Kubernetes — Cheat Sheet

Tags: kubernetes, k8s, containers, orchestration, devops, docker, cloud

Level: intermediate

TL;DR: Production container orchestration cheat sheet covering core primitives, cluster networking, workload controllers, and essential troubleshooting commands.

Key concepts

Control plane coordinates cluster state via API server, etcd, controller manager, and scheduler.

Kubelet runs on worker nodes to manage container lifecycle via CRI.

Kube-proxy maintains host network rules and connection forwarding for Services.

Pod is the smallest deployable compute unit sharing network namespace and storage.

Deployment manages declarative updates and rollbacks for stateless ReplicaSets.

StatefulSet maintains persistent pod identity, ordered deployment, and dedicated storage per replica.

DaemonSet guarantees exactly one copy of a pod runs on each eligible node.

Service provides stable IP and DNS abstraction across ephemeral pod endpoints.

Ingress manages external HTTP and HTTPS routing to internal cluster services.

ConfigMap and Secret inject runtime configuration and sensitive credentials into containers.

Typical questions and ready answers

Q: What is the operational difference between a Deployment and a StatefulSet?R: Deployments treat pods as interchangeable replicas with shared or ephemeral storage. StatefulSets assign unique, sticky ordinal identities and bind dedicated PersistentVolumeClaims that persist across pod rescheduling.

Q: How does a Service locate its target Pods?R: Services use label selectors matching Pod labels to dynamically build an Endpoints or EndpointSlice resource containing active Pod IP addresses.

Q: How do liveness and readiness probes differ during pod lifecycle?R: Liveness probes restart containers that enter broken states; readiness probes temporarily remove pod IPs from service traffic routing until initialization checks pass.

Q: What happens during a rolling update when maxSurge and maxUnavailable are configured?R: Kubernetes calculates thresholds to spin up new pods while deprecating old ones, guaranteeing capacity never drops below desired minus maxUnavailable.

Pitfalls and common mistakes

Omitting container resource requests and limits, causing node starvation and noisy-neighbor OOM kills.

Relying on emptyDir volumes for stateful applications, which lose data upon pod eviction or restart.

Pointing liveness probes at downstream dependencies, causing cascading restarts across the cluster.

Using image tag latest in production manifests, preventing deterministic rollbacks and caching properly.

Forgetting NetworkPolicies, leaving default flat pod-to-pod network traffic completely open across namespaces.

Failing to configure PodDisruptionBudgets on critical services during cluster node drain and maintenance.

Snippets and commands

# Cluster and resource inspection
kubectl get pods -A -o wide
kubectl describe pod <pod-name> -n <namespace>
kubectl logs -f <pod-name> -c <container-name> --tail=100

# Debugging and shell access
kubectl exec -it <pod-name> -n <namespace> -- /bin/sh
kubectl run debug-pod --rm -i --tty --image=busybox -- sh

# Workload rollouts
kubectl rollout status deployment/<deployment-name>
kubectl rollout history deployment/<deployment-name>
kubectl rollout undo deployment/<deployment-name>

# Node management
kubectl cordon <node-name>
kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data
kubectl uncordon <node-name>

YAML

# Minimal Deployment with health checks and resource limits
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web-app
  template:
    metadata:
      labels:
        app: web-app
    spec:
      containers:
      - name: server
        image: nginx:1.25-alpine
        ports:
        - containerPort: 80
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 256Mi
        readinessProbe:
          httpGet:
            path: /healthz
            port: 80
          initialDelaySeconds: 5
          periodSeconds: 10
        livenessProbe:
          httpGet:
            path: /healthz
            port: 80
          initialDelaySeconds: 15
          periodSeconds: 20

To review

[ ] Understand CNI plugins and pod networking implementations (Calico, Flannel, Cilium)

[ ] Master RBAC rules, ServiceAccounts, Roles, and RoleBindings

[ ] Review Ingress Controllers vs Gateway API specifications

[x] Core workload manifests (Deployment, Service, ConfigMap, Secret)

[x] Basic debugging workflows with kubectl describe and logs

Jarvis Interviews
Jarvis