KCA flashcards
KCA · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Pod
- Smallest deployable unit in Kubernetes; one or more containers sharing a network namespace, IPC namespace, and volumes, scheduled together on a single node.
- ReplicaSet
- Controller that maintains a stable set of identical Pods matching a selector; usually managed indirectly by a Deployment rather than created by hand.
- Service ClusterIP
- Default Service type that allocates a virtual IP reachable only inside the cluster; kube-proxy DNATs traffic to selected ready Pods.
- ConfigMap vs Secret
- ConfigMap stores non-confidential key-value data; Secret stores base64-encoded data intended to be restricted, optionally encrypted at rest via EncryptionConfiguration.
- Resource requests vs limits
- Requests are used by the scheduler to place Pods; limits are enforced at runtime, causing CPU throttling or memory OOMKill when exceeded.
- kubeadm init
- Bootstraps a control plane: generates certificates and kubeconfigs, starts static Pods for etcd, kube-apiserver, controller-manager and scheduler, then installs addons.
- bootstrap token
- Short-lived credential stored as a Secret in kube-system that lets a new node join the cluster via kubeadm join; default TTL is 24 hours.
- kubeadm certs check-expiration
- Command that reports expiry dates for all control plane certificates; leaf certificates default to one year and are renewed with kubeadm certs renew all.
- CNI plugin requirement
- Cluster networking is not functional until a CNI plugin is installed; without it nodes remain NotReady and CoreDNS Pods stay pending.
- kubeconfig precedence
- The --kubeconfig flag wins over the KUBECONFIG environment variable, which wins over $HOME/.kube/config; KUBECONFIG may list multiple files to merge.
- RBAC allow-only model
- Authorization is purely additive: a request is permitted if any Role or ClusterRole binding grants it; there are no explicit deny rules.
- ClusterRole vs Role
- Role grants permissions within one namespace; ClusterRole grants cluster-scoped permissions or can be bound into a namespace via RoleBinding.
- Pod Security Admission
- Built-in admission controller enforcing privileged, baseline, or restricted profiles per namespace using pod-security.kubernetes.io labels for enforce, audit, and warn.
- ServiceAccount token projection
- Modern clusters mount short-lived bound tokens with audience and expiry that rotate automatically, replacing legacy long-lived Secret-based tokens.
- NetworkPolicy default deny
- A policy selecting all Pods with an empty podSelector and both Ingress and Egress policyTypes, with no rules, blocks all traffic until allows are added.
- CoreDNS service name
- Cluster DNS is served by CoreDNS, exposed as Service kube-dns in kube-system; Pods resolve names like service.namespace.svc.cluster.local.
- Headless Service
- Service with clusterIP None; DNS returns individual Pod IPs instead of a virtual IP, giving StatefulSets stable per-Pod DNS names.
- NodePort range
- Default range 30000-32767, configurable via the API server's --service-node-port-range flag; kube-proxy opens the port on every node.
- Ingress controller
- Ingress objects are only routing rules; an Ingress controller such as ingress-nginx must run in the cluster to implement L7 HTTP and TLS routing.
- externalTrafficPolicy Local
- Service setting that routes only to Pods on the receiving node and preserves client source IP, at the cost of uneven load distribution.
- CrashLoopBackOff
- Pod state where a container exits repeatedly and the kubelet restarts it with exponential backoff; inspect with kubectl logs --previous.
- ImagePullBackOff
- Pod state caused by a failed image pull: wrong tag, private registry without imagePullSecrets, or node unable to reach the registry.
- Pending due to unschedulable
- Pod state where kubectl describe reports 0/N nodes available, typically from insufficient resources, affinity mismatch, taints, or an unbound PVC.
- NoExecute taint
- Taint effect that evicts already-running Pods lacking a matching toleration, unlike NoSchedule which only blocks new placements.
- kubectl debug ephemeral container
- Attaches a temporary container to a running Pod with --target to share its process namespace, without restarting the Pod.
- Deployment RollingUpdate
- Default strategy replacing Pods gradually using maxSurge and maxUnavailable percentages, both defaulting to 25 percent of the desired replica count.
- StatefulSet guarantees
- Provides stable ordinal Pod names, ordered create and delete, and per-Pod PersistentVolumeClaims via volumeClaimTemplates; requires a headless Service.
- DaemonSet
- Controller that runs exactly one Pod per eligible node, commonly used for CNI agents, log shippers, and node monitoring.
- Taints and tolerations
- Node-side taints repel Pods unless the Pod declares a matching toleration; a toleration permits but does not force scheduling onto that node.
- QoS classes
- Guaranteed when requests equal limits for every container; Burstable when some differ; BestEffort when no requests or limits are set.
- PodDisruptionBudget
- Object limiting voluntary disruptions during drain using minAvailable or maxUnavailable; it does not protect against node failure or involuntary eviction.
- HorizontalPodAutoscaler
- Controller that adjusts replica counts from observed metrics such as CPU utilization; it requires resource requests to compute utilization percentages.