PlatformCurrent
Kubernetes
Also known as: K8s
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
Technology explained
What is Kubernetes?
Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications across clusters of hosts.
Originally developed by Google and now maintained by the Cloud Native Computing Foundation (CNCF), Kubernetes has become the de facto operating system for the cloud. It provides a declarative API to manage fleets of containers, ensuring desired state, high availability, and automated recovery across distributed infrastructure.
Kubernetes abstracts away the underlying hardware or cloud provider, offering standardized primitives for load balancing, storage orchestration, secret management, and automated rollouts. Its extensible architecture via Custom Resource Definitions (CRDs) has spawned a massive ecosystem of cloud-native tooling.
Primary purpose
Orchestrating, scaling, and managing containerized applications across distributed clusters.
Typical environments
AWS EKSGoogle GKEAzure AKSOn-premises bare metal
Typical use cases
- Running high-availability microservices architectures
- Standardising deployment patterns across multi-cloud and hybrid environments
- Automating application scaling and self-healing
- Providing internal developer platforms (IDPs)
Technology map
Explore related technologies
Related technologies
Connected knowledge
26+ resources for Kubernetes
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Technology journey
Learn and operate with Kubernetes
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(2)
Start here: understand the core vocabulary.
Systems Engineering(2)
Learn the architecture, concepts and engineering context.
- eBPF Intrusion Detection for K8s Lateral MovementA staff engineer's guide to building eBPF intrusion detection pipelines that catch lateral movement and syscall anomalies inside Kubernetes clusters. Open
- Zero-Downtime Node Draining in EKS Spot FleetsWiring NTH, EventBridge, SQS, and ASG lifecycle hooks so a 120-second spot reclaim triggers graceful pod drain instead of abrupt eviction. Open
Ops Playbooks(1)
Operate, maintain and improve it in production.
Daily Triage(5)
Practise diagnosis through bounded engineering scenarios.
- Cgroup v2 Page Cache Accounting Triggers Conflicting OOMKilled AlertsOpen
- etcd Leader Flapping Causes API Server Timeouts Post-MigrationOpen
- etcd Leader Flapping After gp3 Migration Stalls Kube APIOpen
- etcd Leader Elections Spike After Kubernetes Node Pool AZ MoveOpen
- etcd Leader Election Storm After GKE Disk Type MigrationOpen
Config Traps(12+)
Recognise and avoid known failure modes.
- Pod Security Admission Exemptions Override Namespace Enforce LabelsA namespace shows a correct PodSecurity enforce label while a cluster-wide static exemption silently bypasses it for one identity, with no denial or warning recorded. Open
- Leftover Allow-All NetworkPolicy Rules Override New Deny-All RulesA new deny-all NetworkPolicy in Kubernetes does not override an existing allow-all policy for the same pods; the two combine additively, leaving the namespace exposed while dashboards show the restriction as active. Open
- Restricted Pod Security Admission Labels Miss Already-Running PodsA namespace label that looks like enforced hardening only governs admission of new or updated pods; pods already running keep whatever privileges they had before the label was applied. Open
- Ingress-Only NetworkPolicy Leaves Kubernetes Egress OpenKubernetes NetworkPolicy objects only restrict the traffic direction named in policyTypes. Learn to detect, fix and validate the common Ingress-only trap that leaves Egress fully open. Open
- A Kubernetes RBAC Hardening Change Can Leave Broad Access UntouchedA narrower Role does not override an older, broader ClusterRoleBinding. This trap shows how a Kubernetes RBAC hardening change can leave Secrets access fully intact and how to diagnose, correct and roll it back safely. Open
- etcd's Backup Proxy Port Bypasses apiserver ACLsA backup sidecar's etcd grpc-proxy listener on a non-default TCP port forwards writes straight into the datastore using its own embedded certificate, so nothing at the kube-apiserver layer ever sees, authenticates, or logs the request before it lands in etcd's key space. Open
