Kubernetes Container Orchestration Flashcards

Question 1

What is the main purpose of the Kubernetes system?

Accepted Answer

Kubernetes is an open source platform that automates the deployment, scaling, and management of containerized applications across a group of machines. It lets teams describe the desired state of their applications, then continuously works to make the actual state match that description. This approach reduces manual operations and helps applications recover from machine failures.

Question 2

What are the two main parts of a Kubernetes cluster?

Accepted Answer

A Kubernetes cluster has a control plane and a set of worker nodes. The control plane makes global decisions, such as scheduling workloads, and stores the cluster's state. Worker nodes run the containerized workloads, and each node runs an agent called the kubelet that reports status to the control plane.

Question 3

What is the role of the kube-apiserver in a cluster?

Accepted Answer

The kube-apiserver is the front door of the control plane. Every request from users, command line tools, and other components passes through it, and it validates those requests before storing them. Because all components communicate through this API, it acts as the central point for reading and changing cluster state.

Question 4

What does etcd store, and why does it matter?

Accepted Answer

etcd is a consistent, distributed key-value store that holds all cluster state, including object definitions, configuration, and the status of resources. It matters because losing or corrupting etcd data can leave the cluster unable to know what it is supposed to run, so backing it up is a core operational task.

Question 5

What is the scheduler's job in the control plane?

Accepted Answer

The kube-scheduler watches for newly created pods that have no assigned node and selects a suitable node for each one. It considers resource requests, node capacity, affinity rules, taints, and other constraints. It only chooses the node; the kubelet on that node is responsible for actually starting the containers.

Question 6

What does the kube-controller-manager do inside the control plane?

Accepted Answer

The kube-controller-manager runs a set of controllers, each of which watches part of the cluster state and works to move it toward the desired state. For example, the node controller notices when nodes stop reporting, and the ReplicaSet controller keeps the correct number of pod replicas running. Each controller follows the same reconciliation pattern.

Question 7

What is the kubelet and where does it run?

Accepted Answer

The kubelet is an agent that runs on every worker node. It receives pod specifications from the API server, ensures that the containers described in them are running and healthy, and reports node and pod status back to the control plane. It typically runs as a system service on the node.

Question 8

How does the reconciliation loop idea help explain Kubernetes behavior?

Accepted Answer

A reconciliation loop repeatedly compares the observed state of the system with the desired state recorded in the API, then acts to close any gap. Because this loop runs continuously, Kubernetes can recover from failures without a person issuing commands. If a container crashes, the loop notices the difference and asks for a replacement.

Question 9

What is a pod, and why is it the smallest deployable unit?

Accepted Answer

A pod is one or more containers that share a network namespace, storage volumes, and a lifecycle, and that are scheduled together onto the same node. Kubernetes manages pods rather than individual containers, which lets tightly coupled helper processes run alongside the main application. Most pods contain a single container.

Question 10

Why should you usually avoid creating bare pods directly in production?

Accepted Answer

A bare pod is not replaced if it fails or if its node is lost, because no controller is responsible for recreating it. Higher-level controllers such as Deployments, ReplicaSets, and StatefulSets keep the desired number of pods running and replace them when needed. For that reason, production workloads are normally defined through a controller.

Question 11

What does a Deployment provide that a ReplicaSet alone does not?

Accepted Answer

A Deployment manages ReplicaSets and adds rollout management on top of them. When you change a pod template, the Deployment creates a new ReplicaSet and shifts pods to it, and it keeps the previous ReplicaSet so you can roll back. This makes it a common choice for stateless applications that are updated over time.

Question 12

When would you choose a StatefulSet instead of a Deployment?

Accepted Answer

Choose a StatefulSet when each pod needs a stable identity, a stable network name, or its own persistent storage that follows it across restarts. StatefulSets create pods with predictable names, such as app-0 and app-1, and start or stop them in order. Databases and clustered systems often use this pattern.

Question 13

What problem does a DaemonSet solve in a cluster?

Accepted Answer

A DaemonSet ensures that a copy of a given pod runs on every node. When nodes are added to the cluster, the DaemonSet adds the pod to them automatically, and it removes the pod when nodes leave. It is typically used for node-level agents such as log collectors, monitoring agents, and network plugins.

Question 14

What is a Job, and how does it differ from a long-running Deployment?

Accepted Answer

A Job runs one or more pods until a specified number of them complete successfully, then stops creating new pods. Unlike a Deployment, which keeps pods running indefinitely and restarts them, a Job is meant for finite tasks such as batch processing or data migrations. A CronJob creates Jobs on a repeating schedule.

