What you will learn in Acing the Certified Kubernetes Administrator Exam, Second Edition
Chapter by chapter
Concepts explained in this book
- kubeletThe kubelet binary is the executable program that runs the Kubernetes node agent.
- Kubernetes DeploymentA Deployment is a Kubernetes API resource that declaratively manages the desired state of replicated application workloads.
- RoleBindingA RoleBinding is a Kubernetes API object that grants the permissions of a Role or ClusterRole to specified subjects within a namespace.
- kubectlkubectl is the Kubernetes command-line tool for interacting with Kubernetes clusters and their API objects.
- serviceA Kubernetes Service is a resource that provides stable network access to a set of Pods and distributes traffic among them.
- roleA role is a Kubernetes RBAC object that defines permitted actions on specified resources within a namespace.
- Container Network InterfaceThe Container Network Interface (CNI) is a standard specification and plugin interface for configuring networking and network resources for containers.
- rolling updateAn application rollout is the controlled, versioned progression of deploying a new workload or application version through successive revisions.
- KubernetesKubernetes is an open-source platform for orchestrating containerized workloads and services across a cluster of machines.
- Kubernetes worker nodeA worker node is a machine in a Kubernetes cluster that runs application workloads and node-level Kubernetes components.
- CoreDNSCoreDNS is a DNS server and plugin-based system that provides service discovery and name resolution for Kubernetes clusters.
- domain name systemThe Domain Name System, a hierarchical naming system that resolves domain or resource names to network addresses.
- configmapA ConfigMap is a Kubernetes API object that stores non-confidential configuration data for use by workloads or cluster components.
- podThe smallest deployable unit in Kubernetes, containing one or more containers that share networking and storage contexts.
- Kubernetes schedulerThe Kubernetes control-plane component that selects suitable nodes for running pods according to resources and placement rules.
- clusterroleA cluster role is a Kubernetes RBAC object that defines permissions for cluster-scoped resources or permissions usable across namespaces.
- persistent volumeA persistent volume is a Kubernetes API object representing storage provisioned for durable workload data.
- kubernetes api serverThe Kubernetes API server is the control-plane component that exposes the Kubernetes API and serves as the entry point for cluster communication.
- role-based access controlRole-based access control is an authorization model that grants permissions according to assigned roles.
- labelA label is a key-value metadata attribute attached to a Kubernetes object for identification, querying, or selection.
- custom resource definitionA custom resource definition is a Kubernetes API object that defines a new custom resource type and its schema.
- node selectorA node selector is a Kubernetes pod scheduling constraint that selects nodes according to their labels.
- ingress controllerAn ingress controller is a Kubernetes component that implements Ingress routing rules for external access to services.
- kubeadmA Kubernetes command-line tool for creating and configuring the components of a Kubernetes cluster.
- certificateA certificate is a digitally signed credential used to establish identity and support authenticated communication.
- cluster role bindingA ClusterRoleBinding is a Kubernetes API object that grants the permissions of a ClusterRole to specified subjects across the cluster.
- Kubernetes APIThe Kubernetes API is the interface through which Kubernetes resources and cluster operations are represented and accessed.
- gateway apiGateway API is a Kubernetes networking API for expressing and implementing traffic routing through gateway resources.
- control plane nodeThe control plane is the set of Kubernetes components that manage cluster state and coordinate cluster operations.
- service accountA Service Account is a Kubernetes API resource representing an identity usable by workloads and other cluster clients.
- persistent volume claimA persistent volume claim is a Kubernetes object that requests and reserves storage from a persistent volume.
- Container Runtime InterfaceThe Container Runtime Interface is the Kubernetes standard interface that container runtimes implement to integrate with kubelet.
- StorageClassA storage class is a Kubernetes object that describes a class of storage and supports dynamic storage provisioning.
- kubectl logskubectl logs is a Kubernetes command for retrieving logs from containers in pods.
- Kubernetes operatorA Kubernetes operator is a software extension that uses custom resources and control-loop logic to automate application or service management.
- kubeconfigA kubeconfig is a configuration file containing the cluster, user, and context information needed for Kubernetes client authentication and access.
- etcdetcd is a consistent distributed key-value store used by Kubernetes to persist cluster configuration and resource state.
- principle of least privilegeThe principle of least privilege is a security practice of granting only the permissions required for an identity or component to perform its duties.
- Kubernetes namespaceA Kubernetes namespace is a logical partition that scopes and organizes namespaced resources within a cluster.
- ReplicaSetA ReplicaSet is a Kubernetes object that maintains a specified number of equivalent pod replicas through a control loop.
