KCA key terms

The smallest deployable unit in Kubernetes: one or more containers that share a network namespace, IP address, and mounted volumes, and are always scheduled together onto the same node.

A virtual partition inside a cluster that scopes names of objects and supports quotas, RBAC rules, and network policies, letting multiple teams or environments share one control plane.

A controller that maintains a specified number of identical Pod replicas, replacing any that fail or are deleted; it uses label selectors to identify the Pods it owns.

A higher-level controller that manages ReplicaSets to provide declarative rolling updates, rollbacks, and scaling for stateless applications, tracking revision history for each change.

A controller for workloads needing stable identity: each Pod gets a predictable ordinal name, its own persistent storage, and ordered creation and deletion, suitable for databases and clustered systems.

A controller that ensures one copy of a Pod runs on every eligible node, or a chosen subset, commonly used for log shippers, monitoring agents, and CNI or storage node components.

A query over key/value labels that determines which objects a controller, Service, or policy applies to; supports equality-based and set-based matching, and is central to loose coupling in Kubernetes.

Non-identifying key/value metadata attached to an object for tooling and humans, such as build information or ingress configuration; unlike labels, annotations cannot be used in selectors.

The front end of the control plane: it validates and serves the REST API, performs authentication and authorization, and is the only component that talks directly to etcd.

A distributed key/value store that holds the entire cluster state; it is the source of truth, so quorum, backup, and latency of etcd directly determine cluster reliability.

The control-plane component that assigns newly created Pods to nodes by filtering out unsuitable nodes and then scoring the rest against priorities, affinity rules, and resource availability.

The node agent that watches for Pods assigned to its node, starts and monitors containers through the container runtime, runs probes, and reports node and Pod status to the API server.

A node component that programs the host's packet handling (iptables, IPVS, or nftables mode) so traffic to Service virtual IPs is load-balanced to healthy backend Pods.

The gRPC contract between kubelet and container runtimes such as containerd or CRI-O, allowing runtimes to be swapped without changing Kubernetes itself; dockershim's removal made this mandatory.

The software on each node that pulls images and creates, starts, and stops containers, typically containerd or CRI-O, configured through a runtime class and CRI socket path.

A Pod defined by a manifest file in the kubelet's configured directory rather than through the API server; kubelet manages it directly and the API server shows a mirror copy.

The official bootstrapping tool that initializes a control plane, joins nodes with generated tokens, and manages certificate renewal and cluster upgrades in phases.

A machine, physical or virtual, registered in the cluster that runs Pods; its status includes conditions such as Ready, MemoryPressure, and DiskPressure, plus capacity and allocatable resources.

A file describing clusters, users, and contexts used by kubectl and client libraries; the current context selects which cluster, credentials, and default namespace a command uses.

An object holding non-secret configuration as key/value pairs or files, consumed by Pods through environment variables, command-line arguments, or mounted volumes that update over time.

An object for sensitive data such as passwords and tokens; values are base64-encoded rather than encrypted by default, so encryption at rest and strict RBAC are required for real protection.

A namespaced identity for processes running in Pods, used by the API server to authenticate them; projected tokens are time-bound and audience-scoped in current versions.

The authorization system that grants permissions by binding subjects to Roles or ClusterRoles; verbs apply to resources, and rules are additive, with no deny rules.

A stable virtual IP and DNS name that load-balances traffic to a set of Pods chosen by a label selector, decoupling clients from Pod churn and individual Pod addresses.

The object holding the actual IP addresses and ports of Pods backing a Service; slices are capped in size and labeled so kube-proxy and other consumers can scale to large Services.

An API object declaring HTTP and HTTPS routing rules from outside the cluster to Services; it requires an Ingress controller, such as NGINX or Traefik, to actually implement the rules.

A namespaced firewall rule set selecting Pods and specifying allowed ingress and egress traffic by peer selector, namespace, or CIDR; enforcement depends on the CNI plugin supporting it.

The networking implementation that assigns Pod IPs and routes traffic between nodes, for example Calico, Cilium, or Flannel; the choice determines whether NetworkPolicy is enforced.

A namespaced request for storage with a size and access mode; it binds to a matching PersistentVolume or triggers dynamic provisioning through a StorageClass.

A cluster-scoped template describing how to dynamically provision volumes, including the provisioner, parameters, reclaim policy, and volume binding mode used by claims that reference it.

The amount of CPU and memory a container is guaranteed and that the scheduler reserves on a node when placing the Pod; sums of requests drive scheduling decisions.

The maximum CPU and memory a container may use; exceeding memory causes an OOM kill, while exceeding CPU causes throttling, so limits and requests should be tuned together.

A derived Pod classification (Guaranteed, Burstable, or BestEffort) based on requests and limits, which determines the order in which Pods are evicted under node pressure.

A node taint repels Pods unless a Pod declares a matching toleration; used to reserve nodes for specific workloads or to keep Pods off unhealthy or dedicated nodes.

A Pod-level rule that constrains scheduling to nodes with particular labels, expressed as required or preferred expressions; it attracts Pods rather than repelling them like taints.

A periodic check that tells kubelet whether a container is still healthy; repeated failures restart the container according to its restart policy, so it should not test dependencies.

A check that determines whether a container should receive traffic; failing Pods are removed from Service endpoints without restarting, which protects clients during startup and overload.

A probe that disables liveness and readiness checks until a slow-starting application succeeds once, preventing premature restarts; after success, normal probes take over.

Maintenance operations: cordon marks a node unschedulable, and drain evicts its Pods while respecting PodDisruptionBudgets, commonly run before upgrades or node repair.

A plugin in the API server request path that can mutate or reject objects after authentication and authorization, enforcing policies such as quotas, pod security, and defaulting.