Question 15

What do liveness and readiness probes tell the kubelet?

Accepted Answer

A liveness probe tells the kubelet whether a container is still functioning, and a failed liveness probe causes the container to be restarted. A readiness probe tells the kubelet whether a container is ready to receive traffic, and a failing readiness probe removes the pod from service endpoints without restarting it.

Question 16

Why are resource requests and limits important for pods?

Accepted Answer

Resource requests tell the scheduler how much CPU and memory a container needs, so the pod lands on a node with room. Limits set the maximum a container may use, and exceeding a memory limit can cause the container to be terminated. Setting both values helps the cluster share resources predictably among workloads.

Question 17

What problem does a Kubernetes Service solve for applications?

Accepted Answer

Pods are temporary and can be replaced with new IP addresses, so clients cannot rely on pod addresses. A Service gives a group of pods one stable virtual IP address and DNS name, and it forwards traffic to whichever healthy pods match its label selector. This keeps clients insulated from pod churn.

Question 18

What are the main types of Kubernetes Service?

Accepted Answer

ClusterIP is the default type and exposes the Service only inside the cluster. NodePort opens the same port on every node so external traffic can reach the Service through any node address. LoadBalancer asks the cloud provider to provision an external load balancer, and ExternalName maps the Service to an external DNS name.

Question 19

How does a Service decide which pods receive its traffic?

Accepted Answer

A Service uses a label selector to match pods by their labels. Kubernetes continuously updates the Service's endpoints so they list the IP addresses of matching pods that are ready to serve traffic. Pods that fail readiness checks are removed from the endpoints until they recover.

Question 20

What is an Ingress, and what must exist before it works?

Accepted Answer

An Ingress is an API object that defines HTTP and HTTPS routing rules, such as host and path matching to different Services. An Ingress controller, which is a separate component running in the cluster, must be installed to read those rules and act on them. Without a controller, an Ingress resource has no effect.

Question 21

What DNS name does a Service receive inside a Kubernetes cluster?

Accepted Answer

Kubernetes runs a cluster DNS service, and by default each Service receives a name in the form service-name.namespace.svc.cluster.local, which resolves to its cluster IP. Pods in the same namespace can usually reach it with just the service name. Pods in other namespaces need the namespace included in the name.

Question 22

What is a NetworkPolicy used for in a Kubernetes cluster?

Accepted Answer

A NetworkPolicy is a resource that controls which pods can send or receive network traffic, based on labels and ports. By default, pods accept traffic from any source, but once a policy selects a pod, only the traffic the policy allows is accepted. Enforcement depends on the cluster network plugin supporting policies.

Question 23

How do pods usually reach external addresses outside the cluster?

Accepted Answer

Pods send outbound traffic through the node's network, and the cluster network plugin routes it toward external destinations. Pods do not need a public address of their own for this. Egress network policies can then limit which external destinations pods are allowed to reach, if the network plugin supports them.

Question 24

What is a headless Service, and when is it useful?

Accepted Answer

A headless Service is created by setting its cluster IP to None, so it does not get a virtual IP or load balance traffic. Instead, DNS returns the individual pod addresses, which lets clients discover and connect to specific pods directly. StatefulSets commonly use headless Services so each pod has a stable DNS name.

Question 25

What is a ConfigMap used for in Kubernetes applications?

Accepted Answer

A ConfigMap stores non-confidential configuration data as key-value pairs, so that settings are kept outside container images. Pods can consume the data as environment variables, as command-line arguments, or as files mounted in a volume. Mounted files are eventually refreshed by the kubelet after changes, while environment variables require a pod restart.

Question 26

How do Secrets differ from ConfigMaps in Kubernetes?

Accepted Answer

Secrets are intended for sensitive values such as passwords, tokens, and keys. Their values are base64 encoded by default, which is an encoding rather than encryption, so access should be restricted with role-based access control and encryption at rest should be enabled. ConfigMaps are for ordinary, non-sensitive settings.

Question 27

What is a PersistentVolumeClaim, and how does it relate to storage?

Accepted Answer

A PersistentVolumeClaim is a request for storage made by a user or workload, specifying a size and access mode such as ReadWriteOnce. Kubernetes binds the claim to a PersistentVolume, which represents an actual piece of storage, either provisioned manually or dynamically by a StorageClass. Pods then mount the claim as a volume.

Question 28

What is the difference between a pod volume and a PersistentVolume?

