Cloud Computing Containers and Orchestration Syllabus

What are the core control plane components in Kubernetes?

kube-apiserver, etcd (cluster datastore), kube-scheduler, kube-controller-manager, and cloud-controller-manager.

What is etcd's role in Kubernetes?

etcd is the distributed, consistent key-value store that holds all cluster state and configuration as the single source of truth.

What components run on every Kubernetes worker node?

kubelet (manages pods/containers on the node), kube-proxy (handles service networking rules), and a container runtime (e.g. containerd).

What does the kube-scheduler do?

It watches for newly created pods with no assigned node and selects an appropriate node for them based on resource requirements, affinity, taints, and constraints.

What is a Pod in Kubernetes?

The smallest deployable unit: one or more tightly coupled containers that share the same network namespace (IP), storage volumes, and lifecycle.

What does a Deployment provide over a bare Pod?

A Deployment manages a ReplicaSet to provide declarative scaling, self-healing, and rolling updates/rollbacks for stateless replicated pods.

What is a ReplicaSet?

A controller that ensures a specified number of identical pod replicas are running at all times, recreating pods that fail or are deleted.

When would you use a StatefulSet instead of a Deployment?

For stateful applications needing stable, unique network identities, ordered deployment/scaling, and stable persistent storage per pod (e.g. databases).

What does a DaemonSet do?

It ensures a copy of a pod runs on every (or selected) node, commonly used for node-level agents like log collectors, monitoring, or CNI plugins.

What is the difference between a Job and a CronJob?

A Job runs pods to completion for a finite task; a CronJob schedules Jobs to run repeatedly on a time-based cron schedule.

What is a Kubernetes Service?

An abstraction providing a stable virtual IP and DNS name that load-balances traffic across a dynamic set of pods selected by labels.

Compare the ClusterIP, NodePort, and LoadBalancer service types.

ClusterIP exposes the service only inside the cluster; NodePort opens a static port on every node's IP; LoadBalancer provisions an external cloud load balancer routing to the service.

What is an Ingress in Kubernetes?

An API object that manages external HTTP/HTTPS access to services, providing host/path-based routing, TLS termination, and virtual hosting via an ingress controller.

Why does an Ingress require an Ingress Controller?

The Ingress object only defines routing rules; an ingress controller (e.g. NGINX, Traefik, cloud LB controller) is the running component that actually implements and enforces those rules.

What is a ConfigMap used for?

To store non-confidential configuration data as key-value pairs, injected into pods as environment variables, command-line args, or mounted files.

How does a Secret differ from a ConfigMap?

A Secret stores sensitive data (passwords, tokens, keys); its values are base64-encoded and can be encrypted at rest, with tighter access controls, whereas a ConfigMap holds plain non-sensitive config.

Are Kubernetes Secrets encrypted by default?

No. By default they are only base64-encoded (not encrypted) in etcd; encryption at rest must be explicitly enabled via an EncryptionConfiguration.

What is a Kubernetes Namespace?

A virtual cluster partition that scopes and isolates groups of resources (names, quotas, access) within a single physical cluster.

What does a ResourceQuota enforce?

It caps the aggregate resource consumption (CPU, memory, storage, object counts) allowed within a namespace.

What is the difference between a ResourceQuota and a LimitRange?

A ResourceQuota limits total resource usage across a whole namespace; a LimitRange sets default/min/max resource constraints per individual pod or container.

What is the Horizontal Pod Autoscaler (HPA)?

A controller that automatically scales the number of pod replicas in a workload up or down based on observed metrics such as CPU utilization or custom metrics.

State the formula the HPA uses to compute desired replicas.

$$\text{desiredReplicas} = \left\lceil \text{currentReplicas} \times \frac{\text{currentMetricValue}}{\text{desiredMetricValue}} \right\rceil$$

How does Horizontal Pod Autoscaling differ from Vertical Pod Autoscaling?

HPA changes the number of pod replicas (scale out/in); VPA adjusts the CPU/memory requests and limits of existing pods (scale up/down).

What is a rolling update in a Kubernetes Deployment?

A gradual update strategy that incrementally replaces old pods with new ones, keeping the app available throughout, governed by maxSurge and maxUnavailable.

What do maxSurge and maxUnavailable control in a rolling update?

maxSurge sets how many extra pods above desired count may be created during the update; maxUnavailable sets how many pods may be unavailable at once.

How do you roll back a Kubernetes Deployment to a previous version?

Use `kubectl rollout undo deployment/<name>` (optionally `--to-revision=N`), which reverts to a prior ReplicaSet revision from the rollout history.

