Kubernetes Core Objects Cheat Sheet Practice Exam

Question 1 Kubernetes Core Objects Cheat Sheet

What is Pod Security Admission (PSA)?

A NetworkPolicy specifies how groups of Pods are allowed to communicate with each other and other network endpoints, enforced by a CNI plugin. A Role grants access to a single namespace; a ClusterRole grants cluster-wide access or access to non-namespaced resources and can be reused across namespaces via RoleBinding. PSA is a built-in admission controller enforcing Pod Security Standards with three levels: privileged, baseline, and restricted, configured per namespace via labels. kube-proxy is a network component on each node that maintains iptables, IPVS, or eBPF rules to implement Kubernetes Service virtual IPs and load balance traffic to backend Pods.

Question 2 Kubernetes Core Objects Cheat Sheet

Which Pods are evicted first under node pressure?

imagePullPolicy controls when the kubelet pulls the container image: Always, IfNotPresent, or Never; :latest defaults to Always, others to IfNotPresent. Pods are evicted in this order: BestEffort, then Burstable that exceed requests, then Burstable that are within requests, with Guaranteed last. A Namespace is a logical partition within a cluster used to divide resources between multiple users, teams, or environments and to enforce scope for names and policies. maxUnavailable is the maximum number of Pods that may be unavailable during the update; maxSurge is the maximum number of Pods that may be created over the desired count.

Question 3 Kubernetes Core Objects Cheat Sheet

What is a Service in Kubernetes?

kube-proxy is a network component on each node that maintains iptables, IPVS, or eBPF rules to implement Kubernetes Service virtual IPs and load balance traffic to backend Pods. Requests are the amount of a resource guaranteed to a container for scheduling; limits are the maximum amount the container is allowed to use (enforced at runtime). A Service is an abstraction that defines a logical set of Pods and a policy to access them, usually via a stable virtual IP and DNS name. A Deployment strategy controls how Pods are replaced when updating; the two built-in strategies are RollingUpdate and Recreate.

Question 4 Kubernetes Core Objects Cheat Sheet

What fields are required in a Pod spec?

A CRD extends the Kubernetes API by defining a new resource type with its own schema, validated by an OpenAPI v3 schema. kube-proxy reads EndpointSlices to program iptables/IPVS/eBPF rules and route Service VIP traffic to the right Pod IPs. apiVersion, kind: Pod, metadata.name, spec.containers[].name, and at least one container image. Secrets are intended for confidential data and may be encrypted at rest and exposed only on demand; ConfigMaps hold plain, non-sensitive configuration.

Question 5 Kubernetes Core Objects Cheat Sheet

What is a LimitRange?

A NetworkPolicy specifies how groups of Pods are allowed to communicate with each other and other network endpoints, enforced by a CNI plugin. PSA is a built-in admission controller enforcing Pod Security Standards with three levels: privileged, baseline, and restricted, configured per namespace via labels. A Pod-level field spec.restartPolicy with values Always, OnFailure, or Never; defaults to Always for normal Pods, OnFailure for Jobs, and Never for CronJob-style workloads. A LimitRange enforces minimum, maximum, default requests, and default limits for individual containers or Pods within a namespace.

Question 6 Kubernetes Core Objects Cheat Sheet

What probe handler types does Kubernetes support?

A ConfigMap stores non-confidential configuration data as key-value pairs that can be mounted into Pods as files or environment variables. HTTP GET (HTTPGetAction), TCP socket (TCPSocketAction), and exec command (ExecAction), plus grpc (1.24+). A controller that intercepts API requests before persistence to mutate objects, used by service meshes, sidecar injectors (Istio), and secret backends. A toleration is applied to a Pod to allow (but not require) it to be scheduled onto a node with a matching taint.

Question 7 Kubernetes Core Objects Cheat Sheet

How are QoS classes assigned?

A Job runs one or more Pods to perform a batch task to completion, tracking successful completions and supporting parallel execution. A Volume is a directory accessible to containers in a Pod, with a lifetime tied to the Pod (or longer when backed by a PV). Guaranteed: every container has limits equal to requests for both CPU and memory. BestEffort: no container sets any requests or limits. Burstable: all other cases. A Service uses a label selector to dynamically route traffic to Pods whose labels match; endpoints are updated automatically by the endpoints controller.

Question 8 Kubernetes Core Objects Cheat Sheet

What is an Annotation?

