Title: Kubernetes Core Objects Cheatsheet — LearnCoachAssist

Q: What is a Kubernetes Pod?
A: A Pod is the smallest deployable unit in Kubernetes; it encapsulates one or more tightly coupled containers that share a network namespace, IPC, and optionally volumes.

Q: What does a Pod represent in the Kubernetes object model?
A: A Pod represents a single instance of a running process in a cluster and is described by a Pod manifest containing metadata (labels, annotations) and a pod spec.

Q: What Kubernetes object directly manages a set of identical Pods?
A: A ReplicaSet manages a stable set of identical Pods and ensures a specified number of pod replicas are running at any given time.

Q: What controller is most commonly used to deploy stateless workloads in production?
A: A Deployment, which manages a ReplicaSet and provides declarative updates, rolling updates, and rollback capability.

Q: What is the purpose of a StatefulSet?
A: A StatefulSet manages the deployment and scaling of a set of Pods with stable, unique network identities and persistent per-pod storage.

Q: When would you choose a StatefulSet over a Deployment?
A: Choose a StatefulSet when Pods need stable network IDs, stable persistent storage, or ordered, graceful deployment and scaling (e.g., databases, message brokers).

Q: What is a DaemonSet?
A: A DaemonSet ensures that a copy of a Pod runs on all (or a subset of) nodes, typically used for node-level agents like log shippers, monitoring, or CNI plugins.

Q: What does a Job controller do?
A: A Job runs one or more Pods to perform a batch task to completion, tracking successful completions and supporting parallel execution.

Q: What is a CronJob?
A: A CronJob manages time-scheduled Jobs by creating Job objects on a cron schedule, similar to Unix crontab entries.

Q: How does a CronJob differ from a Job?
A: A Job runs once and finishes; a CronJob creates Jobs on a schedule and manages their lifecycle, including concurrency policy and history limits.

Q: What is a Service in Kubernetes?
A: A Service is an abstraction that defines a logical set of Pods and a policy to access them, usually via a stable virtual IP and DNS name.

Q: How does a Service discover backend Pods?
A: A Service uses a label selector to dynamically route traffic to Pods whose labels match; endpoints are updated automatically by the endpoints controller.

Q: What is a ClusterIP Service?
A: A ClusterIP Service exposes the Service on a cluster-internal IP, making it reachable only from within the cluster. It is the default Service type.

Q: What is a NodePort Service?
A: A NodePort Service exposes the Service on each node's IP at a static port (default range 30000–32767), reachable from outside the cluster via :.

Q: What is a LoadBalancer Service?
A: A LoadBalancer Service provisions an external load balancer (cloud-provider specific) that routes traffic to backend nodes, exposing the Service on a public IP.

Q: What is a Headless Service?
A: A Headless Service (clusterIP: None) does not provide load balancing or a virtual IP; instead DNS returns the Pods' IPs directly, useful for stateful sets and custom discovery.

Q: What is an ExternalName Service?
A: An ExternalName Service maps a Service to a CNAME DNS record, allowing pods to reach an external service via a cluster-internal name.

Q: What is a Kubernetes Namespace?
A: A Namespace is a logical partition within a cluster used to divide resources between multiple users, teams, or environments and to enforce scope for names and policies.

Q: What resource types are namespaced in Kubernetes?
A: Most workload and configuration resources are namespaced, including Pods, Services, Deployments, ConfigMaps, Secrets, and Jobs. Nodes and PersistentVolumes are cluster-scoped.

Q: What is the default namespace?
A: The default namespace is named default and is used when a resource is created without specifying a namespace.

Q: What is a ConfigMap used for?
A: A ConfigMap stores non-confidential configuration data as key-value pairs that can be mounted into Pods as files or environment variables.

Q: What is a Secret?
A: A Secret is an object used to store sensitive data such as passwords, tokens, or keys, base64-encoded and mountable as files or env vars (optionally with encryption at rest).

Q: How do Secrets differ from ConfigMaps?
A: Secrets are intended for confidential data and may be encrypted at rest and exposed only on demand; ConfigMaps hold plain, non-sensitive configuration.

Q: What is a PersistentVolume (PV)?
A: A PersistentVolume is a piece of storage in the cluster provisioned by an administrator or dynamically by a StorageClass; it is a cluster-scoped resource representing durable storage.

