Cloud · Cloud Fundamentals
Kubernetes & Containers
Container orchestration that schedules workloads across a cluster, providing declarative deployment, scaling, service discovery and self healing.
AdvancedUpdated 2026-09-01
Overview
Containers package an application with its dependencies and share the host kernel, making them far lighter than virtual machines. Kubernetes turns a pool of hosts into a scheduling platform: you declare desired state and controllers reconcile reality toward it.
The operational cost is real. Kubernetes introduces its own networking, storage, identity, policy and upgrade lifecycle. Managed services (AKS, EKS, GKE) remove control plane maintenance but not the need for platform expertise.
How it works
- 01The API server accepts declarative manifests; controllers and the scheduler place pods onto nodes matching resource requests, affinity and taints.
- 02Services provide stable virtual addresses and load balancing; ingress controllers publish HTTP routes; a container network interface plugin provides pod networking.
- 03Configuration and secrets are injected as ConfigMaps and Secrets; persistent storage is claimed through PersistentVolumeClaims.
- 04Namespaces, RBAC, network policies and admission controllers provide multi tenancy and guardrails.
Security considerations
- Never run containers as root or privileged unless there is no alternative; apply pod security standards through admission control.
- Default deny network policies between namespaces, then allow required flows explicitly.
- Scan images in the pipeline and at runtime, and pin to digests rather than mutable tags.
- Use workload identity federation instead of mounting long lived cloud credentials into pods.
Common misconfigurations
- Kubernetes API server or dashboard exposed publicly.
- cluster admin bound to service accounts used by applications or CI systems.
- No resource requests or limits, allowing one workload to starve a node.
- Secrets committed to manifests in version control.