Kubernetes Notes


I pretty much copied in some notes I wrote a long time ago, originally written in a visually-structured .txt format. I’m trying to port those notes to mdx. I plan on continuing learning Kubernetes and working on these notes to help consolidate my learning.



Chapter 1. From Monolith to Microservices

Chapter 2. Container Orchestration

Ideally, we want a single controller/management unit (or “Container Orchestrators”) rather than having to individually manage containers.

Container orchestrators group systems together to form clusters where containers’ deployment and management is automated at scale while meeting requirements:

Kubernetes is an orchestration tool.
(Others include: Amazon ECS, Azure Service Fabric, and Docker Swarm.)

Chapter 3. Kubernetes

(I don’t really get what software-defined storage (SDS) is yet.)

Chapter 4. Kubernetes Architecture

master node = provides running environment for control plane
(TODO: idk what this means)


Must keep control plane running at all costs. Master node is replicated for resiliency.

Master node runs the following control plane components:

In addition, the master node runs:

worker node = provides running environment for client applications.

Worker nodes have following components:

(TODO: What’s a “client user”?)

(TODO: Get back to “Networking Challenges” and subsequent slides later. I don’t entirely understand them at the moment.)

Chapters 5-7

Relevant chapters:

kubectl = CLI tool to manage cluster resources and applications.

Useful commands:

minikube start
minikube start --container-runtime cri-o
minikube status
minikube ssh
minikube dashboard
minikube stop

kubectl config view
kubectl cluster-info
kubectl get namespaces

kubectl proxy
curl http://localhost:8001/

Authentication using bearer tokens:

TOKEN=$(kubectl describe secret -n kube-system $(kubectl get secrets -n kube-system | grep default | cut -f1 -d ' ') | grep -E '^token' | cut -f2 -d':' | tr -d '\t' | tr -d " ")
APISERVER=$(kubectl config view | grep https | cut -f 2- -d ":" | tr -d " ")

curl $APISERVER --header "Authorization: Bearer $TOKEN" --insecure

You can also authenticate with client certificate, client key, and certificate authority.
TODO: Figure out how this works.

Useful commands within minikube ssh:

sudo docker container ls
sudo runc list

Useful commands within minikube ssh:

sudo docker container ls
sudo runc list

Other interesting-but-contextual commands seen:

kubectl -n kube-system describe pod kube-scheduler-minikube | grep "Container ID"

Chapter 8. Kubernetes Building Blocks

With each object, we declare our intent (the desired state of the object) in the spec section.
Kubernetes manages the status section for objects, where it records the actual state of the object.
At any given point in time, the Control Plane tries to match the object’s actual state to the desired state.


Key-value pairs to organize objects.
Labels don’t provide unique identification. (Objects can share the same set of labels.)

Controllers use label selectors to select a subset of objects.
Kubernetes supports two types of selector:


Virtual subclusters.
Names within a namespace are unique, but not across namespaces.

By default, Kubernetes creates the following namespaces:


TODO: controller objects?


Chapter 9. Authentication, Authorization, Admission Control

Interesting Tidbits

etcd is based on the Raft Consensus Algorithm (link).