Compare a rolling update with a recreate deployment strategy.

Rolling update replaces pods incrementally with no downtime; Recreate terminates all old pods before creating new ones, causing downtime but ensuring no version overlap.

What is a PersistentVolume (PV) versus a PersistentVolumeClaim (PVC)?

A PV is a cluster-provisioned piece of storage; a PVC is a user's request for storage of a given size and access mode that binds to a matching PV.

What are the PersistentVolume access modes?

ReadWriteOnce (RWO, one node RW), ReadOnlyMany (ROX, many nodes RO), ReadWriteMany (RWX, many nodes RW), and ReadWriteOncePod (single pod RW).

What is a StorageClass?

An object that defines a 'class' of storage with a provisioner and parameters, enabling dynamic provisioning of PersistentVolumes on demand when a PVC requests it.

What do the Retain, Delete, and Recycle reclaim policies mean for a PV?

Retain keeps the volume and data after the PVC is deleted (manual cleanup); Delete removes the underlying storage automatically; Recycle (deprecated) scrubs and reuses it.

What is Helm?

The package manager for Kubernetes that bundles related manifests into reusable, versioned, templated packages called charts.

What is a Helm chart and what is a release?

A chart is a packaged collection of templated Kubernetes manifests plus metadata; a release is a specific installed instance of a chart running in a cluster.

What is the role of values.yaml in a Helm chart?

It supplies the default configuration values that are substituted into the chart's templates, and can be overridden at install/upgrade time to customize the release.

How do you upgrade and roll back a Helm release?

`helm upgrade <release> <chart>` applies changes and creates a new revision; `helm rollback <release> <revision>` reverts to a previous revision.

What is Amazon EKS?

Amazon Elastic Kubernetes Service, a managed Kubernetes offering where AWS runs and scales the control plane while you manage or offload the worker nodes.

What are the worker node options for Amazon EKS?

Self-managed nodes, EKS managed node groups, and serverless AWS Fargate profiles.

Which AWS add-on provides pod networking in EKS by default?

The Amazon VPC CNI plugin, which assigns pods IP addresses directly from the VPC subnet.

What is Azure Kubernetes Service (AKS)?

Microsoft Azure's managed Kubernetes service that hosts the control plane for free and lets you manage worker node pools, integrating with Azure AD, ACR, and Azure networking.

What is a node pool in AKS?

A group of nodes with identical configuration; AKS supports a system node pool (for critical system pods) and additional user node pools for workloads.

What is Google Kubernetes Engine (GKE)?

Google Cloud's managed Kubernetes service, offered in Standard mode (you manage nodes) and Autopilot mode (Google fully manages nodes and you pay per pod resources).

Contrast GKE Standard and GKE Autopilot modes.

Standard gives you control and billing over node configuration and infrastructure; Autopilot removes node management, auto-provisions and bills per running pod's requested resources with a hardened default config.

What is cluster provisioning in the context of managed Kubernetes?

The automated process of creating a cluster's control plane, node pools, networking, and IAM, typically via CLI (eksctl, az aks create, gcloud) or IaC tools like Terraform.

What is a typical strategy for upgrading a Kubernetes cluster with minimal downtime?

Upgrade the control plane first, then upgrade node pools using a rolling/surge approach: cordon and drain each node to reschedule pods before replacing it with an upgraded node.

Why must the control plane version be upgraded before the nodes?

Kubernetes supports a version skew where the kubelet may be up to two (older) minor versions behind the API server but never ahead, so the control plane must lead the upgrade.

What is AWS Fargate?

A serverless compute engine for containers (used with ECS and EKS) that runs pods/tasks without you provisioning, scaling, or managing EC2 worker nodes.

What is a key benefit and a key limitation of AWS Fargate for EKS?

Benefit: no node management and per-pod right-sized billing with strong isolation. Limitation: no DaemonSets, no privileged containers, limited to specified pod sizes, and each pod runs on its own isolated microVM.

How does Fargate isolation differ from running pods on shared EC2 nodes?

Fargate runs each pod in its own dedicated kernel/microVM (Firecracker), giving VM-level isolation, whereas EC2 nodes pack multiple pods sharing the same host kernel.

What is a container runtime, and which one does modern Kubernetes use by default?

Software that runs containers (pulls images, manages lifecycle) implementing the CRI. Modern Kubernetes uses containerd (or CRI-O) by default after Docker/dockershim removal.

What is the purpose of readiness and liveness probes in Kubernetes?

A liveness probe restarts a container that has become unhealthy/deadlocked; a readiness probe determines when a pod is ready to receive traffic and is added to service endpoints.