- Kubernetes manifestA Kubernetes manifest is a declarative configuration document, typically written in YAML, that describes a resource's desired state.
- ingress objectAn Ingress is a Kubernetes API object that defines external HTTP or HTTPS routing rules to backend services.
- network policyA network policy is a Kubernetes API object that controls allowed traffic to and from pods using selectors and IP ranges.
- HelmHelm is a package manager for installing, configuring, and upgrading applications on Kubernetes.
- Certified Kubernetes Administrator examThe Certified Kubernetes Administrator (CKA) exam is a practical certification examination that assesses the skills required to administer Kubernetes clusters.
- kubectl auth can-ikubectl auth can-i is a kubectl authorization-check command that tests whether a specified identity is allowed to perform an action.
- crictlcrictl is a command-line client for inspecting and managing containers through a Kubernetes-compatible container runtime interface.
- Kubernetes SecretA Secret is a Kubernetes API object intended to hold sensitive data such as credentials or tokens.
- resource requestA CPU request is the amount of CPU capacity that a container requires for scheduling and resource-utilization calculations.
- kube-proxyKube-proxy is the Kubernetes node component that implements network forwarding rules for service traffic to pods.
- kubectl describekubectl describe is a kubectl command that displays detailed information about Kubernetes resources, including status, configuration, and events.
- logA log is time-based behavioral data recorded as text to provide information about events or problems in a running system.
- hostpath volumeA hostPath volume is a Kubernetes volume type that mounts a file or directory from the node's filesystem into a pod.
- kubectl editkubectl edit is a kubectl command that opens a Kubernetes resource for interactive modification and submits the changed configuration.
- environment variableAn environment variable is a named value made available to a process through its execution environment.
- taintA taint is a Kubernetes node attribute that repels pods from being scheduled on the node unless their specifications include a matching toleration.
- controller managerkube-controller-manager is the Kubernetes control-plane component that runs controller processes regulating cluster state.
- schedulingThe process of deploying applications to Kubernetes by assigning their pods to suitable execution resources.
- node cordonA cordon is a node operation that marks a Kubernetes node unschedulable for new pods while leaving existing pods running.
- pod selectorA pod selector is a label-based selector that identifies the pods to which a Kubernetes network policy applies.
- ServiceCIDRA ServiceCIDR is a Kubernetes resource that represents one or more IP address ranges allocated to Services.
- TokenRequest APIThe TokenRequest API is a Kubernetes API interface for obtaining tokens associated with Service Accounts.
- KustomizeKustomize is a Kubernetes-native configuration customization tool that composes and transforms resource manifests without requiring templating.
- affinityNode affinity is a Kubernetes scheduling technique that expresses preferences or requirements for placing pods on nodes.
- volume modeBlock volume mode exposes a persistent volume as an unformatted raw block device rather than a mounted filesystem.
- containerdContainerd is a lightweight, portable container runtime that implements the Container Runtime Interface.
- MetalLBMetalLB is a Kubernetes load-balancer implementation that provides external load-balancing capabilities for clusters without an integrated cloud load balancer.
- static podA static pod is a Kubernetes pod created and managed directly by the kubelet from a local manifest rather than scheduled by the Kubernetes scheduler.
- Helm chartA Helm chart is a package of templates and configuration that describes how to install an application and its Kubernetes resources.
- metrics-serverMetrics Server is a Kubernetes cluster component that collects resource-usage metrics from nodes and containers and exposes them through the resource metrics API.
- tolerationA toleration is a Kubernetes pod scheduling specification that permits placement on a node with a matching taint.
- Kindkind is a tool that runs local Kubernetes clusters using Docker container nodes.
- classless inter-domain routingCIDR is a notation for specifying IP address ranges using a network address and prefix length.
- userA user is an identity principal represented in a certificate for authenticating to the Kubernetes API.
- emptydir volumeAn emptyDir volume is a Kubernetes volume type that provides initially empty storage for a pod and is deleted when the pod is deleted.
- custom objectA custom resource is a Kubernetes API resource instance representing domain-specific state defined by a custom resource definition.
- kubectl applykubectl apply is a kubectl command that creates a Kubernetes resource or updates an existing resource from configuration.
- systemdsystemd is a Linux system and service manager that initializes the operating system and supervises services.
- CalicoCalico is a container networking and network-policy platform that provides Kubernetes pod connectivity and policy enforcement.
- FlannelFlannel is a container network plugin that provides Kubernetes pod networking across nodes.
- label selectorA label selector is a Kubernetes matching expression that identifies or associates objects by their labels.
