Who Owns What
Module 01 — the control-plane map, and what an outage actually costs
Spine segment: desired object · unit u1
- Five actors
- One contract
- What etcd holds
- Controllers, plural
- One decision
- The node's agent
- Four loops, one Deployment
Video modules
27 narrated modules, one per course unit. The pilot walks the whole request path end to end; each module then goes deeper on a single segment of it. They assume you have watched the pilot, and they teach only what their unit teaches.
Five Gates
Module 02 — the API request path, admission webhooks, and who owns a field
Spine segment: admission / storage · unit u2
- Who, then may they
- Mutate, then validate
- Your Service, on the hot path
- Fail closed or fail open
- Before you write one
- RBAC allows it, it still fails
- Two writers, one object
- Who owns this field
Events Are Hints
Module 03 — informers, level-based reconciliation, and loops that eat themselves
Spine segment: watch / cache · unit u3
- Observe, compare, act
- Nobody polls
- A key, not the object
- Level, not edge
- When the watch breaks
- The loop that eats itself
- Reconciling things outside the cluster
- Why resync exists
- What the queue gives you
- Where you look when it stalls
Four Different Promises
Module 04 — workload controllers, autoscaler conflict, and what a PDB really covers
Spine segment: controller queue · unit u4
- Pick by invariant
- What a StatefulSet does not do
- Coverage versus completion
- Two autoscalers, one number
- Removing the shared signal
- What a budget actually buys
- Three ways a Pod dies
- How a rollout actually moves
- Readiness is the throttle
- Completions and parallelism
An API You Cannot Take Back
Module 05 — CRDs, operators, versioning, and finalizers
Spine segment: controller queue · unit u5
- Four words people blur
- A CRD on its own does nothing
- Intent and observation
- What you signed up for
- Served, and stored
- The order that works
- Deletion that waits
- Before you strip it
- The schema is the API
- Validation at the API, not the controller
- When not to write one
Choose, Then Commit
Module 06 — the scheduling framework, why a Pod stays Pending, and what preemption costs
Spine segment: scheduler queue + binding · unit u6
- Two cycles, not one
- Eliminate, then rank
- The output is a name
- Holding the claim
- Requests are the currency
- Wrong in both directions
- Why is it still Pending
- A hint, not a reservation
- Queue order without displacement
Running Is Not Ready
Module 07 — the kubelet's loop, the four boundaries, and what a Pod's status is really telling you
Spine segment: kubelet · unit u7
- A loop, not an inbox
- The order on the node
- What the sandbox is for
- Four contracts, not one runtime
- The kubelet never calls runc
- Phase is not health
- Three probes, three jobs
- Running, receiving nothing
- Deletion is not a transaction
- The API repeats what it was told
A Permission Is Not A Path
Module 08 — Service identity, the two data planes, and how a Pod actually gets its address
Spine segment: CNI · unit u8
- Three owners, not one network
- Labels select, readiness conditions
- When the Service steps out
- A permission is not a path
- Implementations, not APIs
- Past the O(1) slogan
- The requirement does not go away
- A program, not a service
- The kubelet does not call it
- Where the address comes from
- It resolves, nothing answers
Not The Name You Typed
Module 09 — resolver policy, the compiled plugin chain, and what Ready has not proven
Spine segment: DNS · unit u9
- The query that actually leaves
- What expansion costs
- One character
- A cache on every node
- One name, end to end
- The endpoint is itself a Service
- Corefile order is not execution order
- Answers from a watch
- Fallthrough is not forwarding
- What Ready has not proven
Two Halves, One Volume
Module 10 — claim, class and volume, the CSI split, and why storage decides where a Pod can run
Spine segment: CSI · unit u10
- Claim, class, volume
- Pending on purpose
- Four reasons, four checks
- The split people merge
- Only one half is privileged
- Claim to container, in order
- Stage once, publish per Pod
- Storage is not a later phase
- Scheduled, and stuck mounting
A Backup You Have Restored
Module 11 — two availability models, quorum arithmetic, and what a snapshot leaves out
Spine segment: admission / storage · unit u11
- Two different availability models
- Majority, exactly
- The fourth member buys nothing
- Hot standbys, not members
- When the majority is gone
- A backup is a hypothesis
- What the snapshot does not hold
- The deceptive minutes
- The supported way
- Proving it works
Which Signal Proves What
Module 12 — API Priority and Fairness, the evidence hierarchy, and the spine as a diagnostic tool
Spine segment: desired object · unit u12
- Concurrency has to be allocated
- Classify here, serve there
- Blast radius, not fairness
- Contained is not fixed
- Why informers exist at all
- No single source is truth
- The object is the contract
- Who deleted it
- Which layer is slow
kubeadm Writes Files, Then Leaves
Module 13 — what kubeadm actually builds, skew boundaries, and what makes an upgrade safe
Spine segment: desired object · unit u13
- It composes, it does not manage
