Introduction
Kubernetes has become the de facto standard for container orchestration. Originally developed by Google and now maintained by the Cloud Native Computing Foundation (CNCF), Kubernetes enables developers to deploy, scale, and manage containerized applications across clusters of machines.
This comprehensive guide covers everything from basic concepts to production-ready configurations.
Kubernetes Architecture
High-Level Overview
┌─────────────────────────────────────────────────────────────────┐
│ KUBERNETES ARCHITECTURE │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ┌───────────────────────────────────────────────────────────┐ │
│ │ Kubernetes Cluster │ │
│ │ │ │
│ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │
│ │ │ Worker │ │ Worker │ │ Worker │ │ │
│ │ │ Node 1 │ │ Node 2 │ │ Node 3 │ │ │
│ │ │ ┌─────────┐ │ │ ┌─────────┐ │ │ ┌─────────┐ │ │ │
│ │ │ │ Kubelet│ │ │ │ Kubelet│ │ │ │ Kubelet│ │ │ │
│ │ │ │ Kube- │ │ │ │ Kube- │ │ │ │ Kube- │ │ │ │
│ │ │ │ proxy │ │ │ │ proxy │ │ │ │ proxy │ │ │ │
│ │ │ └─────────┘ │ │ └─────────┘ │ │ └─────────┘ │ │ │
│ │ │ ┌─────────┐ │ │ ┌─────────┐ │ │ ┌─────────┐ │ │ │
│ │ │ │ Pods │ │ │ │ Pods │ │ │ │ Pods │ │ │ │
│ │ │ └─────────┘ │ │ └─────────┘ │ │ └─────────┘ │ │ │
│ │ └─────────────┘ └─────────────┘ └─────────────┘ │ │
│ │ │ │ │ │ │
│ │ └─────────────────┼─────────────────┘ │ │
│ │ │ │ │
│ │ ┌──────▼──────┐ │ │
│ │ │ Control │ │ │
│ │ │ Plane │ │ │
│ │ │ ┌────────┐│ │ │
│ │ │ │ kube- ││ │ │
│ │ │ │ apiserver│ │ │ │
│ │ │ └────────┘│ │ │
│ │ │ ┌────────┐│ │ │
│ │ │ │ kube- ││ │ │
│ │ │ │ scheduler│ │ │ │
│ │ │ └────────┘│ │ │
│ │ │ ┌────────┐│ │ │
│ │ │ │ kube- ││ │ │
│ │ │ │ controller│ │ │ │
│ │ │ └────────┘│ │ │
│ │ │ ┌────────┐│ │ │
│ │ │ │ etcd ││ │ │
│ │ │ └────────┘│ │ │
│ │ └─────────────┘ │ │
│ └───────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Control Plane Components
# Control Plane Components Overview
control_plane:
components:
- name: "kube-apiserver"
description: "REST API server for Kubernetes"
function: "Validates and configures API objects"
critical: true
- name: "etcd"
description: "Distributed key-value store"
function: "Stores all cluster data"
critical: true
- name: "kube-scheduler"
description: "Pod scheduler"
function: "Assigns pods to nodes based on resources"
critical: true
- name: "kube-controller-manager"
description: "Controller processes"
function: "Runs controller loops"
controllers:
- "Node controller"
- "Replication controller"
- "Endpoints controller"
- "Service Account controller"
critical: true
- name: "cloud-controller-manager"
description: "Cloud provider integration"
function: "Interfaces with cloud APIs"
critical: false # Optional, depends on cloud provider
Worker Node Components
# Worker Node Components
worker_node:
components:
- name: "kubelet"
description: "Node agent"
function: "Manages pods and containers"
responsibilities:
- "Pod lifecycle management"
- "Health monitoring"
- "Resource reporting"
- name: "kube-proxy"
description: "Network proxy"
function: "Maintains network rules"
types:
- "iptables (default)"
- "ipvs (for higher performance)"
- "userspace (legacy)"
- name: "container runtime"
description: "Runs containers"
options:
- "containerd (recommended)"
- "Docker (deprecated in K8s 1.24+)"
- "CRI-O"
Core Concepts
Pods
┌─────────────────────────────────────────────────────────────────┐
│ KUBERNETES PODS │
├─────────────────────────────────────────────────────────────────┤
│ │
│ A Pod is the smallest deployable unit in Kubernetes │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Single-Container Pod │ │
│ │ ┌─────────────────────────────────────────────────────┐ │ │
│ │ │ Pod │ │ │
