KCNA flashcards

Kubernetes Fundamentals

• A Pod is the smallest deployable unit; its containers share one network namespace (one IP) and can share volumes.
• The kube-apiserver is the front door: kubectl, the kubelet, and all controllers talk to the cluster only through it.
• etcd is the cluster's key-value datastore and single source of truth; only the API server reads and writes it directly.
• The kube-scheduler only picks a node for each Pod; the kubelet on that node actually starts the containers via the runtime.
• A ReplicaSet keeps N identical Pods alive; a Deployment manages ReplicaSets to add rolling updates and rollbacks.
• A Service gives a stable virtual IP and DNS name to an ever-changing set of Pods selected by labels.
• Namespaces scope names, access, and quotas; labels plus selectors are the glue that connects Services and controllers to Pods.
• Kubernetes is declarative: controllers continuously reconcile observed state toward the desired state stored in etcd, which is what self-healing means.

• Every kubectl command is an HTTPS request to the kube-apiserver; kubectl never talks to nodes or etcd directly.
• kubectl apply is declarative and idempotent; create, run, scale, and expose are imperative one-off commands with no file as source of truth.
• A Role grants permissions inside one namespace; a ClusterRole grants them cluster-wide or on cluster-scoped resources like nodes.
• RoleBindings and ClusterRoleBindings attach a Role or ClusterRole to subjects: users, groups, or ServiceAccounts.
• RBAC is additive and allow-only: there are no deny rules, and anything not explicitly granted is forbidden.
• ServiceAccounts are the API identities of workloads; users and groups represent humans and are not Kubernetes API objects.
• A ResourceQuota caps a namespace's total consumption; a LimitRange sets per-container defaults, minimums, and maximums.
• Namespaces scope names, access, and quotas, but they do not isolate the network - that requires NetworkPolicies.

• The kube-scheduler works in two phases: filter out infeasible nodes, then score the feasible ones and bind the Pod to the winner.
• Requests drive scheduling and reserve capacity; limits are enforced at runtime and play no part in placement.
• A container over its CPU limit is throttled; one over its memory limit is OOMKilled.
• Affinity and nodeSelector attract Pods to nodes; taints repel Pods; a toleration permits but never forces placement on a tainted node.
• requiredDuringScheduling rules are hard filters; preferredDuringScheduling rules only influence scoring and can be ignored.
• NoExecute is the only taint effect that evicts already-running Pods; NoSchedule only blocks new ones.
• A DaemonSet runs exactly one Pod on every eligible node; new nodes get the Pod automatically.
• A Pod stays Pending when no single node passes filtering; kubectl describe pod shows the reason in its events.

• A container is an isolated process on a shared host kernel: namespaces control what it sees, cgroups control what it uses.
• Containers virtualize the operating system; VMs virtualize the hardware and each carry their own guest kernel.
• Images are immutable stacks of read-only layers; tags are mutable pointers, digests are immutable content hashes.
• The kubelet drives the container runtime through the CRI; containerd and CRI-O are the mainstream CRI runtimes, and both delegate to runc.
• Kubernetes deprecated the Dockershim in 1.20 and removed it in 1.24; Docker-built images still run because they are OCI images.
• The OCI publishes the image, runtime and distribution specs; runc is the reference runtime implementation.
• Podman is a daemonless, rootless-friendly alternative to Docker with a compatible CLI, producing the same OCI images.
• Containers in one Pod share a network namespace and one IP, talking to each other over localhost.

Container Orchestration

• Every Pod gets its own IP address, and Pods communicate across nodes without NAT; that flat model is implemented by the CNI plugin, not by Kubernetes itself.
• A Service provides a stable virtual IP and DNS name in front of ephemeral Pods, selected by labels and tracked through EndpointSlices.
• kube-proxy runs on every node and programs iptables or IPVS rules that make Service IPs deliver traffic to real Pod endpoints.
• ClusterIP is internal-only and the default; NodePort opens a high port (30000-32767) on every node; LoadBalancer provisions a cloud load balancer on top of NodePort.
• A headless Service (clusterIP: None) returns Pod IPs directly in DNS; ExternalName returns a CNAME to an outside hostname.
• CoreDNS resolves names like api.shop.svc.cluster.local; short names work within the same namespace.
• Ingress defines layer 7 host and path routing but does nothing without an Ingress controller; the Gateway API is its emerging successor.
• Pods are default-allow until a NetworkPolicy selects them; then everything not explicitly allowed in the covered direction is denied, and enforcement requires a CNI plugin that supports policies.

