Kubernetes

Index

• 1. Introduction to Kubernetes
  • 1.1 Container Orchestration Fundamentals
    • What is Container Orchestration
    • Problems Solved by Orchestration
    • Evolution from VMs to Containers to Orchestration
    • Kubernetes vs Docker Swarm vs Nomad
  • 1.2 Kubernetes Overview
    • History and Origin of Kubernetes
    • CNCF and the Kubernetes Ecosystem
    • Kubernetes Use Cases and Adoption
    • Kubernetes Release Cycle and Versioning
  • 1.3 Core Concepts and Terminology
    • Clusters, Nodes, and Pods
    • Control Plane vs Data Plane
    • Declarative vs Imperative Model
    • Desired State and Reconciliation Loop
• 2. Kubernetes Architecture
  • 2.1 Control Plane Components
    • kube-apiserver
    • etcd as the cluster store
    • kube-scheduler
    • kube-controller-manager
    • cloud-controller-manager
  • 2.2 Worker Node Components
    • kubelet
    • kube-proxy
    • Container runtime interface (CRI)
    • containerd and CRI-O
  • 2.3 Cluster Communication
    • API server as the central hub
    • Watch and event-driven updates
    • Authentication and authorization flow
    • Admission controllers pipeline
  • 2.4 Add-ons and Extensions
    • CoreDNS
    • Kubernetes Dashboard
    • Metrics Server
    • Container Network Interface (CNI) plugins
• 3. Setting Up Kubernetes
  • 3.1 Local Development Clusters
    • Minikube setup and usage
    • kind (Kubernetes in Docker)
    • k3s and k3d for lightweight clusters
    • Docker Desktop Kubernetes
  • 3.2 Production Cluster Provisioning
    • kubeadm cluster bootstrap
    • Managed Kubernetes: EKS, GKE, AKS
    • Bare-metal provisioning with kubespray
    • High availability control plane setup
  • 3.3 kubectl CLI
    • Installing and configuring kubectl
    • kubeconfig and context management
    • Basic kubectl commands
    • kubectl plugins and krew
• 4. Workload Resources
  • 4.1 Pods
    • Pod lifecycle and phases
    • Single-container vs multi-container pods
    • Init containers
    • Sidecar containers
    • Pod spec anatomy
    • Ephemeral containers for debugging
  • 4.2 ReplicaSets and Deployments
    • ReplicaSet purpose and behavior
    • Deployment creation and management
    • Rolling updates and rollbacks
    • Deployment strategies (Recreate, RollingUpdate)
    • Pausing and resuming deployments
  • 4.3 StatefulSets
    • StatefulSet use cases
    • Stable network identities
    • Ordered pod creation and deletion
    • Persistent storage with StatefulSets
    • Headless services for StatefulSets
  • 4.4 DaemonSets
    • DaemonSet use cases
    • Node-level workloads
    • DaemonSet update strategies
    • Tolerations with DaemonSets
  • 4.5 Jobs and CronJobs
    • Job types: non-parallel, parallel, indexed
    • Job completion and backoff policies
    • CronJob scheduling syntax
    • ConcurrencyPolicy and history limits
• 5. Configuration and Secrets Management
  • 5.1 ConfigMaps
    • Creating ConfigMaps from literals, files, and directories
    • Consuming ConfigMaps as environment variables
    • Consuming ConfigMaps as volumes
    • ConfigMap update propagation
  • 5.2 Secrets
    • Secret types and use cases
    • Creating and managing Secrets
    • Consuming Secrets in pods
    • Encryption at rest for Secrets
    • External secret management (Vault, AWS Secrets Manager)
  • 5.3 Environment Variables and Downward API
    • Setting static environment variables
    • Referencing ConfigMap and Secret keys
    • Downward API: exposing pod metadata
    • fieldRef and resourceFieldRef
• 6. Networking
  • 6.1 Kubernetes Networking Model
    • Pod-to-pod communication
    • Flat network model principles
    • CNI plugin overview (Calico, Flannel, Cilium)
    • IP address management (IPAM)
  • 6.2 Services
    • ClusterIP service
    • NodePort service
    • LoadBalancer service
    • ExternalName service
    • Headless services
    • Service discovery via DNS
    • Session affinity
  • 6.3 Ingress
    • Ingress resource and controllers
    • NGINX Ingress Controller
    • Path-based and host-based routing
    • TLS termination at Ingress
    • Ingress class and annotations
  • 6.4 Network Policies
    • Default allow vs deny behavior
    • Ingress and egress rules
    • Pod selector and namespace selector
    • Network policy enforcement with Calico/Cilium
  • 6.5 DNS in Kubernetes
    • CoreDNS configuration
    • Service DNS records
    • Pod DNS records
    • Custom DNS policies