Every namespace has a default ServiceAccount; Pods that do not specify one are assigned it automatically. A native sidecar container (GA in 1.29+) is declared in initContainers with restartPolicy: Always and shares the Pod lifecycle; a "sidecar app" is a conventional co-located container using a shared network namespace. An Annotation is a non-identifying key-value pair used to attach arbitrary metadata to objects, often used by tools, libraries, or operators for configuration. PSA is a built-in admission controller enforcing Pod Security Standards with three levels: privileged, baseline, and restricted, configured per namespace via labels.

Question 9 Kubernetes Core Objects Cheat Sheet

What is the kubelet?

PSA is a built-in admission controller enforcing Pod Security Standards with three levels: privileged, baseline, and restricted, configured per namespace via labels. The kubelet is an agent running on each node that registers the node with the API server, watches for Pod specs assigned to it, and ensures the described containers are running and healthy. With --grace-period=0 --force, the Pod is removed from the API server immediately without sending SIGTERM, potentially causing data loss or in-flight errors. The Scheduler is a control plane component that watches for newly created Pods with no node assigned and selects a node for them to run on based on resources, affinity, taints, and policies.

Question 10 Kubernetes Core Objects Cheat Sheet

What is a custom resource definition (CRD)?

A CRD extends the Kubernetes API by defining a new resource type with its own schema, validated by an OpenAPI v3 schema. A ReplicaSet manages a stable set of identical Pods and ensures a specified number of pod replicas are running at any given time. A Namespace is a logical partition within a cluster used to divide resources between multiple users, teams, or environments and to enforce scope for names and policies. Choose a StatefulSet when Pods need stable network IDs, stable persistent storage, or ordered, graceful deployment and scaling (e.g., databases, message brokers).

Question 11 Kubernetes Core Objects Cheat Sheet

How are StatefulSet Pods named?

StatefulSet Pods are named <statefulset-name>-<ordinal-index> starting from 0, e.g. web-0, web-1, with stable DNS records like web-0.nginx.default.svc.cluster.local. serviceName references the governing Headless Service whose DNS entries provide stable network identities for each Pod in the StatefulSet. Resource metrics (CPU, memory) from the metrics-server, custom metrics from the custom-metrics API, and external metrics from the external-metrics API. If no NetworkPolicy selects a Pod, all ingress and egress traffic is allowed (default-allow).

Question 12 Kubernetes Core Objects Cheat Sheet

What is a NodePort Service?

A liveness probe is a kubelet check that determines when to restart a container; if the probe fails, the kubelet kills and restarts the container. Role-Based Access Control (RBAC) is an authorization mode that uses Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings to permit API operations for users, groups, or ServiceAccounts. A ServiceAccount provides an identity for processes running in a Pod, used to authenticate to the API server and to be authorized by RBAC. A NodePort Service exposes the Service on each node's IP at a static port (default range 30000–32767), reachable from outside the cluster via :.

Question 13 Kubernetes Core Objects Cheat Sheet

What is a RoleBinding?

A Pod is the smallest deployable unit in Kubernetes; it encapsulates one or more tightly coupled containers that share a network namespace, IPC, and optionally volumes. A ReplicaSet ensures a desired replica count using a label selector; a Deployment manages one or more ReplicaSets and adds declarative update, rollback, and rollout history features. The kube-apiserver is the front end of the Kubernetes control plane, exposing the REST API and serving as the only component that directly talks to etcd. A RoleBinding grants the permissions in a Role or ClusterRole to subjects (User, Group, or ServiceAccount) within a namespace.

Question 14 Kubernetes Core Objects Cheat Sheet

What is a NetworkPolicy?

A Kubernetes event is a time-stamped record of state changes, warnings, or errors emitted by components (kubelet, scheduler, controllers), viewable via kubectl describe or kubectl get events. Requests are the amount of a resource guaranteed to a container for scheduling; limits are the maximum amount the container is allowed to use (enforced at runtime). A ServiceAccount provides an identity for processes running in a Pod, used to authenticate to the API server and to be authorized by RBAC. A NetworkPolicy specifies how groups of Pods are allowed to communicate with each other and other network endpoints, enforced by a CNI plugin.