- Where the handoff happens
- The container is gone after a reboot
- Separate contracts, separate steps
- Drain protects, it does not upgrade
- The conservative order
- Neither one reconciles
- Safe, not merely successful
An Update Is Not A Reload
Module 14 — config delivery semantics, how QoS is derived, and eviction versus OOM
Spine segment: kubelet · unit u14
- Delivery has semantics
- What actually triggers a rollout
- What a Secret gives you
- Still using the old credential
- QoS is derived, not set
- Kubelet eviction, kernel OOM
- Why the slogan is incomplete
Objects Describe, Controllers Forward
Module 15 — Ingress and Gateway API, ownership boundaries, and why an accepted route can serve nothing
Spine segment: service · unit u15
- The object is not the proxy
- Valid, and serving nothing
- Who owns which object
- Every programmable boundary
- Policy permits, it does not route
- Diagnosing in order
- Accepted, and doing nothing
Feasible Is Not Local
Module 16 — topology hints, node admission, and why a CPU limit is not isolation
Spine segment: kubelet · unit u16
- Aggregate capacity is not locality
- Three managers, one protocol
- Who gets exclusive CPUs
- Scheduled, then refused
- A limit is not isolation
- Latency without high usage
- What the strictest policy promises
- A Guaranteed Pod that still jitters
From Scalar Counts To Claims
Module 17 — device plugins versus DRA, the allocation handshake, and where a device Pod stalls
Spine segment: scheduler queue + binding · unit u17
- A count, or a description
- Policy, and intent
- The order of the handshake
- The architectural discriminator
- A pending device Pod has three owners
- Template, or a named claim
- Which cause is it
- What deletion actually does
Not Every API Is Stored Here
Module 18 — the aggregation layer, watch expiry, and policy without a network call
Spine segment: desired object · unit u18
- Claiming a path
- When it earns its cost
- What a watch owes you
- What registering costs you
- Policy without a network call
- Safer, not free
- Ask, without becoming them
Four Gates, Four Transitions
Module 19 — leader election as optimistic concurrency, and what each gate actually delays
Spine segment: controller queue · unit u19
- Leadership is a conditional write
- The same API, two jobs
- Two candidates, one winner
- What it cannot promise
- Each gate blocks its own transition
- And what a budget is not
- Why gating reduces load
- Pending, reason SchedulingGated
Start At The Nearest Authority
Module 20 — the CKA troubleshooting spine, from control plane to Service
Spine segment: desired object · unit u20
- Start where something still answers
- Descending in order
- What separates a NotReady node
- Ninety seconds on a NotReady node
- Phase names the state, events name the attempt
- The log you actually need
- It resolves, it still fails
- The algorithm underneath
Scope Is Part Of The Permission
Module 21 — how RBAC actually composes, and how a node earns its identity
Spine segment: admission / storage · unit u21
- Scope is half the grant
- The union, not the worst case
- What actually escalates
- A node is an authenticated principal
- Two constraints, not one
- Joined, and still NotReady
The Metrics API Is Not Monitoring
Module 22 — what kubectl top actually reads, and preserving evidence before restart
Spine segment: kubelet · unit u22
- One narrow pipeline
- When top fails
- Three kinds of metric
- Preserve the perishable first
- No shell in the image
- When crictl earns its place
Render First, Then Reconcile
Module 23 — what a successful Helm release proves, and who owns each field
Spine segment: desired object · unit u23
- Two state machines
- What a green release proves
- Review what the API will see
- A rollout is arithmetic
- The deadline reports, it does not act
- A conflict names an owner
- The minimum discriminating evidence
Rejected, Not Pending
Module 24 — LimitRange and quota at admission, and proving a live resize took effect
Spine segment: admission / storage · unit u24
- One object, or the whole namespace
- Forbidden is not Pending
- What quota can actually count
- How a default breaks a quota
- Accepted is not applied
- QoS does not move
- Proving it took effect
Membership Is Not Eligibility
Module 25 — Service types as layers, and what EndpointSlice conditions actually encode
Spine segment: service · unit u25
- Each type adds a layer
- Local is not a hint
- An address is not reachability
- Ready, serving, terminating
- A requirement, or a preference
- The shortest diagnosis
Ask Which Object Restarted
Module 26 — three restart owners, native sidecars, and the Job result protocol
Spine segment: kubelet · unit u26
- Three owners, three objects
- UID and restart count
- OOMKilled, and still the same Pod
- Why a Job with a sidecar can finish
- Independent knobs
- Why a global limit is awkward
Admission Checks The Spec
Module 27 — Pod Security Admission versus runtime enforcement, and choosing an isolation boundary
Spine segment: admission / storage · unit u27
- Three modes, one blocks
- It evaluates the spec
- Passing Restricted is not a claim
- What actually reduces privilege
- A selector, not an implementation
- Remapping the identity
- Choosing between them