KLCP cheat sheet

A Pod is the smallest deployable unit; containers in a Pod share network namespace and can share volumes.

kubectl get pods -o wide shows node placement and Pod IP; kubectl describe pod shows events and container statuses.

Namespaces partition cluster resources; most resources are namespaced, but Node, PersistentVolume, and Namespace are cluster-scoped.

Labels are key/value pairs for selection; annotations store non-identifying metadata and cannot be used for selection.

A Deployment manages ReplicaSets, which manage Pods; rolling updates are governed by maxSurge and maxUnavailable.

ConfigMaps and Secrets inject configuration as env vars or volume files; Secrets are base64-encoded, not encrypted by default.

Service types: ClusterIP (internal), NodePort (static port on each node), LoadBalancer (external LB), ExternalName (CNAME).

Resource requests affect scheduling; limits enforce CPU throttling and memory OOM-kill at runtime.

kubectl apply is declarative and records last-applied-configuration; kubectl create is imperative and fails if the object exists.

The scheduler binds Pods to Nodes based on requests, node selectors, affinity/anti-affinity, and taints/tolerations.

Taints repel Pods from nodes; tolerations allow Pods onto tainted nodes but do not guarantee placement.

Liveness probes restart unhealthy containers; readiness probes remove Pods from Service endpoints; startup probes protect slow-starting apps.

Horizontal Pod Autoscaler scales replicas based on metrics (CPU, memory, custom); requires metrics-server or an adapter.

A DaemonSet runs one Pod per eligible node; a StatefulSet provides stable network identity and ordered deployment.

PersistentVolumeClaims request storage; the PV controller binds a matching PV; StorageClasses enable dynamic provisioning.

PodDisruptionBudgets limit voluntary disruptions (e.g., during drains) by specifying minAvailable or maxUnavailable.

kubectl cordon marks a node unschedulable; kubectl drain evicts Pods and cordons the node.

NetworkPolicies are additive allow-lists; if no policy selects a Pod, all traffic is allowed by default.

A CI pipeline builds and tests artifacts; a CD pipeline deploys them; GitOps uses Git as the source of truth for desired state.

Container images are immutable and identified by digest; tags are mutable references and should be pinned for reproducibility.

Helm charts package Kubernetes manifests; values.yaml overrides defaults; helm upgrade --install is idempotent.

Kustomize overlays patch base manifests without templates; kubectl apply -k applies a kustomization directory.

Blue-green deployment runs two environments and switches traffic; canary releases shift a percentage of traffic gradually.

A Service mesh (e.g., Istio, Linkerd) provides mTLS, traffic splitting, retries, and observability via sidecars or ambient mode.

Ingress exposes HTTP(S) routes to Services; an Ingress controller (e.g., NGINX, Traefik) implements the rules.

Immutable infrastructure replaces rather than mutates running instances; rolling updates are the Kubernetes default strategy.

Supply chain security includes image signing (cosign), SBOMs, and admission policies that verify provenance.

The Twelve-Factor App: config in environment, stateless processes, logs as event streams, disposability, and dev/prod parity.

Microservices decompose by business capability; each service owns its data and communicates via APIs or events.

The sidecar pattern attaches a helper container to a Pod; the ambassador and adapter patterns proxy or translate external interfaces.

The operator pattern encodes operational knowledge in a custom controller watching CustomResourceDefinitions.

Loose coupling uses asynchronous messaging (queues, event buses) to decouple producers and consumers.

Resilience patterns include circuit breaking, retries with backoff, timeouts, bulkheads, and graceful degradation.

Observability rests on metrics, logs, and traces; OpenTelemetry standardizes instrumentation and export.

Stateless services scale horizontally; stateful services require stable identity and persistent storage (StatefulSet).

Serverless/FaaS abstracts infrastructure; cold starts and execution time limits are key architectural constraints.