• The 4Cs are Cloud, Cluster, Container, Code: nested layers of defense in depth, where each inner layer depends on the security of the layers outside it.
• RBAC is additive and allow-only: Roles and ClusterRoles grant verbs on resources, bindings attach them to subjects, and anything not granted is denied.
• A ServiceAccount is a Pod's API identity; give workloads dedicated minimal ServiceAccounts and disable token automounting when the API is not needed.
• Secrets are base64-encoded, not encrypted, by default; enable encryption at rest with an EncryptionConfiguration and restrict Secret access with RBAC.
• PodSecurityPolicy was removed in Kubernetes 1.25; Pod Security Admission enforces the Privileged, Baseline, and Restricted standards via namespace labels in enforce, audit, or warn mode.
• Core securityContext hardening: runAsNonRoot, allowPrivilegeEscalation: false, readOnlyRootFilesystem, drop ALL capabilities, and a RuntimeDefault seccomp profile.
• NetworkPolicies convert default-allow networking into explicit allow-lists that block lateral movement, and are enforced by the CNI plugin.
• Supply chain security means scanning images for CVEs, signing them for provenance, keeping an SBOM, and using minimal base images from trusted registries.

• The five Pod phases are Pending, Running, Succeeded, Failed, and Unknown; the STATUS column of kubectl get pods shows more specific reasons like CrashLoopBackOff.
• ImagePullBackOff means the image cannot be pulled (bad name, tag, or credentials); CrashLoopBackOff means the image ran but the container keeps exiting.
• OOMKilled means the container exceeded its memory limit and was killed, classically with exit code 137.
• kubectl describe ends with the Events section, where scheduling failures (FailedScheduling), mount failures (FailedMount), and probe failures (Unhealthy) are recorded.
• kubectl logs --previous shows output from the last terminated container instance, the key to diagnosing a crash loop; -c selects a container in multi-container Pods.
• A failing liveness probe restarts the container; a failing readiness probe only removes the Pod from Service endpoints; a startup probe delays both for slow-booting apps.
• A Service with no endpoints usually means its label selector matches no Pods or the matching Pods are not ready.
• A NotReady node means the kubelet stopped reporting healthy; describe node shows MemoryPressure, DiskPressure, and PIDPressure conditions.

• A Volume is declared in the Pod spec and (for ephemeral types like emptyDir) lives and dies with the Pod; emptyDir survives container restarts but not Pod deletion.
• PersistentVolumes are the cluster-scoped supply of storage; PersistentVolumeClaims are namespaced requests that bind to them one-to-one, and Pods reference the claim, never the PV.
• The four access modes are ReadWriteOnce (RWO), ReadOnlyMany (ROX), ReadWriteMany (RWX), and ReadWriteOncePod (RWOP).
• ReadWriteOnce limits the volume to one node, not one Pod; only ReadWriteOncePod guarantees a single Pod, and it requires CSI.
• Reclaim policy Retain keeps the PV and its data (status Released, manual cleanup); Delete removes the PV and the underlying storage, and is typical for dynamically provisioned volumes.
• A StorageClass defines a provisioner and parameters; a PVC referencing it triggers dynamic provisioning, and a default class serves PVCs that specify none.
• CSI is the standard interface storage vendors implement, alongside CRI for runtimes and CNI for networking; it replaced in-tree volume plugins.
• StatefulSet volumeClaimTemplates create one PVC per replica (like data-db-0), and those PVCs are kept by default when Pods are rescheduled or scaled down.

