Containerization and Kubernetes Orchestration
What the exam tests
Containerization and Kubernetes Orchestration tests image hygiene, pod lifecycle, scheduling, networking, and safe rollouts. Expect Deployments, Services, Ingress, ConfigMaps and Secrets, probes, HPA, PDB, and RBAC.
Core rules
- Build minimal images from trusted base images, pin digests, run as non-root, and scan for CVEs.
- Readiness probes gate traffic; liveness probes restart stuck containers. An over-aggressive liveness probe causes restart loops.
- Set resource requests and limits; without them the scheduler cannot place pods predictably and noisy neighbors appear.
- Use Deployments for stateless apps, StatefulSets for stable identity, and Jobs for batch. NetworkPolicies default-deny east-west traffic.
Worked example
A Deployment runs three replicas. Add a readiness probe on /healthz (period 5s, failure threshold 3) and a liveness probe on /livez (initial delay 30s). Add a PodDisruptionBudget minAvailable: 2 and an HPA targeting 70% CPU. Reasoning: readiness keeps traffic off warming pods; liveness restarts only truly dead processes; the PDB preserves quorum during node drains; the HPA adds pods as CPU approaches the target.
Traps
Using the latest tag in production. No resource limits leading to OOM kills or node pressure. Confusing readiness and liveness. Missing PDBs during cluster upgrades. Granting cluster-admin to workloads.