• 7. Storage
  • 7.1 Volumes
    • Volume types: emptyDir, hostPath, configMap, secret
    • Volume lifecycle and pod coupling
    • Projected volumes
    • CSI volume plugins
  • 7.2 Persistent Volumes
    • PersistentVolume (PV) resource
    • PersistentVolumeClaim (PVC) resource
    • Access modes: ReadWriteOnce, ReadOnlyMany, ReadWriteMany
    • Reclaim policies: Retain, Delete, Recycle
    • Volume binding modes
  • 7.3 Storage Classes
    • Dynamic provisioning with StorageClasses
    • Provisioner types
    • Default StorageClass
    • Volume expansion
  • 7.4 Container Storage Interface (CSI)
    • CSI driver architecture
    • Popular CSI drivers (AWS EBS, GCE PD, NFS)
    • Volume snapshots and cloning
    • CSI ephemeral volumes
• 8. Scheduling and Resource Management
  • 8.1 Resource Requests and Limits
    • CPU and memory requests
    • CPU and memory limits
    • Quality of Service (QoS) classes
    • LimitRange for namespace defaults
  • 8.2 Scheduling Concepts
    • Scheduler workflow and phases
    • NodeSelector
    • Node affinity and anti-affinity
    • Pod affinity and anti-affinity
    • Topology spread constraints
  • 8.3 Taints and Tolerations
    • Tainting nodes
    • Toleration syntax and effects
    • NoSchedule, PreferNoSchedule, NoExecute
    • Use cases: dedicated nodes, GPU nodes
  • 8.4 Resource Quotas
    • ResourceQuota for namespaces
    • Compute and object count quotas
    • Quota scopes
    • Priority classes and PriorityLevelConfiguration
  • 8.5 Autoscaling
    • Horizontal Pod Autoscaler (HPA)
    • Vertical Pod Autoscaler (VPA)
    • Cluster Autoscaler
    • KEDA: event-driven autoscaling
    • Custom and external metrics
• 9. Security
  • 9.1 Authentication
    • X.509 client certificates
    • Bearer tokens and ServiceAccount tokens
    • OIDC integration
    • Webhook authentication
  • 9.2 Authorization
    • RBAC overview
    • Roles and ClusterRoles
    • RoleBindings and ClusterRoleBindings
    • ABAC and Webhook authorization
    • Least privilege principle
  • 9.3 Admission Control
    • Admission controller types
    • ValidatingAdmissionWebhook
    • MutatingAdmissionWebhook
    • OPA Gatekeeper
    • Kyverno policy engine
  • 9.4 Pod Security
    • Pod Security Admission (PSA)
    • Pod Security Standards: Privileged, Baseline, Restricted
    • SecurityContext: runAsUser, fsGroup, capabilities
    • AppArmor and Seccomp profiles
  • 9.5 Secrets and Supply Chain Security
    • Image signing and verification (cosign, Notary)
    • Admission policies for image registries
    • Falco for runtime threat detection
    • SBOM and vulnerability scanning
• 10. Observability
  • 10.1 Logging
    • kubectl logs and log streaming
    • Node-level logging architecture
    • Cluster-level logging patterns
    • Log aggregation with Fluentd, Fluent Bit, Loki
  • 10.2 Metrics and Monitoring
    • Metrics Server and resource metrics
    • Prometheus operator and ServiceMonitors
    • kube-state-metrics
    • Grafana dashboards for Kubernetes
    • Alertmanager and alerting rules
  • 10.3 Tracing
    • Distributed tracing concepts
    • OpenTelemetry in Kubernetes
    • Jaeger and Tempo integration
    • Instrumenting applications for tracing
  • 10.4 Health Probes
    • Liveness probes
    • Readiness probes
    • Startup probes
    • Probe types: HTTP, TCP, exec, gRPC
  • 10.5 Events and Auditing
    • Kubernetes events and their lifecycle
    • Audit policy configuration
    • Audit log backends
    • Tools: kubeaudit, kube-bench
• 11. Helm and Package Management
  • 11.1 Helm Fundamentals
    • Helm architecture and components
    • Charts, releases, and repositories
    • Installing and managing Helm
    • Helm vs Kustomize
  • 11.2 Working with Charts
    • Chart structure and anatomy
    • values.yaml and value overrides
    • Installing, upgrading, and rolling back releases
    • Helm templating with Go templates
    • Hooks and tests
  • 11.3 Creating and Publishing Charts
    • Scaffolding a new chart
    • Named templates and helpers
    • Subcharts and chart dependencies
    • Packaging and publishing to OCI registries
    • Chart Museum and Artifact Hub
  • 11.4 Kustomize
    • Kustomize overlays and bases
    • Patches: strategic merge and JSON6902
    • ConfigMap and Secret generators
    • Kustomize with kubectl
• 12. CI/CD and GitOps
  • 12.1 CI/CD Pipelines for Kubernetes
    • Building and pushing container images in CI