Q: What is a PersistentVolumeClaim (PVC)?
A: A PersistentVolumeClaim is a request for storage by a user; it consumes a PV that matches its requested size, access mode, and storage class.

Q: What are the access modes supported by PersistentVolumes?
A: ReadWriteOnce (RWO), ReadOnlyMany (ROX), ReadWriteMany (RWX), ReadWriteOncePod (RWOP, Kubernetes 1.22+), and WriteOnce (deprecated).

Q: What is a StorageClass?
A: A StorageClass describes the "classes" of storage offered by a cluster, defining the provisioner, parameters, and reclaim policy for dynamically provisioned PVs.

Q: What does reclaimPolicy control in a StorageClass or PV?
A: reclaimPolicy determines what happens to a PV after its PVC is deleted: Retain, Recycle (deprecated), or Delete.

Q: What is a Volume in the Pod context?
A: A Volume is a directory accessible to containers in a Pod, with a lifetime tied to the Pod (or longer when backed by a PV).

Q: Name common volume types.
A: emptyDir, hostPath, configMap, secret, persistentVolumeClaim, nfs, awsElasticBlockStore, gcePersistentDisk, azureDisk, csi.

Q: What is an emptyDir volume?
A: An emptyDir volume is created when a Pod is assigned to a node and exists as long as the Pod runs; it is initially empty and stored on the node's local medium.

Q: When is hostPath appropriate?
A: hostPath mounts a file or directory from the host node's filesystem into a Pod; suitable only for system-level or single-node development use, not portable workloads.

Q: What is a Label in Kubernetes?
A: A Label is a key-value pair attached to objects (Pods, Services, etc.) used for identification, grouping, and selection by selectors and Service meshes.

Q: What is an Annotation?
A: An Annotation is a non-identifying key-value pair used to attach arbitrary metadata to objects, often used by tools, libraries, or operators for configuration.

Q: What is a Selector?
A: A Selector is an expression that matches a set of objects based on their labels; it is used by Services, Deployments, and network policies to target groups of objects.

Q: What is a Node?
A: A Node is a worker machine (physical or virtual) in Kubernetes where Pods run; it is managed by the control plane and reports its capacity and state.

Q: What fields identify a Node?
A: metadata.name, addresses (InternalIP, ExternalIP, Hostname), nodeInfo (kubelet version, OS, architecture), and conditions (Ready, MemoryPressure, DiskPressure, PIDPressure).

Q: How does the control plane track Node health?
A: The Node controller monitors heartbeats from kubelets; if a node stops reporting within node-monitor-grace-period (default 40s), its status is marked NotReady and Pods are eventually rescheduled.

Q: What is a taint on a Node?
A: A taint is a key-value-effect triplet applied to a node that repels Pods which do not tolerate that taint, e.g. NoSchedule, PreferNoSchedule, NoExecute.

Q: What is a toleration?
A: A toleration is applied to a Pod to allow (but not require) it to be scheduled onto a node with a matching taint.

Q: What is node affinity?
A: Node affinity is a Pod spec field that attracts Pods to a set of nodes based on labels, using requiredDuringSchedulingIgnoredDuringExecution or preferredDuringSchedulingIgnoredDuringExecution.

Q: What is pod anti-affinity?
A: Pod anti-affinity prevents Pods from being scheduled on the same node, zone, or topology domain as other matching Pods, used to spread load or improve availability.

Q: What is the Kubernetes Scheduler?
A: The Scheduler is a control plane component that watches for newly created Pods with no node assigned and selects a node for them to run on based on resources, affinity, taints, and policies.

Q: What is the kubelet?
A: The kubelet is an agent running on each node that registers the node with the API server, watches for Pod specs assigned to it, and ensures the described containers are running and healthy.

Q: What is kube-proxy?
A: kube-proxy is a network component on each node that maintains iptables, IPVS, or eBPF rules to implement Kubernetes Service virtual IPs and load balance traffic to backend Pods.

Q: What is the etcd component used for?
A: etcd is a consistent, distributed key-value store used as the backing store for all cluster data in Kubernetes; it requires a quorum and stores the cluster state.

Q: What is the kube-apiserver?
A: The kube-apiserver is the front end of the Kubernetes control plane, exposing the REST API and serving as the only component that directly talks to etcd.

Q: What does the controller-manager do?
A: The controller-manager runs core control loops (controllers) that regulate cluster state, such as the Node controller, Job controller, EndpointSlice controller, and ServiceAccount controller.