│ │ │ ┌───────────────────────────────────────────────┐ │ │ │
│ │ │ │ Container │ │ │ │
│ │ │ │ • Image: nginx:latest │ │ │ │
│ │ │ │ • Port: 80 │ │ │ │
│ │ │ │ • Resources: CPU/Memory │ │ │ │
│ │ │ └───────────────────────────────────────────────┘ │ │ │
│ │ └─────────────────────────────────────────────────────┘ │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Multi-Container Pod │ │
│ │ ┌─────────────────────────────────────────────────────┐ │ │
│ │ │ Pod │ │ │
│ │ │ ┌──────────────┐ ┌──────────────┐ │ │ │
│ │ │ │ Container │ │ Container │ │ │ │
│ │ │ │ (Main App) │ │ (Sidecar) │ │ │ │
│ │ │ │ nginx:1.21 │ │ log-collector│ │ │ │
│ │ │ └──────────────┘ └──────────────┘ │ │ │
│ │ │ │ │ │ │ │
│ │ │ └──────────┬───────────┘ │ │ │
│ │ │ │ │ │ │
│ │ │ Shared: network, storage │ │ │
│ │ └─────────────────────────────────────────────────────┘ │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Pod Definition Example
# pod.yaml - Basic Pod definition
apiVersion: v1
kind: Pod
metadata:
name: nginx-pod
labels:
app: nginx
tier: frontend
spec:
containers:
- name: nginx
image: nginx:1.21
ports:
- containerPort: 80
resources:
requests:
memory: "64Mi"
cpu: "250m"
limits:
memory: "128Mi"
cpu: "500m"
env:
- name: NGINX_HOST
value: "localhost"
- name: NGINX_PORT
value: "80"
# pod-multicontainer.yaml - Multi-container Pod with sidecar
apiVersion: v1
kind: Pod
metadata:
name: web-pod
labels:
app: web
spec:
containers:
# Main application container
- name: web
image: myapp:latest
ports:
- containerPort: 8080
volumeMounts:
- name: shared-data
mountPath: /data
# Sidecar container (log collector)
- name: log-collector
image: busybox:latest
command: ["sh", "-c", "tail -f /data/logs/*.log"]
volumeMounts:
- name: shared-data
mountPath: /data
# Sidecar container (nginx sidecar)
- name: nginx-sidecar
image: nginx:alpine
ports:
- containerPort: 80
volumeMounts:
- name: nginx-config
mountPath: /etc/nginx/conf.d
volumes:
- name: shared-data
emptyDir: {}
- name: nginx-config
configMap:
name: nginx-config
Deployments
# deployment.yaml - Deployment with rolling updates
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
labels:
app: nginx
spec:
replicas: 3
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx:1.21
ports:
- containerPort: 80
resources:
requests:
memory: "64Mi"
cpu: "250m"
limits:
memory: "128Mi"
cpu: "500m"
readinessProbe:
httpGet:
path: /healthz
port: 80
initialDelaySeconds: 5
periodSeconds: 10
livenessProbe:
httpGet:
path: /healthz
port: 80
initialDelaySeconds: 15
periodSeconds: 20
Services
┌─────────────────────────────────────────────────────────────────┐
│ KUBERNETES SERVICES │
├─────────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ ClusterIP (Default) │ │
│ │ │ │
│ │ ┌──────────┐ ┌──────────┐ │ │
│ │ │ Service │──────►│ Pods │ │ │
│ │ │ 10.0.0.50 │ │ 10.1.1.5 │ │ │
│ │ └──────────┘ │ 10.1.1.6 │ │ │
│ │ (Internal only) └──────────┘ │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ NodePort │ │
│ │ │ │
│ │ ┌──────────┐ ┌──────────┐ │ │
│ │ │ Service │──────►│ Pods │ │ │
│ │ │ :80 │ └──────────┘ │ │
│ │ │ :30080 │ │ │
│ │ └──────────┘ Exposes on each node's IP │ │
│ │ Port range: 30000-32767 │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ LoadBalancer │ │
│ │ │ │
│ │ ┌──────────┐ ┌──────────┐ │ │
│ │ │ Service │──────►│ Pods │ │ │
│ │ │ External │ └──────────┘ │ │
│ │ │ IP │ │ │
│ │ └──────────┘ Creates cloud LB │ │
│ │ (AWS ALB, Azure LB, GCP LB) │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ ExternalName │ │
│ │ │ │
│ │ ┌──────────┐ │ │
│ │ │ Service │───► CNAME: external.service.com │ │
│ │ └──────────┘ (No proxy, DNS only) │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Service Definition