    • Deploying to Kubernetes from CI (GitHub Actions, GitLab CI)
    • Rolling deployments in pipelines
    • Canary and blue-green deployments
  • 12.2 GitOps Principles
    • GitOps core concepts
    • Git as the single source of truth
    • Pull-based vs push-based deployments
    • Reconciliation and drift detection
  • 12.3 Argo CD
    • Argo CD architecture
    • Application and AppProject resources
    • Sync policies and auto-sync
    • Multi-cluster deployments with Argo CD
    • Argo CD RBAC and SSO
  • 12.4 Flux CD
    • Flux v2 architecture
    • GitRepository, Kustomization, HelmRelease resources
    • Image automation with Flux
    • Multi-tenancy with Flux
• 13. Service Mesh
  • 13.1 Service Mesh Concepts
    • Why service meshes exist
    • Data plane vs control plane in a mesh
    • Sidecar proxy pattern
    • mTLS and service-to-service security
  • 13.2 Istio
    • Istio architecture and components
    • VirtualService and DestinationRule
    • Traffic management and load balancing
    • Observability with Istio (Kiali, Jaeger)
    • Istio security policies
  • 13.3 Linkerd
    • Linkerd architecture and design philosophy
    • Installing and configuring Linkerd
    • Automatic mTLS
    • Linkerd observability features
  • 13.4 Cilium Service Mesh
    • eBPF-based networking
    • Cilium as a CNI and service mesh
    • Hubble observability
    • Cilium Network Policies
• 14. Extending Kubernetes
  • 14.1 Custom Resource Definitions (CRDs)
    • CRD schema and validation
    • Versioning and conversion webhooks
    • Structural schemas and pruning
    • CRD status subresource
  • 14.2 Operators
    • Operator pattern and use cases
    • Controller reconcile loop
    • Operator SDK and Kubebuilder
    • Operator Lifecycle Manager (OLM)
    • OperatorHub
  • 14.3 Kubernetes API Extension Points
    • Aggregated API servers
    • Admission webhooks deep dive
    • Scheduler extenders and plugins
    • Custom metrics API
  • 14.4 Kubernetes Client Libraries
    • client-go overview
    • Informers and work queues
    • Python, Java, and other language clients
    • controller-runtime library
• 15. Multi-Cluster and Federation
  • 15.1 Multi-Cluster Patterns
    • Reasons for multi-cluster architectures
    • Active-active vs active-passive
    • Cluster segmentation strategies
    • Cross-cluster service discovery
  • 15.2 Federation and Multi-Cluster Tools
    • Kubefed (Kubernetes Federation v2)
    • Liqo for transparent multi-cluster
    • Admiralty for multi-cluster scheduling
    • Submariner for cross-cluster networking
  • 15.3 Multi-Cluster GitOps
    • Argo CD ApplicationSet for multi-cluster
    • Cluster API (CAPI) for cluster lifecycle
    • Fleet management with Rancher Fleet
    • Policy propagation across clusters
• 16. Cluster Operations and Maintenance
  • 16.1 Cluster Upgrades
    • kubeadm upgrade workflow
    • Managed cluster upgrade strategies
    • Node draining and cordoning
    • Version skew policy
  • 16.2 Backup and Disaster Recovery
    • etcd backup and restore
    • Velero for cluster and application backup
    • PV snapshot backup strategies
    • Recovery time and recovery point objectives
  • 16.3 Cluster Cost Optimization
    • Right-sizing workloads
    • Spot and preemptible nodes
    • Cluster Autoscaler tuning
    • Kubecost and cost visibility tools
  • 16.4 Troubleshooting
    • Debugging pod failures and CrashLoopBackOff
    • Node Not Ready troubleshooting
    • Network connectivity debugging
    • OOMKilled and resource exhaustion
    • etcd health and performance
• 17. Advanced Topics
  • 17.1 eBPF in Kubernetes
    • eBPF fundamentals
    • eBPF-based observability
    • eBPF-based networking and security
    • bpftrace and BCC tools
  • 17.2 GPU and Specialized Hardware
    • GPU operator and device plugins
    • NVIDIA GPU scheduling
    • FPGA and custom accelerators
    • Resource slicing and MIG partitioning
  • 17.3 Serverless on Kubernetes
    • Knative Serving
    • Knative Eventing
    • OpenFaaS on Kubernetes
    • KEDA for scale-to-zero
  • 17.4 AI/ML Workloads on Kubernetes
    • Kubeflow overview and components
    • Training operators (PyTorch, TensorFlow)
    • KServe for model serving
    • Data pipelines with Argo Workflows
  • 17.5 Edge and IoT Kubernetes
    • k3s for edge deployments
    • KubeEdge architecture
    • Akri for IoT device discovery
    • Offline and low-bandwidth cluster operation