Container Orchestration
Orchestration turns a pool of nodes into one scheduling surface. This domain tests Kubernetes primitives and the kubectl workflow: how control-plane components cooperate, how workloads are declared and rolled out, how Services find Pods, and how configuration and storage reach containers.
Control plane and nodes
- kube-apiserver is the only component that talks to etcd; every other component watches the API.
- kube-scheduler binds unscheduled Pods to nodes based on requests and constraints.
- kube-controller-manager runs reconciliation loops (ReplicaSet, Node, Endpoint, and so on).
- On each node, kubelet drives the runtime through the CRI (containerd, CRI-O), and kube-proxy programs Service rules with iptables or IPVS.
Objects and rules
- A Deployment owns ReplicaSets, which own Pods through ownerReferences. Scale and roll out on the Deployment:
kubectl rollout status,kubectl rollout undo. - Service types: ClusterIP is the internal VIP only; NodePort opens 30000–32767 on every node; LoadBalancer requests a cloud LB; ExternalName is a CNAME.
- Endpoints are filled from the selector matching Pods that are Ready, so a failing readiness probe empties a Service even when Pods are Running.
- StatefulSet gives stable names and per-Pod PVCs via volumeClaimTemplates; DaemonSet runs one Pod per node; Job and CronJob handle batch work.
Worked example
A Service times out although its Pods are Running. kubectl get endpoints my-svc shows <none>, which means the selector matched no Ready Pods. Compare kubectl get pods --show-labels with kubectl describe svc my-svc, then check the readiness probe: a Pod that is Running but not Ready is excluded. Finally confirm targetPort matches the port the process actually listens on, verified with kubectl port-forward pod/... 8080:80 and a local request. The reasoning is that Service routing is a label plus readiness plus port chain, and any broken link yields an empty endpoint list.
Traps that cost marks
- Deleting a Deployment cascades to its Pods; deleting a StatefulSet leaves PVCs behind by default.
- A ClusterIP is not routable from outside the cluster, and NodePort does not change the service port inside the Pod.
- ConfigMap updates never refresh environment variables, and mounted files update only eventually.
- Manifests without a namespace land in
default, not the context's last-used namespace.