- resource utilizationResource utilization is the amount of CPU or memory currently consumed by a node or workload.
- node drainNode draining is the process of evicting workloads from a node so it can be taken out of service or maintained.
- policy typeA NetworkPolicy policy type specifies whether the policy governs ingress isolation, egress isolation, or both.
- DaemonSetA DaemonSet is a Kubernetes workload resource that ensures a pod runs on each eligible node.
- automountserviceaccounttoken fieldA Kubernetes pod or service-account setting that controls automatic mounting of service-account credentials.
- projected volumeA Kubernetes volume type that presents projected sources such as service-account credentials to a pod.
- gateway objectA Gateway is a namespace-scoped Gateway API resource that defines listeners and the protocols, ports, and gateway class used for traffic entry.
- gatewayclassA GatewayClass is a cluster-scoped Gateway API resource that defines the controller responsible for implementing a class of gateways.
- HTTPRouteAn HTTPRoute is a Gateway API resource that defines HTTP host, path, and backend routing rules for application traffic.
- Recreate strategyA recreate strategy terminates all old workload instances before starting instances of the new version.
- rollout strategyA rollout strategy is a policy that determines how workload instances are replaced when an application version changes.
- certificate signing requestA Kubernetes CertificateSigningRequest is an API resource containing a requested certificate and the information needed to approve and issue it.
- kubectl uncordonUncordon is the operation of removing a Kubernetes node's unschedulable status so new pods can be scheduled onto it.
- nslookupnslookup is a command-line utility that queries DNS servers for domain and resource-record information.
- exact path typeExact is an Ingress path type that matches a path string exactly and case-sensitively.
- host-based routingHost-based routing is a traffic-routing technique that selects a backend according to the hostname in a request.
- implementation-specific path typeImplementationSpecific is an Ingress path type whose matching behavior is determined by the Ingress class.
- pathType fieldA path type is an Ingress rule setting that specifies how a URL path is matched.
- prefixPrefix is an Ingress path type that matches URL paths by their slash-delimited prefixes.
- groupA collection of Kubernetes user identities represented in authentication credentials for authorization decisions.
- kubectl drainkubectl drain is a kubectl command that evicts or removes pods from a specified Kubernetes node while applying workload-controller and daemon-set handling rules.
- YAMLYAML is a human-readable data serialization language commonly used for configuration files.
- contextA Kubernetes context is a kubeconfig entry that selects a cluster, user credentials, and optionally a namespace for client operations.
- Docker volume mountA volume mount is a container specification that makes a volume available at a path inside the container's filesystem.
- clusterip service typeA ClusterIP is a Kubernetes service type that exposes a service through an internal cluster IP address.
- cgroupA cgroup is a Linux kernel mechanism for organizing and controlling processes and their resource consumption.
- template engineA template engine is software that generates configuration or other output by substituting values into a parameterized template.
- values.yaml fileA values file is a YAML configuration file containing parameters that Helm substitutes into chart templates.
- autoscalingAutoscaling automatically adjusts workload or resource capacity in response to demand or measured conditions.
- CNI pluginA CNI plugin is software that configures container network interfaces and related network resources according to the Container Network Interface specification.
- dry runDry-run is a command option that simulates an operation without applying its resulting resource changes.
- kubectl topkubectl top is a kubectl command that displays current CPU and memory usage for Kubernetes nodes or pods.
- replicaA replica is an independently running copy of a pod or application instance that contributes to workload capacity and redundancy.
- resource limitA resource limit is the maximum amount of a resource, such as CPU or memory, that a Kubernetes container is permitted to consume.
- imperative programmingAn imperative approach prescribes the specific commands or sequence of actions needed to produce a result.
- Kustomize overlayAn overlay is a Kustomize configuration layer that applies environment-specific customizations to a shared set of Kubernetes manifests.
- nfs volumeAn NFS volume is a Kubernetes volume type that mounts a share from an NFS server for pod access.
- sidecar processThe sidecar pattern runs a supporting process alongside a primary application process, typically within the same pod.
- stateless systemA stateless application is an application whose individual instances do not retain essential client or session state locally between requests.
- private keyA private key is the secret cryptographic key used by an identity to prove possession of a public-key credential.
- security tokenAn authentication token is a credential value presented by a client or workload to authenticate access to an API or service.
- loadbalancer serviceA Kubernetes LoadBalancer Service type exposes a Service externally through an integrated or provisioned load balancer.
- declarative configurationA declarative approach specifies the desired end state while the system determines the operations needed to reach it.
