CKA (Other exams) key terms

Consistent key-value store that holds the entire desired and observed state of the cluster; the API server reads and writes it, and losing its data means losing the cluster.

Front end of the control plane that serves the REST API, validates and admits requests, and is the only component that talks directly to etcd.

Control-plane component that watches for Pods with no assigned node and binds each to a node by filtering feasible nodes and scoring them.

Node agent that receives PodSpecs, starts and monitors containers through the container runtime, reports node and Pod status, and runs probes and static Pods.

Node component that programs iptables, IPVS, or nftables rules so Service virtual IPs and load balancing work for traffic reaching the node.

Pod defined by a manifest file in the kubelet's configured directory and managed directly by the kubelet, not by the API server; control-plane components are often run this way.

File holding clusters, users, and contexts that kubectl uses to pick an API server endpoint and credentials; the active context determines which cluster you act on.

Authorization model built from Roles or ClusterRoles that list verbs on resources, bound to users, groups, or ServiceAccounts by RoleBindings or ClusterRoleBindings.

Namespaced identity for processes running in Pods, mounted as a token so workloads can authenticate to the API server and receive the permissions bound to it.

Plugin in the API server request path that can mutate or reject objects after authentication and authorization, enforcing policies such as resource limits or namespace existence.

Tool that bootstraps a conformant cluster by generating certificates, starting control-plane components, joining nodes, and supporting upgrade and token commands.

Binary invoked by the container runtime to attach Pod network interfaces, assign IP addresses, and set routes; examples include Calico, Cilium, and Flannel.

Plugin that lets Kubernetes provision, attach, mount, and snapshot storage from an external system by implementing the Container Storage Interface.

Controller that manages ReplicaSets to keep a declared number of Pod replicas running and supports rolling updates and rollbacks through revision history.

Controller that ensures a specified number of identical Pods exist, replacing failed ones; usually created and scaled indirectly by a Deployment.

Controller that runs one Pod copy on every eligible node, or a subset chosen by node selectors, commonly used for log shippers, agents, and per-node networking.

Controller for Pods needing stable identity, ordered startup and shutdown, and per-replica persistent storage, addressed through a headless Service.

Job runs Pods until a target number of successful completions; CronJob creates Jobs on a cron schedule with concurrency and history limits.

Container that runs to completion before any app container in the Pod starts, often used to wait for dependencies or prepare files on a shared volume.

Query over key-value labels used by controllers and Services to choose which objects they manage or route to; matchLabels requires exact matches, matchExpressions adds set logic.

Pod field listing node labels that must all match for scheduling; simpler but less expressive than node affinity rules.

Scheduling rules using requiredDuringSchedulingIgnoredDuringExecution or preferredDuringSchedulingIgnoredDuringExecution to match node labels with operators and weights.

Taint on a node repels Pods unless the Pod declares a matching toleration; used to reserve nodes for specific workloads or evict them during maintenance.

Cordon marks a node unschedulable; drain evicts its Pods while respecting PodDisruptionBudgets, typically before maintenance or an upgrade.

Policy limiting how many Pods of a selected set may be voluntarily unavailable, constraining eviction during drain or node upgrades.

Requests reserve CPU and memory for scheduling; limits cap usage, with memory overruns causing OOM kills and CPU overruns causing throttling.

Namespace-scoped object capping total requests, limits, object counts, or storage claims, causing creation to fail once the aggregate would exceed the quota.

Namespace policy supplying default requests and limits to containers and enforcing minimum, maximum, and ratio bounds on individual Pods or claims.

Periodic check that restarts a container when it fails, used to recover from deadlocks; misconfiguration can cause endless restart loops.

Check that decides whether a Pod receives Service traffic; failing it removes the Pod from endpoints without restarting the container.

Pod-level setting of Always, OnFailure, or Never controlling whether the kubelet restarts containers that exit; Jobs usually use OnFailure or Never.

Stable virtual IP and DNS name that load-balances traffic to Pods matching a selector, decoupling clients from Pod churn and addresses.

Default Service type reachable only inside the cluster through a virtual IP and DNS name, with kube-proxy programming the data path.

Service type that opens the same port on every node and forwards it to the Service, reachable from outside at node address plus that port.

Service type requesting an external load balancer from the cloud provider, which also allocates a NodePort for routing traffic to backends.

HTTP and HTTPS routing rules by host and path to Services, implemented by an ingress controller that watches Ingress objects and configures a proxy.

Object naming an ingress controller implementation and marking whether it is the cluster default, so Ingress objects are handled by the intended controller.

Service with clusterIP None that publishes per-Pod DNS records instead of a virtual IP, giving clients direct addresses and stable identity for StatefulSets.

Object holding the IP addresses and ports of Pods backing a Service, replacing the older Endpoints object and scaled by grouping addresses.

Namespaced rule set selecting Pods and allowing only listed ingress or egress traffic; enforcement requires a CNI plugin that supports it.

Address range from which each node receives a subnet for Pod IPs, configured on the controller manager and used by the CNI plugin.

Cluster-level storage resource with its own lifecycle, provisioned statically by an admin or dynamically through a StorageClass, then bound to a claim.

Namespaced request for storage with size, access modes, and optional class or selector; Kubernetes binds it to a matching volume.

Object describing a provisioner, parameters, reclaim policy, and volume binding mode used to create volumes on demand for claims.

Claim field requesting ReadWriteOnce, ReadOnlyMany, ReadWriteMany, or ReadWriteOncePod; support depends on the volume plugin rather than on Kubernetes itself.

Pod volume created empty when the Pod starts and deleted when it is removed, shared by containers and often used for scratch space or init handoff.

Pod volume mounting a path from the node filesystem; useful for node agents but a security and portability risk for ordinary workloads.

Recovering etcd from a saved snapshot with etcdctl, then pointing the API server at the restored data directory after stopping control-plane components.

Short-lived API objects recording what happened to resources, such as scheduling failures or image pull errors, read with kubectl get or describe.

Command printing container output, with flags for previous crashed instances, specific containers, follow mode, and tailing a number of lines.

Command running a process inside an existing container, used to inspect files, test DNS and connectivity, or debug an application from within its namespace.

Temporary container added to a running Pod for debugging without restarting it, with limited fields and no probes or resource guarantees.

Command that creates a privileged Pod on a chosen node with the host filesystem mounted, letting you inspect kubelet, runtime, and networking from the node.

Node condition reported when the kubelet cannot renew its status or the runtime is unhealthy, causing Pods to be tainted and rescheduled elsewhere.

Pod state where a container repeatedly exits and the kubelet restarts it with increasing delay; diagnose with logs, previous logs, and describe events.

Deployment strategy replacing Pods gradually under maxSurge and maxUnavailable, keeping the service available and allowing rollback to a prior revision.

Software such as containerd or CRI-O that pulls images and runs containers on a node, reached by the kubelet through the Container Runtime Interface.