Q: What is the cloud-controller-manager?
A: The cloud-controller-manager embeds cloud-specific control logic, separating it from the core control plane, including node lifecycle, routes, and load balancer integration with the cloud provider.

Q: What is an Init Container?
A: An Init Container is a specialized container that runs to completion before the main containers of a Pod start, used for setup, migration, or waiting for dependencies.

Q: How does a sidecar container differ from a sidecar app?
A: A native sidecar container (GA in 1.29+) is declared in initContainers with restartPolicy: Always and shares the Pod lifecycle; a "sidecar app" is a conventional co-located container using a shared network namespace.

Q: What is a liveness probe?
A: A liveness probe is a kubelet check that determines when to restart a container; if the probe fails, the kubelet kills and restarts the container.

Q: What is a readiness probe?
A: A readiness probe determines whether a container is ready to receive traffic; Pods whose containers fail readiness are removed from Service endpoints.

Q: What is a startup probe?
A: A startup probe indicates when an application has started; it disables liveness and readiness checks until it succeeds, useful for slow-starting containers.

Q: What probe handler types does Kubernetes support?
A: HTTP GET (HTTPGetAction), TCP socket (TCPSocketAction), and exec command (ExecAction), plus grpc (1.24+).

Q: What fields control probe behaviour?
A: initialDelaySeconds, periodSeconds, timeoutSeconds, successThreshold, failureThreshold, and terminationGracePeriodSeconds.

Q: What is a Deployment strategy?
A: A Deployment strategy controls how Pods are replaced when updating; the two built-in strategies are RollingUpdate and Recreate.

Q: What does maxUnavailable and maxSurge mean?
A: maxUnavailable is the maximum number of Pods that may be unavailable during the update; maxSurge is the maximum number of Pods that may be created over the desired count.

Q: What does kubectl rollout undo do?
A: kubectl rollout undo rolls a Deployment, StatefulSet, or DaemonSet back to a previous revision by updating its spec to the stored prior ReplicaSet.

Q: What is a HorizontalPodAutoscaler (HPA)?
A: An HPA automatically scales the number of Pod replicas in a Deployment, StatefulSet, or ReplicaSet based on observed CPU utilization, custom metrics, or external metrics.

Q: What metrics sources can the HPA use?
A: Resource metrics (CPU, memory) from the metrics-server, custom metrics from the custom-metrics API, and external metrics from the external-metrics API.

Q: What is a VerticalPodAutoscaler (VPA)?
A: A VPA automatically adjusts CPU and memory requests/limits for containers based on historical usage, recommended for stateful or single-replica workloads.

Q: What is a PodDisruptionBudget (PDB)?
A: A PDB limits the number of Pods of a set that can be voluntarily disrupted at once (e.g., during node drains), ensuring availability during maintenance.

Q: What are PDB disruption limits?
A: PDB can specify minAvailable (absolute or percentage) or maxUnavailable (absolute or percentage) of Pods that must remain available.

Q: What is a HorizontalPodAutoscaler update behavior?
A: behavior fields let you configure scaleUp and scaleDown policies with stabilization windows and policies to prevent flapping.

Q: What is the difference between requests and limits?
A: Requests are the amount of a resource guaranteed to a container for scheduling; limits are the maximum amount the container is allowed to use (enforced at runtime).

Q: What happens when a container exceeds its memory limit?
A: The container is terminated with OOMKilled exit status; for CPU, the container is throttled rather than killed.

Q: What is the Quality of Service (QoS) class?
A: QoS classifies Pods as Guaranteed, Burstable, or BestEffort based on requests/limits, used to decide eviction priority under node pressure.

Q: How are QoS classes assigned?
A: Guaranteed: every container has limits equal to requests for both CPU and memory. BestEffort: no container sets any requests or limits. Burstable: all other cases.

Q: Which Pods are evicted first under node pressure?
A: Pods are evicted in this order: BestEffort, then Burstable that exceed requests, then Burstable that are within requests, with Guaranteed last.

Q: What is a ResourceQuota?
A: A ResourceQuota is a namespace-level object that constrains aggregate resource consumption (CPU, memory, object counts) within a namespace.

Q: What is a LimitRange?
A: A LimitRange enforces minimum, maximum, default requests, and default limits for individual containers or Pods within a namespace.

