Kubernetes

You can name every control plane and node component, explain the reconciliation loop, and talk to a cluster with kubectl.

1. 1Desired state and reconciliationYou can explain why deleting a Pod created by a Deployment causes a replacement to appear immediately.11m28xp
2. 2Control plane componentsYou can state the responsibility of the API server, etcd, scheduler and controller manager and predict what breaks if each stops.12m30xp
3. 3Node componentsYou can describe how the kubelet, container runtime and kube-proxy cooperate to run a Pod on a node.11m28xp
4. 4kubectl and kubeconfigYou can switch contexts and namespaces and know which cluster a command will hit before running it.11m28xp
5. 5The shape of an API objectYou can write a manifest with correct apiVersion, kind, metadata and spec for any resource type.12m30xp
6. 6NamespacesYou can scope resources into namespaces and identify which resource types are cluster-scoped instead.10m25xp
7. 7Labels and selectorsYou can select an exact set of objects using equality and set-based label selectors.11m28xp
8. 8Imperative commands versus applyYou can choose between create, apply and replace and explain how apply merges changes.10m25xp
9. 9Cluster inspection commandsYou can gather cluster version, node capacity and component health before diagnosing any problem.10m25xp
10. 10etcd and cluster stateYou can explain why etcd backups are the single most important cluster safeguard.11m28xp

You can run, configure and debug Pods and understand their lifecycle and container patterns.

1. 1What a Pod isYou can explain why the Pod, not the container, is the smallest deployable unit.11m28xp
2. 2Pod phases and conditionsYou can read a Pod's phase and conditions and identify where in the lifecycle it stalled.11m28xp
3. 3Restart policy and CrashLoopBackOffYou can diagnose a CrashLoopBackOff by reading logs from the previous container instance.11m28xp
4. 4Init containersYou can order setup work in init containers that must complete before the main container starts.11m28xp
5. 5Sidecar and multi-container patternsYou can decide when a helper belongs in the same Pod as a sidecar rather than in its own Pod.11m28xp
6. 6Liveness probesYou can configure a liveness probe that restarts a genuinely hung container without killing a slow one.11m28xp
7. 7Readiness probesYou can use a readiness probe to withhold traffic from a Pod that is alive but not yet able to serve.11m28xp
8. 8Startup probesYou can protect a slow-starting container from liveness restarts without weakening steady-state checks.10m25xp
9. 9Requests and limitsYou can set CPU and memory requests and limits and predict their effect on scheduling and throttling.12m30xp
10. 10Quality of Service classesYou can determine a Pod's QoS class and predict its eviction priority under node pressure.10m25xp
11. 11Systematic Pod troubleshootingYou can move from describe to events to logs to exec in a fixed order to localise any Pod failure.12m30xp

You can pick and operate the right workload controller and run safe rollouts and rollbacks.

1. 1ReplicaSetsYou can explain how a ReplicaSet maintains a replica count and how it claims Pods by selector.10m25xp
2. 2DeploymentsYou can create a Deployment and describe the relationship between Deployment, ReplicaSet and Pod.11m28xp
3. 3Rolling update strategyYou can tune maxSurge and maxUnavailable to trade rollout speed against capacity during a release.12m30xp
4. 4Rollout status and rollbackYou can watch a rollout to completion and revert to the previous revision when it fails.10m25xp
5. 5DaemonSetsYou can run exactly one Pod per node for agent workloads and control which nodes are included.10m25xp
6. 6StatefulSetsYou can explain stable identity, ordered rollout and per-replica storage in a StatefulSet.12m30xp
7. 7JobsYou can run a batch task to completion with correct retry and parallelism settings.10m25xp
8. 8CronJobsYou can schedule recurring work and control what happens when a run overlaps the previous one.11m28xp
9. 9Horizontal Pod AutoscalerYou can autoscale a Deployment on CPU utilisation and explain why requests must be set for it to work.12m30xp
10. 10PodDisruptionBudgetsYou can protect a service from losing too many replicas during voluntary disruptions such as a node drain.11m28xp
11. 11Choosing the right controllerYou can map a workload's identity, ordering and completion requirements to the correct controller type.10m25xp

You can expose workloads inside and outside the cluster and debug connectivity end to end.

1. 1The Kubernetes network modelYou can state the flat networking requirements every CNI plugin must satisfy.11m28xp
2. 2ClusterIP ServicesYou can expose a set of Pods behind a stable virtual IP and DNS name inside the cluster.11m28xp
3. 3Endpoints and EndpointSlicesYou can verify whether a Service actually has backing endpoints when traffic fails.11m28xp
4. 4How kube-proxy routes trafficYou can explain how a ClusterIP is translated into a real Pod address on the node.10m25xp
5. 5Cluster DNSYou can resolve a Service by its short and fully qualified names from inside a Pod.11m28xp
6. 6NodePort ServicesYou can expose a Service on a port of every node and describe the limits of that approach.10m25xp
7. 7LoadBalancer ServicesYou can request an external load balancer and diagnose a Service stuck in Pending external IP.10m25xp
8. 8Ingress and ingress controllersYou can route several hostnames and paths to different Services through one entry point.12m30xp
9. 9NetworkPoliciesYou can restrict Pod-to-Pod traffic to an explicit allow list and confirm the CNI enforces it.12m30xp
10. 10Debugging Service connectivityYou can localise a connectivity failure to DNS, endpoints, ports or policy in a fixed sequence.12m30xp

You can inject configuration and secrets and attach durable storage to workloads.