Question 15 Kubernetes Core Objects Cheat Sheet

What is a PodSecurityPolicy (PSP)?

serviceName references the governing Headless Service whose DNS entries provide stable network identities for each Pod in the StatefulSet. A NetworkPolicy specifies how groups of Pods are allowed to communicate with each other and other network endpoints, enforced by a CNI plugin. A Namespace is a logical partition within a cluster used to divide resources between multiple users, teams, or environments and to enforce scope for names and policies. A PSP was a cluster-level resource (deprecated in 1.21, removed in 1.25) controlling security-sensitive Pod fields. It is replaced by Pod Security Admission (PSA).

Question 16 Kubernetes Core Objects Cheat Sheet

What is an EndpointSlice?

serviceName references the governing Headless Service whose DNS entries provide stable network identities for each Pod in the StatefulSet. The kube-apiserver is the front end of the Kubernetes control plane, exposing the REST API and serving as the only component that directly talks to etcd. A Selector is an expression that matches a set of objects based on their labels; it is used by Services, Deployments, and network policies to target groups of objects. An EndpointSlice is a scalable, grouped reference to a set of network endpoints for a Service, replacing the legacy Endpoints API in large clusters.

Question 17 Kubernetes Core Objects Cheat Sheet

How does a Service discover backend Pods?

A Service uses a label selector to dynamically route traffic to Pods whose labels match; endpoints are updated automatically by the endpoints controller. PSA is a built-in admission controller enforcing Pod Security Standards with three levels: privileged, baseline, and restricted, configured per namespace via labels. A Pod represents a single instance of a running process in a cluster and is described by a Pod manifest containing metadata (labels, annotations) and a pod spec. A ConfigMap stores non-confidential configuration data as key-value pairs that can be mounted into Pods as files or environment variables.

Question 18 Kubernetes Core Objects Cheat Sheet

What does the controller-manager do?

The controller-manager runs core control loops (controllers) that regulate cluster state, such as the Node controller, Job controller, EndpointSlice controller, and ServiceAccount controller. A Role grants access to a single namespace; a ClusterRole grants cluster-wide access or access to non-namespaced resources and can be reused across namespaces via RoleBinding. A LimitRange enforces minimum, maximum, default requests, and default limits for individual containers or Pods within a namespace. The kubelet is an agent running on each node that registers the node with the API server, watches for Pod specs assigned to it, and ensures the described containers are running and healthy.

Question 19 Kubernetes Core Objects Cheat Sheet

What is the difference between Endpoints and EndpointSlices?

Choose a StatefulSet when Pods need stable network IDs, stable persistent storage, or ordered, graceful deployment and scaling (e.g., databases, message brokers). Endpoints store all backend Pods in a single object; EndpointSlices split them into multiple smaller objects, reducing update size and enabling scalable routing in large clusters. Secrets are intended for confidential data and may be encrypted at rest and exposed only on demand; ConfigMaps hold plain, non-sensitive configuration. A ServiceAccount provides an identity for processes running in a Pod, used to authenticate to the API server and to be authorized by RBAC.

Question 20 Kubernetes Core Objects Cheat Sheet

What is a `progressDeadlineSeconds`?

The time (default 600s) after which a Deployment is considered failed if it has not made progress toward its desired state; it pauses further rollouts. behavior fields let you configure scaleUp and scaleDown policies with stabilization windows and policies to prevent flapping. Guaranteed: every container has limits equal to requests for both CPU and memory. BestEffort: no container sets any requests or limits. Burstable: all other cases. QoS classifies Pods as Guaranteed, Burstable, or BestEffort based on requests/limits, used to decide eviction priority under node pressure.

Question 21 Kubernetes Core Objects Cheat Sheet

What does a Job controller do?

A Job runs one or more Pods to perform a batch task to completion, tracking successful completions and supporting parallel execution. The kubelet is an agent running on each node that registers the node with the API server, watches for Pod specs assigned to it, and ensures the described containers are running and healthy. etcd is a consistent, distributed key-value store used as the backing store for all cluster data in Kubernetes; it requires a quorum and stores the cluster state. A Label is a key-value pair attached to objects (Pods, Services, etc.) used for identification, grouping, and selection by selectors and Service meshes.

Question 22 Kubernetes Core Objects Cheat Sheet

What is the API server's default authentication chain?

It applies the configuration in file.yaml to the cluster, creating or updating the described resources to match the desired state. X509 client certs, bearer tokens (ServiceAccount), then OpenID Connect tokens, bootstrap tokens, and anonymous auth (when enabled). A Role grants access to a single namespace; a ClusterRole grants cluster-wide access or access to non-namespaced resources and can be reused across namespaces via RoleBinding. A Selector is an expression that matches a set of objects based on their labels; it is used by Services, Deployments, and network policies to target groups of objects.

