Kubernetes
Also known as: K8s
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is Kubernetes?
Kubernetes is an open-source container orchestration platform that automates the deployment, scaling, and management of containerized applications across clusters of hosts.
Originally developed by Google and now maintained by the Cloud Native Computing Foundation (CNCF), Kubernetes has become the de facto operating system for the cloud. It provides a declarative API to manage fleets of containers, ensuring desired state, high availability, and automated recovery across distributed infrastructure.
Kubernetes abstracts away the underlying hardware or cloud provider, offering standardized primitives for load balancing, storage orchestration, secret management, and automated rollouts. Its extensible architecture via Custom Resource Definitions (CRDs) has spawned a massive ecosystem of cloud-native tooling.
Orchestrating, scaling, and managing containerized applications across distributed clusters.
- Running high-availability microservices architectures
- Standardising deployment patterns across multi-cloud and hybrid environments
- Automating application scaling and self-healing
- Providing internal developer platforms (IDPs)
Explore related technologies
Related technologies
Diagnose and connect Kubernetes
Exact failure lookups, verified technology boundaries and reusable operational artifacts.
35+ resources for Kubernetes
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with Kubernetes
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(3)
Start here: understand the core vocabulary.
Systems Engineering(3)
Learn the architecture, concepts and engineering context.
- Part 1: Kubernetes Boundaries and Failure DomainsPart 1 of a six-part Kubernetes Series: the boundary map, dependency and trust inventory, and failure-domain assumptions that later parts on control-plane design and recovery depend on. Open
- eBPF Intrusion Detection for K8s Lateral MovementA staff engineer's guide to building eBPF intrusion detection pipelines that catch lateral movement and syscall anomalies inside Kubernetes clusters. Open
- Zero-Downtime Node Draining in EKS Spot FleetsWiring NTH, EventBridge, SQS, and ASG lifecycle hooks so a 120-second spot reclaim triggers graceful pod drain instead of abrupt eviction. Open
Ops Playbooks(7)
Operate, maintain and improve it in production.
- Kubernetes Workload Diagnosis Guardrails for Cloud-Native PrimitivesOpen
- Diagnosing Cloud-Native Workload Failures: A Bounded Kubernetes Recovery WorkflowOpen
- Where Next-Gen Cloud-Native Primitives Fail and How Kubernetes HelpsOpen
- Guardrails for Adopting Cloud-Native Primitives on KubernetesOpen
- Recovering Next-Gen Cloud-Native Primitives Safely with KubernetesOpen
- Making Next-Gen Cloud-Native Primitives Repeatable with KubernetesOpen
- Designing a Repeatable Kubernetes Workflow for Cloud-Native PrimitivesOpen
Daily Triage(9)
Practise diagnosis through bounded engineering scenarios.
- Ready Pods Fail Through a Stale Kubernetes Service SelectorOpen
- API Pods Fail Readiness After a Service Account ChangeOpen
- New Deployment Rollout Leaves Pods CrashLooping on a Stale ConfigMap MountOpen
- Kubernetes HPA Scales Pods Up While CPU Graphs Show Idle CapacityOpen
- Cgroup v2 Page Cache Accounting Triggers Conflicting OOMKilled AlertsOpen
- etcd Leader Flapping Causes API Server Timeouts Post-MigrationOpen
- etcd Leader Flapping After gp3 Migration Stalls Kube APIOpen
- etcd Leader Elections Spike After Kubernetes Node Pool AZ MoveOpen
- etcd Leader Election Storm After GKE Disk Type MigrationOpen
Config Traps(12+)
Recognise and avoid known failure modes.
- A Namespace Exemption Label That Lets Privileged Pods Bypass Admission ControlA namespace label intended to enforce restricted Pod Security Admission was silently overridden by a bulk relabelling script and an audit-only custom admission policy, letting privileged pods run undetected. Open
- A Namespace Label Typo That Lets Pod Security Admission Silently Allow Privileged PodsA misspelled Pod Security Admission enforce label passes kubectl apply but leaves the namespace fully unprotected, because Kubernetes only validates label syntax, not the PSA vocabulary. Open
- An Empty namespaceSelector in a NetworkPolicy Quietly Allows All TrafficAn empty namespaceSelector in a Kubernetes NetworkPolicy matches all namespaces, not none, silently defeating intended isolation while the policy still shows as applied. Open
- A Namespace Without a Default-Deny NetworkPolicy Leaves Pods Open to All TrafficA namespace with one allow-specific Kubernetes NetworkPolicy is not the same as a namespace with default-deny; unselected pods remain fully open until an explicit deny-all policy is added. Open
- Kubernetes NetworkPolicy Default Allow Leaves Workloads ExposedKubernetes namespaces do not isolate network traffic by default. This trap explains why, how to confirm the exposure with read-only checks, and how to apply and validate a deny-all policy safely. Open
- A Wildcard Verb in a ClusterRole Quietly Grants Cluster-Wide Write AccessA ClusterRole edited for a debugging session and left with verbs: ["*"] silently grants cluster-wide write and delete access, because RBAC applies wildcards literally regardless of the role's original intent. Open
- Namespace-Wide RBAC Read on Secrets Lets Any Pod Read Every Team's CredentialsA Role granting get/list/watch on secrets without resourceNames lets any pod's ServiceAccount read every Secret in the namespace, not just its own, when combined with default token automounting. Open
- kubelet Anonymous Auth Left On Grants Unauthenticated Root-Level Node API AccessA node's kubelet API can silently bypass cluster RBAC entirely when anonymous authentication is left enabled, letting unauthenticated network clients read pod data and execute commands. Open
- Kubernetes Secrets Look Encrypted But etcd Stores Them in Plain Base64Kubernetes Secrets are base64-encoded, not encrypted, in etcd by default. Anyone with etcd or backup access can read every Secret regardless of RBAC — unless encryption at rest is explicitly enabled and existing Secrets are re-encrypted. Open
- Etcd Client Port Without Certificate Authentication Exposes Every Kubernetes SecretAn etcd client port left without certificate authentication bypasses Kubernetes RBAC entirely, exposing every Secret in the cluster to anyone with network access. Open
- fsGroup Permissions Silently Fail on Kubernetes hostPath VolumesfsGroup does not apply to hostPath volumes in Kubernetes. This trap explains why the write fails, how to diagnose it safely, and how to correct it without weakening the Pod's security context. Open
- Missing etcd Encryption Configuration Leaves Kubernetes Secrets Recoverable in BackupsKubernetes Secrets decode from etcd as plain base64 unless a real encryption provider is configured on kube-apiserver - RBAC alone does not protect backups or etcd access. Open
Incident Runbooks(1)
Stabilise, recover and validate during incidents.