liveBookmanning.com

What you will learn in Kubernetes for Developers

by William Denniss

Read it on liveBook Get the book at manning.com

Chapter by chapter

Concepts explained in this book

• Kubernetes DeploymentA Kubernetes Deployment is an API object that manages the desired state and rollout of replicated application Pods.
• KubernetesKubernetes is an open-source container orchestration platform that automates deployment, scaling, and management of containerized workloads.
• HorizontalPodAutoscalerA pod autoscaler is a Kubernetes controller that adjusts the number of workload replicas according to resource or application metrics.
• persistent volume claimA PersistentVolumeClaim is a Kubernetes storage request that allows a workload to obtain persistent storage with specified capacity and access properties.
• declarative programmingDeclarative configuration specifies the desired state of a system rather than a sequence of operational commands.
• kubectlkubectl is the Kubernetes command-line client for creating, reading, updating, deleting, and otherwise managing Kubernetes resources.
• containerA container instance is a runtime invocation of a container image that persists as a Docker-managed container until it is removed.
• resource requestA resource request is the amount of a particular compute resource that a Kubernetes container is expected to need for scheduling and resource accounting.
• serviceA Kubernetes Service is a stable networking abstraction that provides connectivity to a group of Pods.
• label selectorA label selector field is a Kubernetes resource field that identifies matching objects according to their labels.
• persistent volumeA persistent volume is a Kubernetes storage resource that provides data storage intended to survive container or Pod replacement.
• configurationConfiguration is the set of declarative settings that specify how a service or system should operate.
• resource limitA resource limit is the maximum amount of a resource that Kubernetes permits a workload container to consume before enforcing the limit.
• ingress objectIngress is a Kubernetes API resource that routes external HTTP or HTTPS traffic to Services and can terminate or re-encrypt TLS connections.
• queueA task queue is an ordered collection of pending tasks awaiting processing by workers.
• readiness checkA readiness probe is a health test that determines whether an application instance is ready to receive user traffic.
• workerA worker Pod is a workload instance that performs units of work assigned by a coordinator.
• statefulnessA stateful application depends on persistent or retained state across requests, executions, or instance replacements.
• security contextA Kubernetes security context is a set of Pod or container settings that controls security-related execution properties such as the user identity.
• liveness checkA liveness probe is a Kubernetes health check that determines whether a running container is still functioning and should be allowed to continue running.
• podA Pod is the Kubernetes scheduling unit that groups one or more containers and treats them as a single unit.
• StatefulSetA StatefulSet is a Kubernetes workload resource that manages stateful Pods with stable identities and persistent storage associations.
• computer clusterA cluster is a group of machines managed together as a shared computing resource.
• jobA Kubernetes Job is a workload resource that runs a finite task to completion rather than maintaining a continuously running service.
• StorageClassA Kubernetes storage class describes a category of dynamically provisioned storage and the parameters used to create volumes in that category.
• internal serviceAn internal service is a Kubernetes Service addressed through a private cluster IP for communication among workloads inside the cluster.
• scalabilityScaling is the adjustment of application instances or computing capacity to match changing workload demand.
• reclaim policyA reclaim policy is a Kubernetes storage setting that determines what happens to underlying storage after its persistent volume is released.
• Docker ComposeA Docker Compose file is a declarative configuration file that defines the services, images, and settings for a Docker Compose application.
• deployment pipelineA deployment pipeline is an automated sequence of validation and delivery steps that promotes software or configuration changes to a deployment environment.
• stateless systemA stateless application is an application whose instances do not retain client or operational state between requests or executions.
• DockerDocker is a platform and toolset for building, packaging, and running containers.
• DockerfileA Dockerfile is a text file containing instructions for building a Docker container image.
• compositionObject composition in Kubernetes is a pattern in which a higher-order resource embeds the specification of a lower-level resource.
• role-based access controlRole-based access control is an authorization model that grants permissions according to assigned roles rather than directly to individual identities.
• configmapA ConfigMap is a Kubernetes object that stores non-confidential configuration data as key-value pairs or file contents.
• uptimeHigh availability is the property of an application remaining operational despite failures of individual infrastructure components or failure domains.
• pending statusPending is a Kubernetes Pod phase indicating that a Pod has been accepted but is not yet running, often because it lacks schedulable resources or constraints cannot be satisfied.
• Autopilot modeAutopilot mode is a Google Kubernetes Engine operating mode that automatically provisions, scales, repairs, and upgrades cluster compute capacity.
• autoscalingCluster autoscaling is the automated adjustment of cluster node capacity to provide resources for scheduled workloads.
• node selectorA node selector is a Pod scheduling constraint that requires placement on nodes matching specified label key-value pairs.
• quality of service classQuality of service is the Kubernetes classification and level of resource guarantees assigned to a workload based on its resource configuration.
