DevOps, SRE & Cloud Interview · Containers & Kubernetes · Lesson 2 of 3
Kubernetes: the core objects
Kubernetes is a container orchestrator: you declare the desired state and its control loop continuously works to make reality match. You almost never act on containers directly — you declare higher-level objects.
- Pod: the smallest deployable unit — one or more tightly-coupled containers sharing a network/IP and storage. Pods are ephemeral and disposable.
- Deployment: manages a ReplicaSet to keep N identical pod replicas running, and handles rolling updates and rollbacks for stateless apps.
- Service: a stable virtual IP + DNS name that load-balances across a changing set of pods (selected by labels) — because pod IPs come and go.
- ConfigMap / Secret: inject configuration and sensitive values into pods (env vars or mounted files), keeping config out of the image.
- StatefulSet: like a Deployment but for stateful workloads needing stable identities and storage (databases); DaemonSet: one pod per node (agents, log shippers).
- Ingress: HTTP(S) routing and TLS termination from outside the cluster to Services.
Desired state, not stepsYou tell Kubernetes 'I want 5 replicas', not 'start a container'. If a pod dies or a node fails, the controller notices the gap between desired and actual and reconciles — recreating pods to restore 5. It is a thermostat, not a switch.
Pods are cattle, not petsNever treat a pod as durable. It has no stable IP, can be evicted or rescheduled at any time, and loses its local disk. Put a Service in front for a stable address and a PersistentVolume behind it for durable data.
◆ Lock it in
- Kubernetes is declarative: you set desired state, a control loop reconciles reality to it.
- Pod (unit) → Deployment (N replicas + rolling updates) → Service (stable IP/LB) → Ingress (external HTTP/TLS).
- StatefulSet for stateful apps, DaemonSet for per-node agents, ConfigMap/Secret for config.
Feynman drill — say it out loudWalk from a Pod up to external traffic: what does a Deployment, a Service, and an Ingress each add?
Step 1 rate your confidence · Step 2 pick your answer
Why do you put a Service in front of pods instead of calling pods directly?
Step 1 — how sure are you?