Glossary
Kubernetes’ vocabulary spans several layers at once: workload objects (Pod, Deployment, StatefulSet, DaemonSet, Job) that describe what should run, cluster services (Service, Ingress, Gateway API, NetworkPolicy) that describe how traffic reaches it, storage and config objects (ConfigMap, Secret, PV/PVC, StorageClass) that describe what it needs, and a control plane (API server, etcd, controllers, the scheduler) that continuously reconciles all of it toward the state you declared. On top of that sits RBAC and admission control for who can do what, and a toolchain — kubectl, Helm, GitOps — for actually operating a cluster. When a lesson uses a term you’re unsure about, or unsure whether it’s still current for Kubernetes 1.37, look it up here.
| Term | Meaning | Lesson |
|---|---|---|
| admission webhook | An HTTP callback the API server invokes during admission (validating and/or mutating) before persisting an object; ValidatingAdmissionPolicy/MutatingAdmissionPolicy cover many in-cluster cases without one, but Kyverno and Gatekeeper still run as webhooks for anything a CEL policy can’t express. | Pod & Cluster Security |
| affinity / anti-affinity | podAffinity schedules a Pod near Pods matching a label selector (same node/zone/topology domain); podAntiAffinity schedules it away from them — both support requiredDuringSchedulingIgnoredDuringExecution (hard) and preferred... (soft), and both are evaluated all-or-nothing per term. | Node Affinity, Taints & Tolerations |
| annotation | A non-identifying key/value pair on an object’s metadata, meant for tooling and libraries to attach arbitrary data — unlike a label, an annotation is never used as a selector target. | kubectl & Declarative YAML |
API server (kube-apiserver) | The single front door to a Kubernetes cluster: every read and write — from kubectl, a controller, or another API server component — goes through it, and it is the only control-plane component that talks to etcd directly. | Architecture: Control Plane & Nodes |
| Term | Meaning | Lesson |
|---|---|---|
| bound token (ServiceAccount) | Since Kubernetes 1.22, a ServiceAccount’s token is a short-lived, audience-scoped, auto-rotating JWT obtained via the TokenRequest API (or a projected serviceAccountToken volume with expirationSeconds) — no long-lived Secret token is auto-created anymore. | RBAC & Service Accounts |
| CEL (Common Expression Language) | The expression language ValidatingAdmissionPolicy and MutatingAdmissionPolicy use to write validation/mutation rules directly against the incoming object (object.spec...), instead of shipping a webhook server to run the same check. | Pod & Cluster Security |
| Chart (Helm) | A directory of templated Kubernetes manifests plus Chart.yaml metadata and a values.yaml of defaults — the unit Helm packages, versions, and installs as a Release. | Helm Package Management |
| CNI (Container Network Interface) | The plugin interface that actually wires up Pod networking and — for the plugins that implement it (Calico, Cilium, and others) — enforces NetworkPolicy; a CNI that doesn’t implement policy enforcement will silently accept a NetworkPolicy object without ever blocking any traffic. | Network Policies |
| Cluster Autoscaler | Adds or removes whole Nodes based on Pod scheduling pressure — scales up when Pods are Pending for lack of capacity, scales down an underutilized Node by cordoning and draining it first (a voluntary disruption, so it respects a PodDisruptionBudget, unlike preemption). | Pod Disruption & Cluster Autoscaling |
| ConfigMap | A namespaced object holding non-confidential key/value configuration data, consumed by a Pod as environment variables, individual env values, or a mounted volume of files. | ConfigMaps & Secrets |
| containerd | The container runtime kubelet talks to through the CRI to actually pull images and start/stop containers on a Node — the default runtime for kind, most managed Kubernetes offerings, and this course’s clusters. | Architecture: Control Plane & Nodes |
| controller | A control loop that watches one kind of object (or several), compares observed state to desired state, and issues API calls to move the cluster toward the desired state — the pattern every built-in workload controller and every Operator follows. | What is Kubernetes? |
| cordon / drain | kubectl cordon <node> marks a Node unschedulable without touching what’s already running on it; kubectl drain <node> additionally evicts existing Pods through the (PodDisruptionBudget-respecting) Eviction API — the pair used before a voluntary Node maintenance or replacement. | Pod Disruption & Cluster Autoscaling |
| CoreDNS | The cluster’s DNS server: a Deployment running in kube-system that answers <service>.<namespace>.svc.cluster.local (and Pod DNS) queries by watching Services and Endpoints/EndpointSlices, so a client can reach a Service by name instead of its ClusterIP. | DNS & Service Discovery |
| CronJob | Creates a Job on a schedule (standard cron syntax), governed by concurrencyPolicy (Allow/Forbid/Replace), startingDeadlineSeconds for a missed schedule, and separate success/failure history limits. | Jobs & CronJobs |