- public-key infrastructurePublic key infrastructure is a security framework that uses public-key cryptography and trusted certificates to authenticate parties and protect communications.
- authorizationAuthorization is the process of determining which actions an authenticated subject may perform on protected resources.
- authenticationAuthentication is the process of verifying the identity of a user, workload, or system making a request.
- kubelet configurationKubelet configuration is the configuration data, commonly stored in a YAML file, that controls kubelet settings such as cluster DNS, certificates, cluster domain, and health endpoints.
- access modeAn access mode is a storage configuration specifying how many pods may read from or write to a volume.
- kindnetkindnet is the default Container Network Interface plugin used by kind clusters for local container networking.
- kubectl runkubectl run is a kubectl command that creates a pod from a specified container image and command options.
- CrashLoopBackOffCrashLoopBackOff is a Kubernetes pod status condition indicating repeated container crashes followed by progressively delayed restarts.
- native sidecarA native sidecar container is an init container with an Always restart policy that continues running alongside a pod's main application containers.
- daemonA daemon is a background process that runs persistently on an operating system without direct user interaction.
- fully qualified domain nameA fully qualified domain name is a complete DNS name that uniquely identifies a host or service within the DNS hierarchy.
- namespace selectorA namespace selector is a label-based selector that identifies namespaces whose pods may be included in a network policy rule.
- network address spaceAn IP block is a CIDR-defined range of IP addresses used as a source or destination in a network policy rule.
- kustomization.yamlA kustomization file is a Kustomize configuration document that declares resources and customization transformations for a Kubernetes application.
- rollbackRollback is the restoration of an application to a previous known configuration or version after a change.
- standard errorStandard error is the conventional output stream through which a process writes diagnostic and error messages.
- standard outputStandard output is the conventional output stream through which a process writes normal textual output.
- Container Storage InterfaceThe Container Storage Interface is a standard for exposing storage operations from container orchestrators to storage implementations.
- DockerDocker is a container platform for building, running, and managing container images and containers.
- kubectl getkubectl get is a kubectl subcommand that retrieves and displays Kubernetes resources and their attributes.
- Kubernetes eventA Kubernetes event is a recorded notification about a noteworthy change or occurrence involving a Kubernetes object or cluster component.
- helm chart repositoryA Helm chart repository is a server or storage location that hosts packaged, versioned Helm charts and their index metadata for distribution.
- pending stateA pending state is a Kubernetes pod phase in which the pod has been accepted but is not yet running, commonly because it has not been scheduled.
- certificate-based authenticationCertificate-based authentication verifies an identity using a signed digital certificate presented by the requesting client.
- ServiceAccount tokenA service account token is a credential associated with a Kubernetes ServiceAccount that authenticates workload requests to the Kubernetes API.
- X.509 certificateAn X.509 certificate is a standardized digital certificate format used to bind an identity to a public key.
- CloudNativePGCloudNativePG is an open-source Kubernetes operator for automating the management of PostgreSQL databases.
- bridge pluginA bridge plugin is a container-networking plugin that creates or configures a software bridge for connecting container network interfaces.
- overlay networkA network overlay is a virtual network abstraction built on top of an existing physical network to provide connectivity between workloads or nodes.
- VXLANVXLAN is a network virtualization protocol that encapsulates Layer 2 frames within Layer 3 packets to extend logical networks across routed infrastructure.
- goal-seekingA configuration approach that specifies a desired end state while leaving the path to that state to the system.
- idempotencyThe property that repeating the same operation produces no further change after the first successful application.
- reclaim policyA reclaim policy specifies what Kubernetes does with a persistent volume after its persistent volume claim is released.
- headless serviceA headless service is a Kubernetes Service configured without a cluster IP so DNS can return the addresses of its backing pods directly.
- bootstrap tokenA bootstrap token is a temporary bearer credential used to authenticate a node or client during Kubernetes cluster bootstrapping or node joining.
- join commandA join command is a command that configures a Kubernetes node to authenticate to and become a member of an existing cluster.
- resource allocationResource allocation is the CPU and memory capacity reserved for workloads through their resource requests.
- node portA NodePort is a Kubernetes service type that exposes a service on a port of each cluster node.
- debuggingTroubleshooting is the systematic investigation of symptoms and system behavior to identify and resolve operational problems.
- kube-scheduler.yamlA Kubernetes static-pod manifest that configures the scheduler process and its referenced settings and credentials.
- background processingA Linux background process is an operating-system process that runs without directly occupying an interactive terminal.
- Kustomize patchA Kustomize patch is a declarative transformation that changes selected fields of a Kubernetes resource without replacing its complete base manifest.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.