Containers & Kubernetes

Kubernetes is the de-facto container orchestration platform. Understanding it deeply is essential for any platform or DevSecOps engineer operating modern infrastructure.

Prerequisites

• Comfort with Linux command line (Essential Commands)
• Basic understanding of containers (Docker run, images, volumes)

Architecture overview

Control Plane                          Worker Nodes
┌────────────────────────┐            ┌──────────────────┐
│  kube-apiserver        │◄──────────►│  kubelet         │
│  etcd                  │            │  kube-proxy      │
│  kube-controller-mgr   │            │  container runtime│
│  kube-scheduler        │            │  Pods            │
└────────────────────────┘            └──────────────────┘

• kube-apiserver — the front door; everything talks to this
• etcd — distributed key-value store; the source of truth for cluster state
• kube-scheduler — assigns pods to nodes based on resource requirements and constraints
• kube-controller-manager — reconciliation loops (ReplicaSet, Deployment, Node controllers)
• kubelet — agent on each node; ensures containers in pods are running
• kube-proxy — manages iptables/ipvs rules for Service networking

Core resources

Resource	What it does
Pod	Smallest deployable unit — one or more containers sharing network and storage
Deployment	Manages replicated Pods with rolling updates and rollback
StatefulSet	Like Deployment, but for stateful workloads — stable pod names and persistent storage
DaemonSet	Runs one pod per node — used for logging, monitoring agents
Service	Stable network endpoint for a set of Pods
Ingress	HTTP/HTTPS routing from outside the cluster to Services
ConfigMap / Secret	Inject configuration and credentials into Pods
Namespace	Virtual cluster — isolate resources, apply RBAC and quotas

Essential kubectl commands

# Context management
kubectl config get-contexts
kubectl config use-context prod

# Pod operations
kubectl get pods -n default
kubectl get pods -A                    # all namespaces
kubectl describe pod my-pod
kubectl logs my-pod -f                 # follow logs
kubectl exec -it my-pod -- /bin/sh     # shell into pod

# Apply manifests
kubectl apply -f deployment.yaml
kubectl delete -f deployment.yaml

# Rollout
kubectl rollout status deployment/app
kubectl rollout undo deployment/app    # rollback

Where to go next

Kubernetes Security Hardening — CIS benchmarks, network policies, admission control