| CRD (CustomResourceDefinition) | Registers a brand-new object Kind with the API server, complete with an OpenAPI v3 schema for validation — once installed, kubectl get/apply/watch work on it exactly like a built-in object, and it’s stored in etcd the same way. | Operators & Custom Resources |
| CRI (Container Runtime Interface) | The gRPC interface between kubelet and a container runtime (containerd, CRI-O) — it’s what lets kubelet manage containers without hardcoding a specific runtime’s API. | Architecture: Control Plane & Nodes |
| CSI (Container Storage Interface) | The plugin interface (GA since Kubernetes 1.13) that lets a storage vendor’s driver plug into Kubernetes without living in the core kubernetes/kubernetes tree — nearly every StorageClass in production names a CSI driver’s provisioner. | PVs, PVCs & Storage Classes |
| custom resource | An instance of a Kind defined by a CRD — the CRD is the schema, a custom resource is one object conforming to it, exactly the way a Pod is an instance of the built-in Pod Kind. | Operators & Custom Resources |
| Term | Meaning | Lesson |
|---|---|---|
| DaemonSet | Runs exactly one copy of a Pod on every Node matching its (optional) node selector, adding or removing the Pod automatically as Nodes join or leave — the shape for a per-Node agent like a log shipper or CNI plugin. | StatefulSets & DaemonSets |
| Deployment | Manages a ReplicaSet (and, across an update, an old and a new ReplicaSet together) to provide declarative, versioned rolling updates and rollback for a stateless workload — the ownership chain is Deployment → ReplicaSet → Pod. | Deployments & ReplicaSets |
| dry-run (client vs server) | kubectl apply --dry-run=client only renders the manifest locally, no server round-trip at all; --dry-run=server sends the request all the way through the API server’s validation and admission chain (so it catches a real schema or policy rejection) without persisting the object. | kubectl & Declarative YAML |
| emptyDir | A volume created empty when a Pod is scheduled and deleted permanently when the Pod is removed from a Node — shared scratch space between containers in the same Pod, not persistent storage. | Volumes & Volume Types |
| Endpoints (deprecated) | The original, single-object-per-Service list of backing Pod IPs (core/v1); it does not shard, so it scales poorly past a few hundred backends — EndpointSlice (GA since Kubernetes 1.21) is the recommended replacement kube-proxy and CoreDNS both already read. | Services: ClusterIP, NodePort, LoadBalancer |
| EndpointSlice | The scalable, sharded replacement for Endpoints (discovery.k8s.io/v1, GA since 1.21): a Service’s backing Pods are split across multiple EndpointSlice objects (capped per slice) instead of one ever-growing Endpoints object, and both kube-proxy and CoreDNS watch these directly. | Services: ClusterIP, NodePort, LoadBalancer |
| ephemeral container | A throwaway container (GA/stable since Kubernetes 1.25) added to an already-running Pod via kubectl debug, sharing the target container’s process namespace for troubleshooting — it never restarts the Pod and can’t be added to the original Pod spec. | Logging & Metrics |
| etcd | The distributed key-value store that is the cluster’s single source of truth — every object the API server serves is read from and written to etcd, and only the API server talks to it directly. | Architecture: Control Plane & Nodes |
extensions/v1beta1 (removed) | The pre-1.0-stability API group early Kubernetes resources (Deployment, DaemonSet, ReplicaSet, NetworkPolicy) briefly lived under; it stopped being served in Kubernetes 1.16 (moved to apps/v1/networking.k8s.io/v1), and Ingress’s own copy under extensions/v1beta1/networking.k8s.io/v1beta1 was removed in 1.22 — a manifest using it today is rejected outright, not silently downgraded. | kubectl & Declarative YAML |
| Term | Meaning | Lesson |
|---|---|---|
field manager / managedFields | Server-Side Apply tracks who owns which field of an object in metadata.managedFields, keyed by a field manager name (kubectl’s default, a controller’s name, …) — two managers writing the same field with conflicting values is a real, rejected conflict, not a silent overwrite. | kubectl & Declarative YAML |
| filter, score, bind (scheduling cycle) | The scheduler’s per-Pod pipeline: Filter discards every Node that flatly can’t run the Pod (NodeResourcesFit, TaintToleration, PodTopologySpread, …, leaving the feasible set), PostFilter runs DefaultPreemption only if no Node is feasible, Score ranks the feasible Nodes, and Bind commits the Pod to the winner. | The Scheduler & Resource Requests |
| Gateway API | The more expressive, role-oriented successor to Ingress (gateway.networking.k8s.io), splitting one monolithic object into GatewayClass (infrastructure provider), Gateway (a listener/load-balancer instance), and route types (HTTPRoute, GRPCRoute, …) owned by different teams. | Ingress & Gateway API |
Gateway (resource) | The Gateway API object that requests an actual piece of traffic-handling infrastructure (a cloud load balancer, an in-cluster proxy) from a named GatewayClass, declaring its listeners (protocol, port, hostname) — routes then attach to it. | Ingress & Gateway API |