Question 23 Kubernetes Core Objects Cheat Sheet

What is a Deployment strategy?

apiVersion, kind: Pod, metadata.name, spec.containers[].name, and at least one container image. reclaimPolicy determines what happens to a PV after its PVC is deleted: Retain, Recycle (deprecated), or Delete. The control loops observe actual state vs. desired state and take corrective action: replacing failed Pods, rescheduling on node loss, and removing unready Pods from Service backends. A Deployment strategy controls how Pods are replaced when updating; the two built-in strategies are RollingUpdate and Recreate.

Question 24 Kubernetes Core Objects Cheat Sheet

What is the kube-apiserver?

An emptyDir volume is created when a Pod is assigned to a node and exists as long as the Pod runs; it is initially empty and stored on the node's local medium. A Role grants access to a single namespace; a ClusterRole grants cluster-wide access or access to non-namespaced resources and can be reused across namespaces via RoleBinding. The kube-apiserver is the front end of the Kubernetes control plane, exposing the REST API and serving as the only component that directly talks to etcd. A StatefulSet manages the deployment and scaling of a set of Pods with stable, unique network identities and persistent per-pod storage.

Question 25 Kubernetes Core Objects Cheat Sheet

What is a self-healing mechanism in Kubernetes?

The Scheduler is a control plane component that watches for newly created Pods with no node assigned and selects a node for them to run on based on resources, affinity, taints, and policies. Requests are the amount of a resource guaranteed to a container for scheduling; limits are the maximum amount the container is allowed to use (enforced at runtime). A controller that intercepts API requests before persistence to mutate objects, used by service meshes, sidecar injectors (Istio), and secret backends. The control loops observe actual state vs. desired state and take corrective action: replacing failed Pods, rescheduling on node loss, and removing unready Pods from Service backends.

Question 26 Kubernetes Core Objects Cheat Sheet

What is the default behavior if no NetworkPolicy matches a Pod?

kubectl is the official command-line client used to interact with the Kubernetes API server, supporting CRUD operations on resources and streaming logs/exec. A Kubernetes event is a time-stamped record of state changes, warnings, or errors emitted by components (kubelet, scheduler, controllers), viewable via kubectl describe or kubectl get events. kube-proxy reads EndpointSlices to program iptables/IPVS/eBPF rules and route Service VIP traffic to the right Pod IPs. If no NetworkPolicy selects a Pod, all ingress and egress traffic is allowed (default-allow).

Question 27 Kubernetes Core Objects Cheat Sheet

What is a Kubernetes release cadence?

A VPA automatically adjusts CPU and memory requests/limits for containers based on historical usage, recommended for stateful or single-replica workloads. Approximately three minor releases per year; each minor release is supported for about 14 months (9 months active, then 5 months security only). The controller-manager runs core control loops (controllers) that regulate cluster state, such as the Node controller, Job controller, EndpointSlice controller, and ServiceAccount controller. A Volume is a directory accessible to containers in a Pod, with a lifetime tied to the Pod (or longer when backed by a PV).

Question 28 Kubernetes Core Objects Cheat Sheet

What happens when a container exceeds its memory limit?

kubectl port-forward forwards a local port to a port in a Pod, useful for debugging services locally without exposing them cluster-wide. The container is terminated with OOMKilled exit status; for CPU, the container is throttled rather than killed. A ClusterIP Service exposes the Service on a cluster-internal IP, making it reachable only from within the cluster. It is the default Service type. A Job runs once and finishes; a CronJob creates Jobs on a schedule and manages their lifecycle, including concurrency policy and history limits.

Question 29 Kubernetes Core Objects Cheat Sheet

What is a toleration?

Recreate terminates all existing Pods before creating new ones, causing downtime but avoiding two versions running simultaneously—useful for incompatible schema migrations. A toleration is applied to a Pod to allow (but not require) it to be scheduled onto a node with a matching taint. A network plugin (CNI) that supports NetworkPolicy enforcement, such as Calico, Cilium, or Weave Net, must be installed. A Job runs once and finishes; a CronJob creates Jobs on a schedule and manages their lifecycle, including concurrency policy and history limits.

Question 30 Kubernetes Core Objects Cheat Sheet

What does `maxUnavailable` and `maxSurge` mean?