Cloud Native Application Delivery

• RollingUpdate is the default Deployment strategy; Recreate stops all old Pods first and causes downtime
• Blue-green and canary are patterns, not strategy field values; canary traffic splitting typically needs a service mesh or Argo Rollouts
• kubectl rollout status watches a Deployment rollout and kubectl rollout undo rolls back to the previous revision
• GitOps keeps desired state in Git and an in-cluster controller pulls and reconciles it; Argo CD and Flux are the graduated CNCF GitOps tools
• In GitOps, deploys are merges and rollback is git revert; manual cluster edits show up as drift and are reconciled away
• A Helm chart plus values produces a release; helm upgrade and helm rollback move a release between numbered revisions
• Kustomize customizes plain YAML with bases and overlays, no templates, and runs via kubectl apply -k
• CI push model: the pipeline holds cluster credentials and applies changes; GitOps pull model: the agent inside the cluster fetches from Git

• A rolling update only progresses as new Pods pass readiness probes; a bad release stalls while the old ReplicaSet keeps serving
• kubectl rollout status hangs on a stuck rollout; kubectl get replicasets shows the telltale two-ReplicaSet picture
• ProgressDeadlineExceeded (default progressDeadlineSeconds 600) marks Progressing=False but Kubernetes never rolls back automatically
• Bad image tags show as ImagePullBackOff; failing readiness probes show Running but 0/1 Ready; capacity problems show Pending
• kubectl rollout undo returns to a previous revision; revisionHistoryLimit (default 10) bounds how many old ReplicaSets are kept, and 0 disables rollback
• helm history shows revision states (deployed, superseded, failed, pending-upgrade) and helm rollback recovers a failed release
• helm upgrade --atomic auto-rolls-back on failure; without --wait, Helm can report success while the underlying rollout is stuck
• After any deploy, verify with observability signals: error rate and latency against the pre-deploy baseline, and logs from the new Pods

Cloud Native Architecture

• Metrics measure trends over time, logs record discrete events, traces follow one request across services.
• Prometheus pulls metrics by scraping HTTP endpoints and stores them as labeled time series queried with PromQL.
• Alertmanager, not Prometheus itself, deduplicates, groups, and routes alert notifications.
• metrics-server powers kubectl top and the HPA with current CPU and memory only; it keeps no history and is not Prometheus.
• Containers log to stdout and stderr; a node-level DaemonSet agent like Fluentd or Fluent Bit ships logs to a central store.
• OpenTelemetry is vendor-neutral telemetry instrumentation; Jaeger is a backend that stores and visualizes traces.
• Prometheus, Fluentd, and Jaeger are CNCF graduated projects; exporters adapt third-party systems to Prometheus.
• Comparing requested resources with actual usage metrics is how you right-size workloads and control cluster cost.

• The CNCF definition names five techniques: containers, service meshes, microservices, immutable infrastructure, and declarative APIs.
• Cloud native systems aim to be loosely coupled, resilient, manageable, and observable, with change driven by automation.
• Microservices trade operational complexity for independent scaling, deployment, and team autonomy; monoliths are simpler to run and debug.
• Immutable infrastructure means replace, not patch: ship a new container image instead of modifying a running instance.
• Declarative APIs express desired state; reconciliation loops continuously drive actual state toward it, which enables self-healing.
• HPA scales Pod replicas, VPA right-sizes Pod requests, Cluster Autoscaler changes node count, and KEDA scales on events down to zero.
• Serverless means no server management and scale-to-zero; Knative brings request-driven and event-driven serverless to Kubernetes.
• CNCF projects mature from sandbox to incubating to graduated; Kubernetes was the first CNCF project and Prometheus the second.

• The CNCF is a project of the Linux Foundation and a vendor-neutral home for cloud native open source; Kubernetes was its first hosted project.
• CNCF projects have exactly three maturity levels, in order: Sandbox, Incubating, Graduated.
• Sandbox means early and experimental; Incubating means growing with real production users; Graduated means stable, widely adopted, and production-ready.
• The Technical Oversight Committee (TOC) governs project acceptance and advancement between maturity levels.
• Kubernetes was the first CNCF project to reach Graduated status.
• The CNCF landscape maps the ecosystem into functional categories and shows each hosted project's maturity level.
• Kubernetes organizes community work through Special Interest Groups (SIGs), each owning an area like network, storage, or security.
• Contributors help a project, maintainers lead it, end users run it in production, vendors sell around it, and ambassadors advocate for it.

Yes — the whole KCNA deck is free and needs no account. Create a free account only if you want to save progress and drill full practice questions and mock exams.