- system:public-info-viewer: One Binding, Two Trust LevelsA single kubeadm-installed ClusterRoleBinding lists both system:authenticated and system:unauthenticated as subjects against one shared ClusterRole, so any rule added for monitoring or discovery tooling becomes reachable without a bearer token or client certificate. RBAC returns allow, and audit logs show ordinary anonymous traffic rather than a policy violation worth escalating. Open
- Default-Deny Egress Silently Breaks Pod DNS LookupsA cluster-wide egress default-deny NetworkPolicy blocks UDP/TCP 53 to CoreDNS unless an explicit allow rule exists, and the resulting failures surface as connection timeouts and retry storms in application logs rather than obvious DNS errors, sending on-call engineers chasing the wrong service. Open
- Static Pod Manifests: hostPath's Admission BypassA DaemonSet with a writable hostPath onto /etc/kubernetes/manifests on a control-plane node hands any compromised container a path to root-level pods that kubelet starts directly, skipping RBAC, PodSecurity admission and every webhook the API server would normally enforce. Open
- Base64 ConfigMaps Meet etcd's Identity Provider DefaultA ConfigMap holding a base64 database password looks encoded but is stored as flat, retrievable cleartext in etcd, in kubelet caches, and in every replica that mounts it. When etcd encryption at rest is left on its default identity provider, that same string also sits unencrypted in snapshots, Velero backups, and any copy of the etcd data directory, entirely outside the RBAC boundary that Secret objects are meant to enforce. Open
- PodSecurityPolicy Migration Leftover Disables PodSecurityA single stray plugin name in a kube-apiserver flag can strip PodSecurity enforcement from every namespace at once, including kube-system, letting container specs carrying privileged: true, hostPID or hostNetwork pass admission unchecked. RBAC and NetworkPolicy provide no backstop, since neither governs container capability grants on the control plane. Open
- hostPath Policy Prefix Checks Miss the /run SymlinkAn admission policy written against /var/run/docker.sock does nothing if the node's /var/run is a symlink to /run, because a pod can mount /run/docker.sock directly and the same socket becomes reachable under a path string the policy never inspected. Namespace-scoped exemptions and standard RBAC reviews will not catch this on Kubernetes nodes running systemd-based distributions. Open
Incident Runbooks(4)
Stabilise, recover and validate during incidents.
- Kubernetes NetworkPolicy Absent by Default Allows Unrestricted Pod-to-Pod East-West Traffic Across NamespacesWith no NetworkPolicy objects defined, Kubernetes permits every pod to reach every other pod across all namespaces on any port. This isn't a misconfiguration in the traditional sense — it's the platform's documented default. Compromised workloads pivot freely between dev, staging and production without triggering a single firewall rule. Open
- Kubernetes etcd exposed without TLS client certificate authentication on default port 2379etcd's gRPC and HTTP listener on port 2379 accepts unauthenticated plaintext connections because -client-cert-auth, -cert-file and -trusted-ca-file were never set on the static pod manifest. Anyone reaching the node network can run etcdctl get / -prefix and read every Secret, ConfigMap and ServiceAccount token in the cluster in cleartext. Open
- Kubernetes RBAC ClusterRoleBinding granting cluster-admin to the default service account in kube-system namespaceA ClusterRoleBinding still lists system:serviceaccount:kube-system:default as a subject against the cluster-admin ClusterRole. Every pod scheduled into kube-system without an explicit serviceAccountName silently inherits a token with full API server control, including secrets read access across every namespace, until someone notices or an attacker does first. Open
- Kubernetes Secrets stored unencrypted in etcd without encryption-at-rest provider (aescbc/kms) configuredKubernetes ships with the identity provider as the default encryption-at-rest setting, meaning kube-apiserver writes Secret objects to etcd as plaintext unless an EncryptionConfiguration is explicitly supplied. Any etcd snapshot, disk image, or unauthorised etcdctl read exposes credentials, tokens, and TLS keys in the clear. Open