CKAD key terms

The smallest deployable unit in Kubernetes: one or more containers that share a network namespace, IP address, and storage volumes, and that are scheduled together on the same node.

A container that runs to completion before a Pod's main containers start, often to wait for dependencies or prepare files; if it fails, the kubelet retries it according to the Pod restart policy.

A helper container running alongside the main application container in the same Pod, sharing its network and volumes, typically handling tasks such as logging, proxying, or data synchronisation.

A temporary volume created when a Pod is scheduled and deleted when the Pod is removed; shared by all containers in the Pod and useful for scratch space or passing files between containers.

A workload controller that runs Pods until a specified number of successful completions is reached, then stops creating new ones; suited to batch processing and one-off tasks.

A controller that creates Jobs on a repeating schedule written in cron syntax, with settings for concurrency policy, deadlines, and how many successful or failed Job records to keep.

A request for storage of a given size and access mode that binds to a PersistentVolume; Pods mount the claim instead of referencing storage directly, decoupling workloads from the underlying volume implementation.

Requests reserve the CPU and memory the scheduler guarantees for a container; limits cap the maximum it may consume, causing CPU throttling or memory-related termination when exceeded.

A temporary container added to a running Pod for debugging that shares the Pod's namespaces; it has no probes or resource guarantees and cannot be removed once added.

A controller that manages ReplicaSets to keep a specified number of identical Pods running, and that supports declarative rolling updates and rollbacks of the Pod template.

A controller that ensures a specified number of identical Pod replicas exist at any time, replacing failed ones; it is normally created and managed indirectly by a Deployment.

A deployment strategy that replaces Pods gradually, creating new ones while terminating old ones so the application stays available; its behaviour is tuned by maxSurge and maxUnavailable.

A rolling update setting specifying how many Pods above the desired replica count may be created temporarily during the update, expressed as an absolute number or a percentage.

A rolling update setting specifying how many Pods below the desired replica count may be unavailable during the update, as an absolute number or a percentage; zero gives no-downtime updates when combined with surge.

A command that reverts a Deployment, DaemonSet, or StatefulSet to a previous revision recorded in its rollout history, optionally targeting a specific revision number.

A controller that ensures a copy of a Pod runs on every node, or on a selected subset of nodes, commonly used for node-level agents such as log collectors or network plugins.

A controller for stateful workloads that gives each Pod a stable ordered identity, its own PersistentVolumeClaim, and a predictable network name, with ordered creation and deletion.

A packaged collection of Kubernetes manifest templates plus default values and metadata, installable and upgradable as a versioned release with user-supplied configuration overrides.

A tool built into kubectl that customises plain YAML manifests by layering patches, overlays, and image or name transformations without templating, applied with kubectl apply -k.

A query over key/value labels used by controllers, Services, and policies to determine which objects they target; it supports equality-based and set-based matching expressions.

A resource that automatically adjusts the replica count of a Deployment, ReplicaSet, or StatefulSet based on observed metrics such as CPU utilisation or custom metrics.

A periodic check telling the kubelet whether a container is still healthy; repeated failures cause the container to be killed and restarted according to the Pod's restart policy.

A periodic check deciding whether a container is ready to receive traffic; failing Pods are removed from Service endpoints but are not restarted, and return to rotation once they pass again.

A check that runs during container start-up and suppresses liveness and readiness checks until it succeeds, giving slow-starting applications time to initialise without being restarted prematurely.

A command that prints a container's standard output and error; flags allow following live output, viewing logs from a previous crashed instance, and choosing a container in a multi-container Pod.

A command that reports current CPU and memory usage for Pods or nodes, sourced from the metrics server; useful for spotting hot spots and validating requests and limits.

A Pod status indicating a container repeatedly exits and Kubernetes waits with increasing delays before restarting it, usually caused by application errors, bad configuration, or failing probes.

An API object holding non-confidential key/value data or files that Pods consume as environment variables, command arguments, or mounted volumes, keeping configuration separate from container images.

An API object for holding sensitive data such as passwords or tokens, stored base64-encoded and consumed like a ConfigMap; access is governed by RBAC and the data can be encrypted at rest.

A container specification field that imports every key of a ConfigMap or Secret as an environment variable, optionally applying a prefix to each name to avoid collisions.

A mechanism that exposes Pod and container metadata, such as name, namespace, labels, or resource limits, to running containers through environment variables or mounted files.

An identity object used by Pods when calling the Kubernetes API; its token is projected into containers and its permissions come from RoleBindings or ClusterRoleBindings.

Pod- and container-level settings controlling privileges and access, including the user and group IDs to run as, read-only root filesystem, Linux capabilities, and privilege escalation.

A reference to one or more registry-credential Secrets that the kubelet uses to authenticate against a private container registry when pulling an image for a Pod.

The default Service type, providing a stable virtual IP and DNS name that load-balances traffic to the selected Pods; it is reachable only from inside the cluster network.

A Service type that opens a static port on every node's IP address and forwards traffic to the selected Pods, making the application reachable from outside the cluster.

A Service whose clusterIP is set to None, so DNS returns individual Pod IP addresses instead of load-balancing; used with StatefulSets and for client-side service discovery.

An API object defining HTTP and HTTPS routing rules from outside the cluster to Services, based on host and path, which requires an Ingress controller to take effect.

A resource that selects Pods and declares which ingress and egress traffic is permitted, enforced by the CNI plugin; selected Pods become isolated except for explicitly allowed flows.

A command that tunnels a local port to a port on a Pod or Service through the API server, useful for testing or debugging without exposing the workload publicly.