The controller-manager runs core control loops (controllers) that regulate cluster state, such as the Node controller, Job controller, EndpointSlice controller, and ServiceAccount controller. serviceName references the governing Headless Service whose DNS entries provide stable network identities for each Pod in the StatefulSet. A Role grants access to a single namespace; a ClusterRole grants cluster-wide access or access to non-namespaced resources and can be reused across namespaces via RoleBinding. maxUnavailable is the maximum number of Pods that may be unavailable during the update; maxSurge is the maximum number of Pods that may be created over the desired count.

Question 31 Kubernetes Core Objects Cheat Sheet

What does `CrashLoopBackOff` indicate?

A Deployment strategy controls how Pods are replaced when updating; the two built-in strategies are RollingUpdate and Recreate. CrashLoopBackOff means a container is repeatedly crashing; the kubelet waits an increasing backoff time (10s, 20s, 40s up to 5 minutes) before restarting. Every namespace has a default ServiceAccount; Pods that do not specify one are assigned it automatically. A Service is an abstraction that defines a logical set of Pods and a policy to access them, usually via a stable virtual IP and DNS name.

Question 32 Kubernetes Core Objects Cheat Sheet

What fields identify a Node?

A Helm chart is a package of pre-configured Kubernetes resources templated with Go templates, parameterized via a values.yaml file, used to release and manage applications. A NetworkPolicy with no podSelector applies to all Pods in the namespace; an empty ingress or egress rule list allows all matching traffic. An ExternalName Service maps a Service to a CNAME DNS record, allowing pods to reach an external service via a cluster-internal name. metadata.name, addresses (InternalIP, ExternalIP, Hostname), nodeInfo (kubelet version, OS, architecture), and conditions (Ready, MemoryPressure, DiskPressure, PIDPressure).

Question 33 Kubernetes Core Objects Cheat Sheet

What is a Secret?

A Secret is an object used to store sensitive data such as passwords, tokens, or keys, base64-encoded and mountable as files or env vars (optionally with encryption at rest). initialDelaySeconds, periodSeconds, timeoutSeconds, successThreshold, failureThreshold, and terminationGracePeriodSeconds. An Init Container is a specialized container that runs to completion before the main containers of a Pod start, used for setup, migration, or waiting for dependencies. A readiness probe determines whether a container is ready to receive traffic; Pods whose containers fail readiness are removed from Service endpoints.

Question 34 Kubernetes Core Objects Cheat Sheet

What is a Label in Kubernetes?

A Label is a key-value pair attached to objects (Pods, Services, etc.) used for identification, grouping, and selection by selectors and Service meshes. The controller-manager runs core control loops (controllers) that regulate cluster state, such as the Node controller, Job controller, EndpointSlice controller, and ServiceAccount controller. A taint is a key-value-effect triplet applied to a node that repels Pods which do not tolerate that taint, e.g. NoSchedule, PreferNoSchedule, NoExecute. ReadWriteOnce (RWO), ReadOnlyMany (ROX), ReadWriteMany (RWX), ReadWriteOncePod (RWOP, Kubernetes 1.22+), and WriteOnce (deprecated).

Question 35 Kubernetes Core Objects Cheat Sheet

What does `kubectl get pods -A` do?

A NetworkPolicy specifies how groups of Pods are allowed to communicate with each other and other network endpoints, enforced by a CNI plugin. maxUnavailable is the maximum number of Pods that may be unavailable during the update; maxSurge is the maximum number of Pods that may be created over the desired count. It lists all Pods across all namespaces; the -A (or --all-namespaces) flag overrides the current namespace setting. A StorageClass describes the "classes" of storage offered by a cluster, defining the provisioner, parameters, and reclaim policy for dynamically provisioned PVs.

Question 36 Kubernetes Core Objects Cheat Sheet

What is pod anti-affinity?

Pod anti-affinity prevents Pods from being scheduled on the same node, zone, or topology domain as other matching Pods, used to spread load or improve availability. Use kubectl logs <pod> [-c <container>]; for previous runs use --previous, and for live tailing use -f. A Job runs once and finishes; a CronJob creates Jobs on a schedule and manages their lifecycle, including concurrency policy and history limits. A bootstrap token is a short-lived token (24h+) used to authenticate new nodes joining a cluster, typically during kubeadm join.

Question 37 Kubernetes Core Objects Cheat Sheet

When would you choose a StatefulSet over a Deployment?

