Compute (Server, Kubernetes Service, Container Registry)
Domain 2 - Compute
This domain covers virtual machines, managed Kubernetes (NKS) and the private image registry. Expect questions on bootstrapping a server (login key, init script, image), resizing and snapshots, and on how NKS clusters sit inside a VPC.
Core rules
- A Server is created from a server image; the login key (SSH key pair) is injected at creation, and the init script runs once at first boot - use it for package installs and agent registration, not for secrets.
- Changing the server specification (vCPU/memory) requires stopping the server. Block storage can be expanded while attached, but the filesystem must be grown inside the OS.
- NKS manages the control plane; you own node pools. Node pools are placed on VPC subnets, so private node pools need a NAT Gateway (or private endpoints) to pull public images and reach external registries.
- Container Registry is a private registry; authenticate with an access key or registry token and create an image pull secret for pods.
- Autoscaling works at two levels: node pool autoscaling for NKS and Auto Scaling groups for plain Servers, both driven by policies.
Worked example
A private NKS node pool hangs in ImagePullBackOff. Reasoning: the node has no route to the internet, so it cannot reach the public registry. Two correct fixes: push the image to Container Registry (private, reachable inside the VPC) and add a pull secret, or attach a NAT Gateway to the node subnet. Adding an Internet Gateway to the private subnet is not the fix - it breaks the intended isolation.
Traps
- Deleting a whole cluster when only a node pool needed recycling.
- Forgetting that ACG rules must allow node traffic and the load balancer health check.
- Injecting passwords through an init script that then sits in instance metadata.