Accepted Answer

A volume is defined within a pod specification and generally lives only as long as that pod. A PersistentVolume is a cluster-level resource representing storage that exists independently of any single pod, so its data can outlive the pods that use it.

Question 29

What is a StorageClass, and why do administrators use it?

Accepted Answer

A StorageClass describes a type of storage, such as fast or standard tiers, along with the provisioner that creates it. When a claim references a StorageClass, Kubernetes can create a matching PersistentVolume automatically, which is called dynamic provisioning. This avoids pre-creating volumes by hand and lets users request storage by category.

Question 30

What does the access mode ReadWriteOnce mean for a volume?

Accepted Answer

ReadWriteOnce means the volume can be mounted read-write by a single node at a time, although multiple pods on that same node may share it. Other modes include ReadOnlyMany, which allows many nodes to read the volume, and ReadWriteMany, which allows many nodes to read and write. Not every storage backend supports every mode.

Question 31

How can a container receive a Secret value as an environment variable?

Accepted Answer

In the pod specification, an environment variable can reference a specific key inside a Secret via a secretKeyRef field. When the container starts, the variable contains the decoded value. Changing the Secret later does not update running containers, so the pod usually needs to be restarted to pick up the new value.

Question 32

Why is it a poor practice to bake configuration into container images?

Accepted Answer

Baking configuration into an image ties the image to one environment, so the same build cannot be promoted from testing to production without rebuilding. Keeping settings in ConfigMaps and Secrets lets one image run in many environments, with each environment supplying its own values. This separation makes changes easier to review and roll back.

Question 33

What does the Horizontal Pod Autoscaler do for a workload?

Accepted Answer

The Horizontal Pod Autoscaler changes the number of pod replicas for a workload, such as a Deployment, based on observed metrics like CPU utilization. It increases replicas when load rises and decreases them when load falls, within a configured minimum and maximum. Vertical scaling of pod sizes is a separate concern.

Question 34

What does the Cluster Autoscaler do when pods cannot be scheduled?

Accepted Answer

The Cluster Autoscaler adds nodes to the cluster when pending pods cannot fit on existing nodes, and removes nodes that stay underused and whose pods can be moved elsewhere. It works with the node groups of a cloud or infrastructure provider, so it depends on that integration.

Question 35

How does the scheduler rank nodes that all have room for a pod?

Accepted Answer

The scheduler first filters out nodes that fail hard requirements, such as insufficient resources, unmatched node selectors, or untolerated taints. It then scores the remaining nodes using priorities such as spreading pods across zones or balancing resource use. The highest scoring node is selected for the pod.

Question 36

What is a taint on a node, and how does a toleration relate?

Accepted Answer

A taint marks a node so that pods without a matching toleration are kept away from it, with effects such as NoSchedule or NoExecute. A toleration, set on a pod, allows that pod to be scheduled onto a node with a matching taint, but it does not force the pod onto that node.

Question 37

How does a rolling update replace running pods gradually?

Accepted Answer

A rolling update replaces old pods with new ones so that some capacity keeps serving traffic during the change. The maxSurge setting controls how many extra pods may be created above the desired count, and maxUnavailable controls how many pods may be unavailable during the update. Readiness probes determine when each new pod counts as available.

Question 38

What does a PodDisruptionBudget protect against during maintenance?

Accepted Answer

A PodDisruptionBudget limits how many pods of an application can be voluntarily disrupted at the same time, such as during a node drain or cluster upgrade. It lets administrators state a minimum number or percentage of pods that must remain available. It does not stop involuntary failures such as hardware crashes.

Question 39

Which kubectl commands help you diagnose a pod that will not start?

Accepted Answer

Start with kubectl describe pod to see events, such as failed scheduling or image pull errors, and the current state of each container. Then run kubectl logs on the pod, adding the container name or the, previous flag if the container has restarted. Use kubectl get pods to view status, including restart counts.

Question 40

How can you roll back a Deployment to an earlier revision?

Accepted Answer

Use kubectl rollout undo deployment followed by the Deployment name to return to the previous revision, or add the, to-revision flag to choose a specific one. You can check the history with kubectl rollout history first. Rollbacks work because the Deployment keeps old ReplicaSets, which store earlier pod templates.

Kubernetes Container Orchestration Flashcards

1Cluster Architecture Fundamentals

2Pods and Workload Controllers

3Services and Networking

4Configuration, Secrets, and Storage

5Scheduling, Scaling, and Operations

Learning Resources