• image tagA version tag is an identifier appended to an image reference to distinguish a particular image version.
• taintA Kubernetes taint is node metadata that prevents Pods without a matching toleration from being scheduled on the node according to its effect.
• tolerationA Kubernetes toleration is Pod scheduling configuration that permits placement on nodes with a matching taint without guaranteeing that placement.
• ordinal indexAn ordinal is an incrementing integer that identifies a Pod's stable position within a StatefulSet.
• service IPA cluster-local IP address is an address reachable within a Kubernetes cluster but not normally from the public internet.
• MinikubeMinikube is a tool for running a local Kubernetes cluster, commonly with a single node and optional multi-node configurations.
• namespaceA Kubernetes namespace is a logical scope that groups and isolates named resources within a cluster.
• API groupA Kubernetes API group is a named collection of related API resources and versions.
• authenticationAuthentication is the process of verifying or presenting an identity to obtain credentials for accessing a system.
• authentication and authorizationAuthorization is the process of determining which actions an authenticated identity may perform on system resources.
• cluster role bindingA Kubernetes ClusterRoleBinding assigns a ClusterRole to subjects at cluster scope.
• clusterroleA Kubernetes ClusterRole is a cluster-scoped object that defines permissions applicable across namespaces or to cluster-wide resources.
• federated identity integrationIdentity federation is an integration pattern that lets an external identity provider authenticate identities for another system.
• roleA Kubernetes Role is a namespace-scoped object that defines permissions for API groups, resources, and verbs.
• RoleBindingA Kubernetes RoleBinding is a namespace-scoped object that assigns a Role to subjects such as users, groups, or service accounts.
• service accountA Kubernetes ServiceAccount is an identity and credential object intended for workloads that access the Kubernetes API.
• configuration as codeConfiguration as code is a practice of representing system configuration in files that are managed like source code.
• imperative programmingAn imperative command directly instructs a system to perform an operational action rather than declaring the desired resulting state.
• TLS terminationTLS termination is the process of ending a TLS connection at an intermediary that handles encryption and certificate processing before forwarding the request.
• Kubernetes worker nodeA node is an individual machine that provides computing resources within a cluster.
• probeA liveness or readiness probe is a Kubernetes health check that determines whether a container should be restarted or can receive traffic.
• service discoveryService discovery is the process of locating available services and their network endpoints within a distributed system.
• rolling updateA rolling update incrementally replaces instances of an application with a new version while retaining some existing instances during the transition.
• Kubernetes SecretA Kubernetes Secret is an API object that stores sensitive data such as keys, certificates, and credentials.
• resource utilizationA CPU metric is a measurement of processor consumption or capacity associated with a workload.
• non-root containerA non-root container is a container whose processes run under a user identity other than the operating-system root user.
• container escape vulnerabilityA container escape vulnerability is a flaw that allows a process confined in a container to access resources or privileges outside the container.
• emptydir volumeemptyDir is a Kubernetes volume type that provides temporary node-backed storage for a Pod and is deleted when the Pod leaves the node.
• CrashLoopBackOffCrashLoopBackOff is a Kubernetes container status indicating repeated crashes followed by progressively delayed restart attempts.
• image pull errorAn image pull error is a Kubernetes failure state in which a cluster cannot download the container image required by a workload.
• exponential backoffExponential backoff is a retry strategy that increases the delay between successive attempts by an expanding factor.
• BLPOP commandThe Redis BLPOP command removes and returns the leftmost value from a list, blocking until a value is available when the list is empty.
• rpushThe Redis RPUSH command appends one or more values to the right end of a list.
• pod specificationA PodSpec is the Kubernetes specification that defines the containers and settings of a Pod.
• agent orchestrationA container orchestrator is a platform that schedules, operates, scales, and maintains containerized workloads across compute resources.
• bin-packingBin-packing is the placement of multiple workloads onto shared resources to maximize resource utilization while respecting constraints.
• custom resource definitionA custom resource definition is a Kubernetes API extension that introduces a new resource type with a user-defined schema.
• Kubernetes operatorThe operator pattern packages domain-specific operational logic in a controller that reconciles custom resources toward their desired state.
• workload abstractionWorkload abstraction is an infrastructure abstraction in which applications are specified as deployable workload requirements rather than individual machines.
• YAMLYAML is a human-readable data serialization format commonly used for structured configuration.
• restart policyA restart policy is a Pod setting that determines whether workloads are restarted after termination or failure.
• container imageA Docker image is an immutable package containing a filesystem, application code, dependencies, and metadata used to create a Docker container.
• volume claim templateA volume claim template is a StatefulSet specification template from which Kubernetes creates a PersistentVolumeClaim for each Pod.
• base imageA base image is a Docker image that provides the initial filesystem and runtime environment for building another application image.