# service.yaml - ClusterIP Service
apiVersion: v1
kind: Service
metadata:
name: nginx-service
spec:
type: ClusterIP
selector:
app: nginx
ports:
- name: http
port: 80
targetPort: 80
protocol: TCP
---
# service-nodeport.yaml - NodePort Service
apiVersion: v1
kind: Service
metadata:
name: nginx-nodeport
spec:
type: NodePort
selector:
app: nginx
ports:
- port: 80
targetPort: 80
nodePort: 30080
protocol: TCP
---
# service-loadbalancer.yaml - LoadBalancer Service
apiVersion: v1
kind: Service
metadata:
name: nginx-lb
spec:
type: LoadBalancer
selector:
app: nginx
ports:
- port: 80
targetPort: 80
externalTrafficPolicy: Local # Preserves client source IP
---
# service-headless.yaml - Headless Service
apiVersion: v1
kind: Service
metadata:
name: nginx-headless
spec:
clusterIP: None # Headless
selector:
app: nginx
ports:
- port: 80
targetPort: 80
Networking
Kubernetes Networking Model
┌─────────────────────────────────────────────────────────────────┐
│ KUBERNETES NETWORKING MODEL │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Every Pod gets its own IP address │
│ All Pods can communicate with all other Pods │
│ Pods can communicate without NAT │
│ │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ Node 1 │ │
│ │ ┌──────────────┐ ┌──────────────┐ │ │
│ │ │ Pod A │ │ Pod B │ │ │
│ │ │ 10.1.1.5 │◄──│ 10.1.1.6 │ │ │
│ │ └──────────────┘ └──────────────┘ │ │
│ │ │ │ │ │
│ │ └──────────────────┼──────────────────────┐ │ │
│ │ │ │ │ │
│ │ ┌──────────────┐ ┌──────────────┐ │ │ │
│ │ │ Pod C │ │ Pod D │ │ │ │
│ │ │ 10.1.2.10 │◄──│ 10.1.2.11 │◄───┘ │ │
│ │ └──────────────┘ └──────────────┘ │ │
│ │ Node 2 ◄─────────────────┘ │
│ │ │
│ │ All pods can reach each other directly │
│ │ Using their pod IPs │
│ │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ Service Discovery: │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ DNS-based: my-service.namespace.svc.cluster.local │ │
│ │ │ │
│ │ Environment variables: │ │
│ │ MY_SERVICE_SERVICE_HOST=10.0.0.50 │ │
│ │ MY_SERVICE_SERVICE_PORT=80 │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Ingress
# ingress.yaml - Ingress with TLS and path-based routing
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: my-app-ingress
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
ingressClassName: nginx
tls:
- hosts:
- example.com
- www.example.com
secretName: tls-secret
rules:
- host: example.com
http:
paths:
- path: /api
pathType: Prefix
backend:
service:
name: api-service
port:
number: 8080
- path: /web
pathType: Prefix
backend:
service:
name: web-service
port:
number: 80
- path: /
pathType: Prefix
backend:
service:
name: default-service
port:
number: 80
Storage
PersistentVolumes and PersistentVolumeClaims
# persistent-volume.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv001
spec:
capacity:
storage: 10Gi
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Retain
storageClassName: standard
nfs:
server: nfs-server.example.com
path: /exports/pv001
---
# persistent-volume-claim.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: my-pvc
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 5Gi
storageClassName: standard
---
# pod-with-pvc.yaml
apiVersion: v1
kind: Pod
metadata:
name: pod-with-pvc
spec:
containers:
- name: app
image: nginx:latest
volumeMounts:
- name: data
mountPath: /data
volumes:
- name: data
persistentVolumeClaim:
claimName: my-pvc
Storage Classes
# storage-class.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: fast-ssd
provisioner: kubernetes.io/gce-pd
parameters:
type: pd-ssd
replication-type: regional-pd
volumeBindingMode: WaitForFirstConsumer
reclaimPolicy: Retain
ConfigMaps and Secrets
# configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: app-config
data:
database.conf: |
host=localhost
port=5432
max_connections=100
app.properties: |
log.level=INFO
cache.enabled=true
---
# secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: db-credentials
type: Opaque
stringData:
username: admin
password: changeme # Base64 encode for production
---
# pod-using-config-secret.yaml
apiVersion: v1
kind: Pod
metadata:
name: app-pod
spec:
containers:
- name: app
image: myapp:latest
envFrom:
- configMapRef:
name: app-config
- secretRef:
name: db-credentials
volumeMounts:
- name: config
mountPath: /etc/config
volumes:
- name: config
configMap:
name: app-config
Resource Management
Resource Requests and Limits
# resource-quota.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
name: compute-quota
spec:
hard:
requests.cpu: "10"
requests.memory: 20Gi
limits.cpu: "20"
limits.memory: 40Gi
pods: "50"
---
# limit-range.yaml
apiVersion: v1
kind: LimitRange
metadata:
name: default-limits
spec:
limits:
- default:
memory: 256Mi
cpu: 200m
defaultRequest:
memory: 128Mi
cpu: 100m
type: Container
Health Checks
# pod-with-probes.yaml
apiVersion: v1
kind: Pod
metadata:
name: app-with-probes
spec:
containers:
- name: app
image: myapp:latest
ports:
- containerPort: 8080
# Readiness Probe - when to receive traffic
readinessProbe:
httpGet:
path: /ready
port: 8080
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
failureThreshold: 3
timeoutSeconds: 1
# Liveness Probe - when to restart
livenessProbe:
httpGet:
path: /healthy
port: 8080
initialDelaySeconds: 15
periodSeconds: 20
failureThreshold: 3
timeoutSeconds: 1
# Startup Probe - for slow starting containers
startupProbe:
httpGet:
path: /started
port: 8080
failureThreshold: 30
periodSeconds: 10
timeoutSeconds: 1
Helm Package Manager
Helm Charts
# Chart.yaml
apiVersion: v2
name: my-app
description: A Helm chart for my application
version: 1.0.0
appVersion: "1.0"
---
# values.yaml
replicaCount: 3
image:
repository: myapp
pullPolicy: IfNotPresent
tag: "latest"
service:
type: ClusterIP
port: 80
ingress:
enabled: true
className: nginx
hosts:
- host: myapp.example.com
paths:
- path: /
pathType: Prefix
resources:
limits:
cpu: 500m
memory: 256Mi
requests:
cpu: 200m
memory: 128Mi
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 10
targetCPUUtilizationPercentage: 70
# Helm commands
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update
helm install my-release bitnami/nginx
helm upgrade my-release bitnami/nginx
helm rollback my-release 1
helm uninstall my-release
Production Best Practices
RBAC (Role-Based Access Control)
# role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: default
name: pod-reader
rules:
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list", "watch"]
---
# rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: read-pods
namespace: default
subjects:
- kind: User
name: jane
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
Network Policies
# network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: api-allow
namespace: production
spec:
podSelector:
matchLabels:
app: api
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
ports:
- protocol: TCP
port: 8080
egress:
- to:
- podSelector:
matchLabels:
app: database
ports:
- protocol: TCP
port: 5432
Conclusion
Kubernetes is a powerful platform for container orchestration. Key takeaways:
- Understand the architecture - Control plane vs worker nodes, etcd for state
- Use Deployments - Not bare Pods, for self-healing and rolling updates
- Leverage Services - For stable networking and load balancing
- Implement health checks - Readiness, liveness, and startup probes
- Secure your cluster - RBAC, Network Policies, Secrets management
Comments