The Scheduler is a control plane component that watches for newly created Pods with no node assigned and selects a node for them to run on based on resources, affinity, taints, and policies. A LoadBalancer Service provisions an external load balancer (cloud-provider specific) that routes traffic to backend nodes, exposing the Service on a public IP. A VPA automatically adjusts CPU and memory requests/limits for containers based on historical usage, recommended for stateful or single-replica workloads. Choose a StatefulSet when Pods need stable network IDs, stable persistent storage, or ordered, graceful deployment and scaling (e.g., databases, message brokers).

Question 38 Kubernetes Core Objects Cheat Sheet

What is a bootstrap token?

A bootstrap token is a short-lived token (24h+) used to authenticate new nodes joining a cluster, typically during kubeadm join. PDB can specify minAvailable (absolute or percentage) or maxUnavailable (absolute or percentage) of Pods that must remain available. A Service uses a label selector to dynamically route traffic to Pods whose labels match; endpoints are updated automatically by the endpoints controller. The controller-manager runs core control loops (controllers) that regulate cluster state, such as the Node controller, Job controller, EndpointSlice controller, and ServiceAccount controller.

Question 39 Kubernetes Core Objects Cheat Sheet

What is a container restart policy?

An EndpointSlice is a scalable, grouped reference to a set of network endpoints for a Service, replacing the legacy Endpoints API in large clusters. StatefulSet Pods are named <statefulset-name>-<ordinal-index> starting from 0, e.g. web-0, web-1, with stable DNS records like web-0.nginx.default.svc.cluster.local. Most workload and configuration resources are namespaced, including Pods, Services, Deployments, ConfigMaps, Secrets, and Jobs. Nodes and PersistentVolumes are cluster-scoped. A Pod-level field spec.restartPolicy with values Always, OnFailure, or Never; defaults to Always for normal Pods, OnFailure for Jobs, and Never for CronJob-style workloads.

Question 40 Kubernetes Core Objects Cheat Sheet

What is a ValidatingAdmissionPolicy?

A RoleBinding grants the permissions in a Role or ClusterRole to subjects (User, Group, or ServiceAccount) within a namespace. A readiness probe determines whether a container is ready to receive traffic; Pods whose containers fail readiness are removed from Service endpoints. A ValidatingAdmissionPolicy is a CEL-based admission policy that validates incoming API requests declaratively, replacing many webhook-based validators (beta in 1.30). The cloud-controller-manager embeds cloud-specific control logic, separating it from the core control plane, including node lifecycle, routes, and load balancer integration with the cloud provider.

Question 41 Kubernetes Core Objects Cheat Sheet

When is `hostPath` appropriate?

hostPath mounts a file or directory from the host node's filesystem into a Pod; suitable only for system-level or single-node development use, not portable workloads. A startup probe indicates when an application has started; it disables liveness and readiness checks until it succeeds, useful for slow-starting containers. Guaranteed: every container has limits equal to requests for both CPU and memory. BestEffort: no container sets any requests or limits. Burstable: all other cases. X509 client certs, bearer tokens (ServiceAccount), then OpenID Connect tokens, bootstrap tokens, and anonymous auth (when enabled).

Question 42 Kubernetes Core Objects Cheat Sheet

How does the control plane track Node health?

CrashLoopBackOff means a container is repeatedly crashing; the kubelet waits an increasing backoff time (10s, 20s, 40s up to 5 minutes) before restarting. An EndpointSlice is a scalable, grouped reference to a set of network endpoints for a Service, replacing the legacy Endpoints API in large clusters. The Node controller monitors heartbeats from kubelets; if a node stops reporting within node-monitor-grace-period (default 40s), its status is marked NotReady and Pods are eventually rescheduled. It applies the configuration in file.yaml to the cluster, creating or updating the described resources to match the desired state.

Question 43 Kubernetes Core Objects Cheat Sheet

What is a PersistentVolumeClaim (PVC)?

A DaemonSet ensures that a copy of a Pod runs on all (or a subset of) nodes, typically used for node-level agents like log shippers, monitoring, or CNI plugins. PSA is a built-in admission controller enforcing Pod Security Standards with three levels: privileged, baseline, and restricted, configured per namespace via labels. A PersistentVolumeClaim is a request for storage by a user; it consumes a PV that matches its requested size, access mode, and storage class. revisionHistoryLimit is the number of old ReplicaSets retained for rollback; the default is 10. Setting it to 0 disables rollback history.