Q: What is a NetworkPolicy?
A: A NetworkPolicy specifies how groups of Pods are allowed to communicate with each other and other network endpoints, enforced by a CNI plugin.

Q: What is required for NetworkPolicy to take effect?
A: A network plugin (CNI) that supports NetworkPolicy enforcement, such as Calico, Cilium, or Weave Net, must be installed.

Q: What does an empty NetworkPolicy selector mean?
A: A NetworkPolicy with no podSelector applies to all Pods in the namespace; an empty ingress or egress rule list allows all matching traffic.

Q: What is the default behavior if no NetworkPolicy matches a Pod?
A: If no NetworkPolicy selects a Pod, all ingress and egress traffic is allowed (default-allow).

Q: What is a PodSecurityContext?
A: A PodSecurityContext sets security-relevant settings at the Pod level: runAsUser, runAsGroup, fsGroup, seccompProfile, runAsNonRoot, and supplemental groups.

Q: What is a ServiceAccount?
A: A ServiceAccount provides an identity for processes running in a Pod, used to authenticate to the API server and to be authorized by RBAC.

Q: What is the default ServiceAccount in a namespace?
A: Every namespace has a default ServiceAccount; Pods that do not specify one are assigned it automatically.

Q: What is RBAC?
A: Role-Based Access Control (RBAC) is an authorization mode that uses Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings to permit API operations for users, groups, or ServiceAccounts.

Q: What is the difference between Role and ClusterRole?
A: A Role grants access to a single namespace; a ClusterRole grants cluster-wide access or access to non-namespaced resources and can be reused across namespaces via RoleBinding.

Q: What is a RoleBinding?
A: A RoleBinding grants the permissions in a Role or ClusterRole to subjects (User, Group, or ServiceAccount) within a namespace.

Q: What is an EndpointSlice?
A: An EndpointSlice is a scalable, grouped reference to a set of network endpoints for a Service, replacing the legacy Endpoints API in large clusters.

Q: How does kube-proxy use EndpointSlices?
A: kube-proxy reads EndpointSlices to program iptables/IPVS/eBPF rules and route Service VIP traffic to the right Pod IPs.

Q: What is the difference between Endpoints and EndpointSlices?
A: Endpoints store all backend Pods in a single object; EndpointSlices split them into multiple smaller objects, reducing update size and enabling scalable routing in large clusters.

Q: What is a custom resource definition (CRD)?
A: A CRD extends the Kubernetes API by defining a new resource type with its own schema, validated by an OpenAPI v3 schema.

Q: What is an Operator?
A: An Operator is a method of packaging, deploying, and managing a Kubernetes application using CRDs and custom controllers, encoding operational knowledge.

Q: What is kubectl?
A: kubectl is the official command-line client used to interact with the Kubernetes API server, supporting CRUD operations on resources and streaming logs/exec.

Q: Common kubectl commands for resources?
A: kubectl get, kubectl describe, kubectl create, kubectl apply, kubectl delete, kubectl edit, kubectl patch, kubectl delete --grace-period=0.

Q: What does kubectl apply -f file.yaml do?
A: It applies the configuration in file.yaml to the cluster, creating or updating the described resources to match the desired state.

Q: What does kubectl get pods -A do?
A: It lists all Pods across all namespaces; the -A (or --all-namespaces) flag overrides the current namespace setting.

Q: How do you view the logs of a container in a Pod?
A: Use kubectl logs <pod> [-c <container>]; for previous runs use --previous, and for live tailing use -f.

Q: What is a side-effect of kubectl delete without grace period?
A: With --grace-period=0 --force, the Pod is removed from the API server immediately without sending SIGTERM, potentially causing data loss or in-flight errors.

Q: What is a Helm chart?
A: A Helm chart is a package of pre-configured Kubernetes resources templated with Go templates, parameterized via a values.yaml file, used to release and manage applications.

Q: What is a release in Helm?
A: A Helm release is an instance of a chart running in a cluster, with its own name, namespace, and version history, allowing upgrades, rollbacks, and uninstalls.

Q: What is a Pod manifest?
A: A Pod manifest is a YAML or JSON file with apiVersion, kind, metadata, and spec fields describing the desired Pod state, submitted to the API server.

Q: What fields are required in a Pod spec?
A: apiVersion, kind: Pod, metadata.name, spec.containers[].name, and at least one container image.