1. 1ConfigMapsYou can supply configuration as environment variables or mounted files and know which updates propagate live.11m28xp
2. 2SecretsYou can store credentials in a Secret and explain the protection base64 encoding does not provide.11m28xp
3. 3Injecting configuration into containersYou can wire individual keys or whole objects into a container and resolve name collisions.10m25xp
4. 4Pod volumes and emptyDirYou can share a scratch directory between containers in a Pod and state when its contents are lost.10m25xp
5. 5PersistentVolumes and claimsYou can bind a PersistentVolumeClaim to storage and explain the separation between claim and volume.12m30xp
6. 6StorageClasses and dynamic provisioningYou can enable dynamic provisioning so claims create their own volumes automatically.11m28xp
7. 7Access modes and reclaim policiesYou can choose access modes and a reclaim policy that match the storage backend and data value.11m28xp
8. 8Per-replica storage with volumeClaimTemplatesYou can give each StatefulSet replica its own persistent volume that follows its identity.11m28xp
9. 9ResourceQuotas and LimitRangesYou can cap a namespace's total resource consumption and supply defaults for Pods that omit requests.11m28xp

You can control where Pods land and keep critical workloads running under pressure.

1. 1How the scheduler decidesYou can describe the filtering and scoring phases that select a node for a Pod.11m28xp
2. 2nodeSelector and node labelsYou can pin a workload to nodes with a specific label such as a GPU or disk type.9m23xp
3. 3Node affinity and anti-affinityYou can express soft and hard placement preferences that nodeSelector cannot capture.12m30xp
4. 4Taints and tolerationsYou can reserve nodes for specific workloads by tainting them and tolerating the taint selectively.12m30xp
5. 5Topology spread constraintsYou can distribute replicas evenly across zones or nodes with a defined skew tolerance.11m28xp
6. 6Pod priority and preemptionYou can give critical workloads a higher priority class and predict which Pods get evicted to make room.11m28xp
7. 7Static PodsYou can identify a static Pod and explain why deleting it through the API does not remove it.10m25xp
8. 8Cordon, drain and uncordonYou can safely evacuate a node for maintenance without breaking disruption budgets.11m28xp

You can authenticate workloads, grant least-privilege access and constrain container capabilities.

1. 1The API request pipelineYou can trace an API request through authentication, authorisation and admission control.11m28xp
2. 2ServiceAccountsYou can give a Pod its own identity for calling the API instead of using the default account.11m28xp
3. 3Roles and ClusterRolesYou can write a Role granting exactly the verbs and resources a workload needs.12m30xp
4. 4RoleBindings and ClusterRoleBindingsYou can bind a role to a subject in the correct scope and avoid accidental cluster-wide grants.11m28xp
5. 5SecurityContextYou can run a container as non-root with a read-only filesystem and dropped capabilities.12m30xp
6. 6Pod Security Standards and admissionYou can enforce a baseline or restricted policy on a namespace and interpret the rejection message.11m28xp
7. 7Admission controllers and webhooksYou can explain how mutating and validating webhooks alter or block objects before they are stored.11m28xp
8. 8Reducing secret exposureYou can limit who and what can read a Secret and describe safer external alternatives.11m28xp

You can observe, upgrade, extend and recover a live cluster.

1. 1Events and metricsYou can correlate Kubernetes events with resource metrics to explain a workload's behaviour.11m28xp
2. 2Cluster logging architectureYou can explain why logs must be shipped off the node to survive Pod deletion.10m25xp
3. 3Ephemeral containers and kubectl debugYou can attach a debugging container to a running Pod that contains no shell or tools.11m28xp
4. 4Port forwarding and proxyingYou can reach a Pod or Service from your workstation without exposing it publicly.9m23xp
5. 5Custom resources and operatorsYou can describe how a CustomResourceDefinition plus a controller extends the API with new behaviour.11m28xp
6. 6Packaging with HelmYou can install and upgrade a templated application release and inspect the values in effect.11m28xp
7. 7Cluster and node upgradesYou can sequence a cluster upgrade respecting version skew rules between components.12m30xp
8. 8Backup and disaster recoveryYou can plan a recovery covering etcd state, persistent volumes and cluster add-ons.12m30xp
9. 9API versions and deprecationYou can find manifests using removed API versions before an upgrade breaks them.10m25xp
10. 10Full-cluster incident triageYou can work from symptom to cause across control plane, node, workload and network layers in one structured pass.13m33xp