• external metricAn external metric is a monitoring measurement sourced outside a Kubernetes cluster and exposed for workload autoscaling.
• throughputRequests per second is a throughput metric measuring the number of requests received or processed during one second.
• affinityNode affinity is a Kubernetes scheduling constraint that requires or prefers placing a Pod on nodes whose labels match specified expressions.
• defense in depthDefense in depth is a security strategy that layers multiple independent protections so that failure of one protection does not compromise the entire system.
• privileged portA privileged port is a network port below 1024 that traditionally requires elevated operating-system privileges for a process to bind to it.
• labelA Kubernetes label is an arbitrary key-value metadata pair attached to an object for identification and selection.
• reproducibilityReproducibility is the ability to recreate the same application environment from a recorded set of build instructions and inputs.
• container registryA container repository is a storage location that stores and distributes container images identified by image names and tags.
• Pod Security StandardsA restricted Pod security profile is a Kubernetes security configuration that applies the strictest restrictions to Pod execution and container privileges.
• preemptionPreemption is the proactive removal of lower-priority Pods to make resources available for higher-priority Pods.
• PriorityClassA PriorityClass is a Kubernetes resource that defines a priority value and related preemption behavior for Pods.
• resource contentionResource contention is competition among workloads for finite computing resources on shared infrastructure.
• background processingBackground processing is execution of application work asynchronously or outside the primary request-handling path.
• pod security admissionPod Security admission is a Kubernetes admission mechanism that enforces Pod security policies when resources are submitted to the API.
• runAsNonRootrunAsNonRoot is a Kubernetes security-context setting that requires a container process to run as a non-root user.
• restricted policyThe Restricted Pod Security profile applies stricter defense-in-depth requirements, including preventing containers from running as the root user.
• dependencyAn external dependency is a separately running service or resource that an application requires to perform some operations.
• loadbalancer serviceA LoadBalancer Service is a Kubernetes Service type that requests an externally reachable network load balancer and external IP address.
• port forwardingPort forwarding maps a network port on one endpoint to a port on another endpoint so traffic can reach a service.
• cronjobA Kubernetes CronJob is a workload resource that creates Jobs on a recurring schedule.
• graceful shutdownA graceful shutdown is an orderly process termination that stops accepting new work and allows in-progress work to finish.
• termination grace periodA termination grace period is the amount of time Kubernetes allows a Pod to terminate gracefully before forced termination.
• host-based routingHost-based routing directs requests to different backends according to the hostname in the request.
• L4 load balancerA layer-4 load balancer distributes network traffic based on transport-layer information such as protocol, address, and port.
• layer-7 load balancerA layer-7 load balancer distributes application-layer requests using information such as HTTP paths and hostnames.
• path-based routingPath-based routing directs requests to different backends according to the URI path.
• nodeless KubernetesNodeless Kubernetes is a managed Kubernetes operating model that abstracts node provisioning and management while retaining node-related scheduling semantics.
• incrementing primary keyAn incrementing primary key is a record identifier generated by increasing a numeric value for each inserted record.
• N + 1 query problemThe N+1 query problem is a database access pattern in which one query retrieves a collection and additional queries retrieve related data for each item.
• read replicationA read replica is a synchronized database instance that serves read operations separately from a primary writable instance.
• SQLAn SQL query is a declarative statement that requests or manipulates data in a relational database.
• universally unique identifierA UUID is a 128-bit identifier designed to be generated with a very low probability of collision across clients and systems.
• replica capacityReplica capacity is the number of requests per second that one workload replica can serve.
• kubectl applykubectl apply is a kubectl command that creates or updates Kubernetes resources from declarative configuration.
• blue-green deploymentA blue/green strategy is a rollout technique that runs old and new application versions side by side and switches traffic between them.
• admission controllerAn admission controller is a Kubernetes component that validates or mutates API requests before they are persisted.
• repositoryA Git repository is a data store containing versioned files and the history of changes made to them.
• dynamic provisioningDynamic provisioning automatically creates persistent storage resources when a workload submits a compatible storage request.
• spread topologyA spread topology is a scheduling constraint that distributes Pods across specified topology domains such as zones or nodes.
• pod evictionPod eviction is the removal of a Pod from a node to reclaim resources during resource pressure or contention.
• volumeA Kubernetes volume is a directory-backed storage abstraction accessible to containers in a Pod, with its medium and contents determined by its volume type.
• microservice architectureMicroservices is an architectural pattern that structures an application as multiple independently maintained services.
• indexed jobAn indexed Job is a Kubernetes Job whose task instances are identified by distinct completion indexes assigned to its Pods.