Q: What does imagePullPolicy control?
A: imagePullPolicy controls when the kubelet pulls the container image: Always, IfNotPresent, or Never; :latest defaults to Always, others to IfNotPresent.

Q: What is the difference between a Deployment and a ReplicaSet?
A: A ReplicaSet ensures a desired replica count using a label selector; a Deployment manages one or more ReplicaSets and adds declarative update, rollback, and rollout history features.

Q: What is revisionHistoryLimit on a Deployment?
A: revisionHistoryLimit is the number of old ReplicaSets retained for rollback; the default is 10. Setting it to 0 disables rollback history.

Q: What is a strategy: Recreate Deployment?
A: Recreate terminates all existing Pods before creating new ones, causing downtime but avoiding two versions running simultaneously—useful for incompatible schema migrations.

Q: What is a progressDeadlineSeconds?
A: The time (default 600s) after which a Deployment is considered failed if it has not made progress toward its desired state; it pauses further rollouts.

Q: What is a StatefulSet's serviceName field?
A: serviceName references the governing Headless Service whose DNS entries provide stable network identities for each Pod in the StatefulSet.

Q: How are StatefulSet Pods named?
A: StatefulSet Pods are named <statefulset-name>-<ordinal-index> starting from 0, e.g. web-0, web-1, with stable DNS records like web-0.nginx.default.svc.cluster.local.

Q: What is a Pod's status phases?
A: Pending, Running, Succeeded, Failed, and Unknown—high-level summary, not a comprehensive state machine.

Q: What does CrashLoopBackOff indicate?
A: CrashLoopBackOff means a container is repeatedly crashing; the kubelet waits an increasing backoff time (10s, 20s, 40s up to 5 minutes) before restarting.

Q: What is a container restart policy?
A: A Pod-level field spec.restartPolicy with values Always, OnFailure, or Never; defaults to Always for normal Pods, OnFailure for Jobs, and Never for CronJob-style workloads.

Q: What is a Kubernetes event?
A: A Kubernetes event is a time-stamped record of state changes, warnings, or errors emitted by components (kubelet, scheduler, controllers), viewable via kubectl describe or kubectl get events.

Q: What is the default Kubernetes DNS service name?
A: kube-dns (or coredns when using CoreDNS) is the cluster-internal DNS service; Pods resolve Service names via <svc>.<ns>.svc.cluster.local.

Q: What is a PodSecurityPolicy (PSP)?
A: A PSP was a cluster-level resource (deprecated in 1.21, removed in 1.25) controlling security-sensitive Pod fields. It is replaced by Pod Security Admission (PSA).

Q: What is Pod Security Admission (PSA)?
A: PSA is a built-in admission controller enforcing Pod Security Standards with three levels: privileged, baseline, and restricted, configured per namespace via labels.

Q: What is a ValidatingAdmissionPolicy?
A: A ValidatingAdmissionPolicy is a CEL-based admission policy that validates incoming API requests declaratively, replacing many webhook-based validators (beta in 1.30).

Q: What is a MutatingAdmissionWebhook?
A: A controller that intercepts API requests before persistence to mutate objects, used by service meshes, sidecar injectors (Istio), and secret backends.

Q: What is a self-healing mechanism in Kubernetes?
A: The control loops observe actual state vs. desired state and take corrective action: replacing failed Pods, rescheduling on node loss, and removing unready Pods from Service backends.

Q: What is the difference between kubectl exec and kubectl attach?
A: kubectl exec runs a new command in a container; kubectl attach attaches to the main process's STDIN/STDOUT, similar to docker attach.

Q: What is kubectl port-forward?
A: kubectl port-forward forwards a local port to a port in a Pod, useful for debugging services locally without exposing them cluster-wide.

Q: What is the API server's default authentication chain?
A: X509 client certs, bearer tokens (ServiceAccount), then OpenID Connect tokens, bootstrap tokens, and anonymous auth (when enabled).

Q: What is a bootstrap token?
A: A bootstrap token is a short-lived token (24h+) used to authenticate new nodes joining a cluster, typically during kubeadm join.

Q: What is kubeadm?
A: kubeadm is the official bootstrapping tool that creates a minimum viable, conformant Kubernetes cluster, handling certificates, control plane init, and node join.

Q: What is a Kubernetes release cadence?
A: Approximately three minor releases per year; each minor release is supported for about 14 months (9 months active, then 5 months security only).