Path 07 · learning path
Operating workloads from the kubectl side: choosing between Deployments, StatefulSets, DaemonSets and Jobs, making probes and resource limits mean something, debugging genuinely broken pods and Services, following a request through a Service and DNS, and scaling by hand and with an autoscaler. The security layers are the Secure Kubernetes path.
Each part names what it needs. Nothing has to be installed before part 1.
The path
Each part states what it assumes from the previous one, so you can also jump in where your setup already is.
Deployments, StatefulSets, DaemonSets, Jobs and CronJobs on a real three-node cluster: what kubectl reports, what happens when you delete a pod of each kind, why a DaemonSet skips the control plane, and which to use.
What readiness, liveness and startup probes do (with a failing one of each), how requests decide scheduling and limits decide OOMKilled and throttling, what the cgroup counters show, and how termination grace works.
A troubleshooting sequence (get, describe, logs, events, exec, port-forward) applied to four broken workloads: a crashing container, a missing image, a missing ConfigMap and an empty Service. Real events, real fixes.
How a request finds a pod: cluster DNS, the Service ClusterIP, the EndpointSlice the selector fills, port versus targetPort, headless Services and Ingress in outline; each inspected on a kind cluster, mistakes included.
Manual scaling, rolling updates and rollback as an operator sees them, and a HorizontalPodAutoscaler on kind with metrics-server: real utilisation figures, a 2-to-6 scale-up under load, and the scale-down window.
Practise
Create a service account that can roll out Deployments in one namespace and nothing else, prove the boundary with impersonation and a real short-lived token, and audit the cluster for wildcard roles and anonymous access.
On a kind cluster, turn on the restricted Pod Security profile for a namespace, watch it reject a default pod, then add a Kyverno ValidatingPolicy in Audit mode, read the PolicyReport, and switch it to Deny.
Toolchain
Container orchestration platform and the deployment target for most of the toolchain.
After the last part
One path picks up where this one stops. It is a suggestion, not a requirement.
RBAC, Pod Security, network policy, Kyverno admission and GitOps, layer by layer.