• ReplicaSetA ReplicaSet is a Kubernetes workload resource that maintains a set of Pods matching a specified Pod template and replica count.
• Google Cloud SDKgcloud is the Google Cloud command-line interface for managing Google Cloud resources and services.
• Kubernetes EngineGoogle Kubernetes Engine is Google Cloud's managed Kubernetes service.
• DNS-based service discoveryDNS-based service discovery is a service-discovery method that resolves a service name to its network endpoint through DNS.
• environment variable discoveryEnvironment variable discovery is a service-discovery method that exposes a service endpoint to a workload through an environment variable.
• configmap volumeA ConfigMap volume is a read-only Kubernetes volume that exposes ConfigMap data to containers as files.
• noscheduleNoSchedule is a Kubernetes taint effect that prevents new Pods lacking a matching toleration from being scheduled on a node.
• max skewMax skew is a topology-spread setting that limits the permitted difference in Pod counts between topology domains.
• topology keyA topology key is a node-label key whose values define the topology domains considered equivalent for spreading workloads.
• unsatisfiable constraint behaviorUnsatisfiable constraint behavior determines how scheduling proceeds when a topology-spread constraint cannot be met.
• Kubernetes resourceA Kubernetes object is a persistent API resource that represents a desired or observed entity in a Kubernetes system.
• virtual machineA virtual machine is a software-emulated computer that provides an application with an isolated operating environment and typically includes a guest operating system.
• Kubernetes controllerA Kubernetes controller is a control-loop component that observes resource state and takes actions to move it toward the desired state.
• baseline policyThe Baseline Pod Security profile prevents Pods from elevating privileges to obtain administrative access while preserving broader compatibility.
• clusterip service typeClusterIP is a Kubernetes Service type that assigns a cluster-internal IP address for access from within the cluster.
• language flexibilityLanguage flexibility is the ability to deploy applications written in different programming languages and using different dependency versions on the same platform.
• lightweight isolationLightweight isolation separates application processes and their dependencies without duplicating an entire operating system for each application.
• resource isolationResource isolation restricts an application environment to specified amounts of host CPU, memory, or other system resources.
• image pull policyAn image pull policy is a Kubernetes Pod setting that determines when a container image is pulled from a registry.
• certificateA TLS certificate is a digital certificate that authenticates a network endpoint and supports Transport Layer Security connections.
• access modeAn access mode specifies how and by how many Pods a persistent volume may be mounted for reading and writing.
• readwriteonceReadWriteOnce is a persistent-storage access mode that permits a volume to be mounted for read-write use by a single node.
• Recreate strategyA re-create strategy replaces a deployed workload by stopping all instances of the old version before starting instances of the new version.
• best-effort QoS classThe BestEffort QoS class is a Kubernetes Pod quality-of-service classification assigned when containers have no resource requests or limits.
• pod disruption budgetA Pod Disruption Budget is a Kubernetes policy that limits the number of Pods from a workload that can be voluntarily disrupted at once.
• canary deploymentA rollout is the controlled propagation of an application or platform update across its deployed instances or locations.
• environment variableAn environment variable is a named value supplied through a process environment to provide runtime configuration.
• priority-based schedulingPriority is an integer value assigned to a Pod that influences its scheduling order and eviction ranking.
• managed certificateA managed certificate is a cloud-managed certificate resource whose provisioning, renewal, and deployment are handled automatically for specified domains.
• self-signed certificateA self-signed certificate is a certificate signed by its own subject rather than by a trusted certificate authority.
• TLSTLS is a cryptographic protocol that encrypts network communication and can authenticate endpoints using certificates.
• kubeletThe kubelet is a Kubernetes node agent that communicates with the control plane and manages container lifecycle on its node.
• placeholder podA placeholder Pod is a low-priority Kubernetes Pod scheduled to reserve cluster capacity that can be reclaimed when higher-priority workloads need resources.
• backoff limitA backoff limit is a Job setting that specifies how many execution attempts are allowed before the Job is considered failed.
• parallelism fieldParallelism is a Kubernetes Job setting that specifies how many Pod instances may run concurrently.
• resource burstingResource bursting is the temporary use of computing capacity above a workload's normal requested amount when capacity is available.
• exec probeA command-based probe is a Kubernetes probe that runs a command in a container and evaluates its exit status.
• zero downtimeA zero downtime update is an application update performed without interrupting service availability to users.
• GitOps operatorA GitOps operator is a cluster-resident control loop that reconciles running resources with declarative configuration stored in a version-controlled repository.
• burstable classThe burstable QoS class is a Kubernetes Pod quality-of-service classification for Pods whose resource limits exceed their requests or are only partially specified.
• health checkA health check is an operational test or signal indicating whether an application or process is functioning correctly.
• static queueA static queue is a finite work assignment in which the number of tasks is declared in advance and a separate workload instance processes each task.

These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.