Most introductions to Kubernetes hand you a list of commands. That is the wrong end. Kubernetes is one idea repeated at every level: you write down the state you want, store it, and independent loops keep comparing that record against reality and closing the gap. Nothing executes your command — something notices a difference and acts later, elsewhere. Hold that and the parts stop being vocabulary: a Deployment is a loop, a probe an input to one. Nearly every beginner surprise, from the pod that will not die to the config change nothing picked up, is a mismatch between what you declared and which loop was watching.
Each chapter opens with the short version. Tap one to read the detail.
You write intent; the cluster writes reality
~2 min
Every object has a spec you own and a status the system owns. It is a record of intent, not an instruction — so when something does not happen, the answer is in the object, not your terminal.
The control plane is a room full of loops
~2 min
One API server is the front door to all cluster state; everything else watches it and reconciles. A controller is not an event handler — it compares desired against current, so it repairs damage it never saw.
Why the unit is a Pod, not a container
~2 min
A Pod is one or more containers always placed and run together, sharing one address and its volumes. It is also disposable: never moved to another node, only replaced — so anything assuming a fixed address is broken.
Deployment, ReplicaSet, Pod — and what actually triggers a rollout
~2 min
A Deployment manages ReplicaSets; a ReplicaSet manages Pods. A rollout happens if and only if the Pod template changes — which is exactly why editing a ConfigMap, or scaling the Deployment, restarts nothing.
Requests are the currency; limits are the punishment
~2 min
The scheduler reads only requests; the kernel enforces only limits. Over a CPU limit you are throttled and never killed; over a memory limit you are killed and never throttled. Most capacity mysteries are one of those applied in the wrong place.
Where a Pod lands, and why it never moves
~2 min
The scheduler filters nodes that could take a Pod, scores the survivors, and binds one — once. Every affinity rule ends in IgnoredDuringExecution, so relabelling nodes changes nothing for Pods already running.
Liveness and readiness answer different questions
~2 min
A failing liveness probe kills and restarts the container. A failing readiness probe only removes it from Service traffic. Swap them and a slow dependency becomes a restart storm across every healthy replica you own.
A stable address in front of moving Pods
~2 min
Pods are created and destroyed to match desired state, so a Service supplies one durable name and virtual address that each node's rules rewrite toward a live Pod. Nothing listens on that address, which is why the usual reflexes diagnose nothing.
Objects that do nothing until something implements them
~2 min
An Ingress with no controller, and a NetworkPolicy on a plugin that ignores it, are both accepted by the API server and both do nothing. Storing your intent is never evidence that anything will act on it.
What survives a restart, and what survives you
~2 min
A volume's lifetime is the Pod's, not the container's, so an emptyDir survives a crash but never a replacement. A claim outlives its Pod — but if its class reclaims by deleting, the data dies with the claim.
Configuration, secrets, and who can actually read them
~2 min
A ConfigMap read as environment variables is fixed at container start; mounted as a volume it keeps updating; via subPath it never updates. Secrets are stored unencrypted by default, and authorization is purely additive — no deny rule exists anywhere in it.
Written by Keentune. We are not affiliated with or endorsed by the organizations whose documentation informs this guide, and any linked sources belong to their respective owners.
All exam, test, and product names and trademarks are the property of their respective owners and are used here for identification and reference only. Keentune is independent study practice — not affiliated with, authorized, or endorsed by any of these organizations.