

Declare and reconcile cluster infrastructure through Kubernetes-style APIs. Use Cluster API concepts to create repeatable cluster templates, manage machine lifecycles, and coordinate upgrades across environments.

Protect control-plane availability, etcd health, certificates, and critical add-ons. Plan version-skew-safe upgrades, node draining, maintenance windows, and API migration when resources are deprecated.

Back up application data, Kubernetes resources, and control-plane state according to recovery objectives. Test restoration, regional failure procedures, storage snapshots, and the difference between backups and replicated availability.

Share clusters safely with namespaces, quotas, limit ranges, network isolation, RBAC, and policy boundaries. Decide when soft multi-tenancy is sufficient and when separate or virtual clusters are safer.

Manage applications and policy across many clusters, regions, and accounts. Address fleet inventory, placement, configuration drift, cross-cluster discovery, identity, and failure isolation.

Run scale-to-zero services and event-driven workloads on Kubernetes using serverless frameworks such as Knative. Account for request activation, cold starts, autoscaling behavior, and event delivery guarantees.

Operate Kubernetes on constrained, remote, or intermittently connected devices. Plan lightweight distributions, centralized fleet control, local autonomy, update safety, and data placement for edge environments.

Schedule GPUs and other accelerators through device plugins, node labels, quotas, and topology-aware placement. Design training and inference workloads around large images, shared storage, batch queues, model serving, and expensive capacity.

Protect source, dependencies, build systems, images, registries, manifests, and deployment paths. Apply software bills of materials, signing, provenance, admission verification, vulnerability scanning, and trusted build practices.

Detect suspicious processes, file changes, privilege escalation, and unusual network activity in running clusters. Prepare audit trails, containment actions, credential rotation, forensic collection, and recovery procedures for Kubernetes incidents.

Measure cluster spending and allocate it by namespace, workload, team, or service. Improve utilization through requests, autoscaling, node selection, bin packing, quotas, and safe use of interruptible capacity.

Build paved roads that let teams deploy safely without mastering every cluster detail. Combine templates, self-service APIs, policy, documentation, service catalogs, and developer portals while keeping platform ownership clear.

Take a service from application requirements through containerization, manifests, storage and networking decisions, security controls, automated delivery, observability, release validation, and operational handoff. The project includes failure testing, rollback, scaling, backup, and post-release review.

Map Kubernetes skills to application, platform, site reliability, security, networking, and cluster administration roles. Build proof through public manifests, charts, operators, runbooks, incident exercises, and production-style projects; evaluate certifications such as KCNA, CKA, CKAD, and CKS, and stay current through release notes and enhancement proposals.