Question 44 Kubernetes Core Objects Cheat Sheet

What is the Kubernetes Scheduler?

The control loops observe actual state vs. desired state and take corrective action: replacing failed Pods, rescheduling on node loss, and removing unready Pods from Service backends. Node affinity is a Pod spec field that attracts Pods to a set of nodes based on labels, using requiredDuringSchedulingIgnoredDuringExecution or preferredDuringSchedulingIgnoredDuringExecution. maxUnavailable is the maximum number of Pods that may be unavailable during the update; maxSurge is the maximum number of Pods that may be created over the desired count. The Scheduler is a control plane component that watches for newly created Pods with no node assigned and selects a node for them to run on based on resources, affinity, taints, and policies.

Question 45 Kubernetes Core Objects Cheat Sheet

What is a Headless Service?

An Operator is a method of packaging, deploying, and managing a Kubernetes application using CRDs and custom controllers, encoding operational knowledge. A Headless Service (clusterIP: None) does not provide load balancing or a virtual IP; instead DNS returns the Pods' IPs directly, useful for stateful sets and custom discovery. kubectl exec runs a new command in a container; kubectl attach attaches to the main process's STDIN/STDOUT, similar to docker attach. A Deployment strategy controls how Pods are replaced when updating; the two built-in strategies are RollingUpdate and Recreate.

Question 46 Kubernetes Core Objects Cheat Sheet

What does `reclaimPolicy` control in a StorageClass or PV?

A Service is an abstraction that defines a logical set of Pods and a policy to access them, usually via a stable virtual IP and DNS name. PSA is a built-in admission controller enforcing Pod Security Standards with three levels: privileged, baseline, and restricted, configured per namespace via labels. imagePullPolicy controls when the kubelet pulls the container image: Always, IfNotPresent, or Never; :latest defaults to Always, others to IfNotPresent. reclaimPolicy determines what happens to a PV after its PVC is deleted: Retain, Recycle (deprecated), or Delete.

Question 47 Kubernetes Core Objects Cheat Sheet

What is a Pod manifest?

A Pod manifest is a YAML or JSON file with apiVersion, kind, metadata, and spec fields describing the desired Pod state, submitted to the API server. initialDelaySeconds, periodSeconds, timeoutSeconds, successThreshold, failureThreshold, and terminationGracePeriodSeconds. A StatefulSet manages the deployment and scaling of a set of Pods with stable, unique network identities and persistent per-pod storage. kubectl is the official command-line client used to interact with the Kubernetes API server, supporting CRUD operations on resources and streaming logs/exec.

Question 48 Kubernetes Core Objects Cheat Sheet

What is a liveness probe?

Approximately three minor releases per year; each minor release is supported for about 14 months (9 months active, then 5 months security only). Pod anti-affinity prevents Pods from being scheduled on the same node, zone, or topology domain as other matching Pods, used to spread load or improve availability. A liveness probe is a kubelet check that determines when to restart a container; if the probe fails, the kubelet kills and restarts the container. maxUnavailable is the maximum number of Pods that may be unavailable during the update; maxSurge is the maximum number of Pods that may be created over the desired count.

Question 49 Kubernetes Core Objects Cheat Sheet

What does `kubectl rollout undo` do?

maxUnavailable is the maximum number of Pods that may be unavailable during the update; maxSurge is the maximum number of Pods that may be created over the desired count. reclaimPolicy determines what happens to a PV after its PVC is deleted: Retain, Recycle (deprecated), or Delete. A ReplicaSet ensures a desired replica count using a label selector; a Deployment manages one or more ReplicaSets and adds declarative update, rollback, and rollout history features. kubectl rollout undo rolls a Deployment, StatefulSet, or DaemonSet back to a previous revision by updating its spec to the stored prior ReplicaSet.

Question 50 Kubernetes Core Objects Cheat Sheet

What is required for NetworkPolicy to take effect?

An ExternalName Service maps a Service to a CNAME DNS record, allowing pods to reach an external service via a cluster-internal name. A network plugin (CNI) that supports NetworkPolicy enforcement, such as Calico, Cilium, or Weave Net, must be installed. HTTP GET (HTTPGetAction), TCP socket (TCPSocketAction), and exec command (ExecAction), plus grpc (1.24+). kube-proxy reads EndpointSlices to program iptables/IPVS/eBPF rules and route Service VIP traffic to the right Pod IPs.