KCNA cheat sheet

kube-apiserver is the only component that reads and writes etcd directly; every other control-plane component and client goes through it.

etcd is a distributed key-value store holding all cluster state; losing quorum (a majority of members) makes the cluster effectively read-only and unable to accept writes.

kube-scheduler assigns Pods to Nodes by filtering feasible nodes and then scoring them; the scheduler never starts containers itself.

kubelet runs on every node, watches the API server for PodSpecs bound to its node, starts containers through the CRI, and reports status.

kube-proxy programs node networking rules (iptables or IPVS) that implement Service virtual IPs and load balancing.

Pod is the smallest deployable unit; containers in one Pod share a network namespace and IP and may share volumes, but not a filesystem by default.

Deployment manages ReplicaSets with rolling updates and rollback; StatefulSet provides stable identity and ordered rollout; DaemonSet runs one Pod per eligible node.

Service types: ClusterIP (internal virtual IP), NodePort (default range 30000-32767), LoadBalancer (external load balancer), ExternalName (DNS CNAME, no proxying).

Requests determine scheduling placement and guaranteed resources; limits set the cgroup ceiling, so exceeding a memory limit causes OOMKill while exceeding a CPU limit causes throttling.

A container packages an application with its dependencies and shares the host kernel; a virtual machine runs a full guest OS on a hypervisor.

OCI specifies the image format, runtime spec, and distribution API; containerd and CRI-O are CRI-compatible runtimes that implement it.

Image layers are read-only and content-addressed, so identical layers are cached and shared between images; a writable layer exists only at container runtime.

CRI decouples kubelet from runtimes, CNI provides pod networking, and CSI provides storage - three pluggable interfaces of Kubernetes.

Horizontal Pod Autoscaler changes replica count from observed metrics; Vertical Pod Autoscaler adjusts requests and limits; Cluster Autoscaler adds or removes nodes.

The ReplicaSet controller reconciles desired versus actual replica count, which is the mechanism behind Kubernetes self-healing.

RollingUpdate replaces Pods incrementally honoring maxSurge and maxUnavailable; Recreate terminates all Pods before creating replacements, causing downtime.

Liveness probes restart a failing container, readiness probes remove a Pod from Service endpoints, and startup probes guard slow-starting containers from liveness checks.

Helm packages manifests into charts with templating, default values, and release tracking; Kustomize instead patches a shared base with overlays and no templating.

GitOps uses a Git repository as the source of truth and an in-cluster agent (Argo CD or Flux) to reconcile live state and detect or revert drift.

Blue-green keeps two identical environments and flips traffic at once; canary sends a small traffic share to the new version and ramps up after metric gates pass.

CI builds and tests artifacts; CD delivers them - repeatable delivery requires versioned, declarative manifests applied the same way to every environment.

Immutable tags (git SHA or image digest) make a deployment reproducible and rollback deterministic; the mutable latest tag does not.

Progressive delivery automates canary or blue-green rollouts by analyzing metrics and triggering rollback when thresholds are breached.

kubectl apply is declarative: the desired state is stored in the API server and controllers converge toward it, unlike imperative create or run commands.

A release artifact should be promoted unchanged across environments; rebuilding per environment breaks the guarantee that tested bits are what runs in production.

CNCF hosts the cloud native landscape and grades projects as sandbox, incubating, or graduated; Kubernetes, Prometheus, Envoy, and containerd are graduated.

Twelve-factor principles: config in environment variables, stateless processes, disposability, dev/prod parity, explicit dependencies, and logs as event streams.

Microservices replace in-process calls with network calls, adding latency, partial failure, and duplicate delivery that callers must handle with retries and timeouts.

A service mesh (Istio, Linkerd) moves mTLS, retries, traffic splitting, and telemetry into proxies so application code stays unaware.

Observability rests on three pillars - metrics, logs, and traces - and traces are what connect a single request across service boundaries.

Asynchronous messaging (queues, event buses) decouples producer and consumer lifetimes, but at-least-once delivery forces consumers to be idempotent.

CAP theorem: under a network partition a distributed store must choose consistency or availability; partition tolerance is unavoidable in real networks.

Serverless platforms scale to zero, trading idle cost for cold-start latency on the first request after an idle period.

Autoscaling has three independent axes: replicas (HPA), per-pod resources (VPA), and nodes (Cluster Autoscaler), and each addresses a different bottleneck.