GatewayClass | The Gateway API object naming a controller implementation (analogous to IngressClass or StorageClass) that a Gateway references via gatewayClassName — cluster-scoped, typically installed once by a platform team. | Ingress & Gateway API |
| GitOps | The pull-based deployment model where a controller running inside the cluster (Argo CD, Flux) continuously reconciles live state against manifests in a Git repository, instead of a CI pipeline pushing kubectl apply from outside — the repository, not a pipeline run, is the source of truth. | GitOps & CI/CD for Kubernetes |
GRPCRoute | The Gateway API route type for gRPC traffic (stable at gateway.networking.k8s.io/v1, alongside HTTPRoute), matching on gRPC service/method instead of an HTTP path — requires the Gateway’s listener to speak HTTP/2. | Ingress & Gateway API |
| Term | Meaning | Lesson |
|---|---|---|
| headless Service | A Service created with clusterIP: None: it gets no virtual IP at all, and its DNS name resolves directly to the individual Pod IPs behind it (or, for a StatefulSet, one stable per-Pod DNS name) instead of load-balancing through one address — what StatefulSet identity depends on. | DNS & Service Discovery |
| Helm | Kubernetes’ package manager: packages a set of templated manifests into a versioned Chart, fills in values.yaml placeholders at install time, and tracks every install as a Release with its own upgrade/rollback history. | Helm Package Management |
| HorizontalPodAutoscaler (HPA) | Adjusts a workload’s replica count up or down based on observed metrics (CPU/memory via metrics-server, or custom/external metrics) — needs resources.requests set on every container and a running metrics-server before it can do anything at all. | Horizontal Pod Autoscaling |
| hostPath | Mounts a path from the Node’s own filesystem directly into a Pod — ties the Pod to whatever happens to already be on that specific Node and is a common security foot-gun, unlike emptyDir or a real PV. | Volumes & Volume Types |
HTTPRoute | The Gateway API route type for HTTP traffic (stable at gateway.networking.k8s.io/v1) — attaches to a Gateway’s listener and matches on path/header/method, the Gateway API equivalent of an Ingress rule but expressed as its own object. | Ingress & Gateway API |
| informer | The client-go machinery a controller builds on: it lists the current state of a watched object type once, then keeps a local cache in sync via a long-lived watch, so a controller’s reconcile loop reads from cache instead of hitting the API server on every tick. | Architecture: Control Plane & Nodes |
| Ingress | Routes external HTTP(S) traffic to Services by host/path rules — the API itself has been frozen (no further evolution) since Gateway API became its more expressive, actively developed successor; an Ingress object alone does nothing without an ingress controller actually implementing it. | Ingress & Gateway API |
| ingress-nginx (retiring) | The most widely deployed Ingress controller; the project is retiring (announced retirement effective March 2026), which is one of the concrete reasons this course treats Gateway API as the forward-looking choice rather than a nice-to-have alternative. | Ingress & Gateway API |
| init container | Runs to completion, in order, before any regular container in the same Pod starts — used to wait for a dependency or prepare shared state; unlike a native sidecar, it does not keep running alongside the app. | Pods: the Atomic Unit |
| Term | Meaning | Lesson |
|---|---|---|
| Job | Runs a Pod (or several) to completion rather than forever, tracking success count against completions and giving up per backoffLimit/activeDeadlineSeconds — the shape for a one-off or batch task, unlike a Deployment. | Jobs & CronJobs |
| Karpenter | A node-lifecycle autoscaler that provisions right-sized Nodes directly against a cloud provider’s API in response to unschedulable Pods, rather than scaling a fixed, pre-defined node-group the way Cluster Autoscaler does. | Pod Disruption & Cluster Autoscaling |
| kind | Runs Kubernetes (kind.sigs.k8s.io) Nodes as Docker/Podman containers on your own machine — this course’s own clusters; kind 0.33 defaults to Kubernetes 1.37, and a real, multi-node config (kind.x-k8s.io/v1alpha4) is one YAML file away. | Running Kubernetes Locally |
| k3d | Runs k3s — a certified, lightweight Kubernetes distribution — inside Docker containers, similar in spirit to kind but built around k3s’s smaller footprint and some components (Traefik, servicelb) already built in. | Running Kubernetes Locally |
| kube-proxy | Runs on every Node and programs local packet-rewriting rules (iptables or IPVS, depending on mode) from the Services and Endpoints/EndpointSlices it watches — the component that actually makes a Service’s virtual IP work, transparently routing any packet to it toward one backing Pod. | Services: ClusterIP, NodePort, LoadBalancer |
| kubeconfig / context | A kubeconfig file bundles cluster endpoints, user credentials, and named contexts (cluster + user + default namespace); kubectl config get-contexts/use-context is how you see and switch which cluster your next command actually talks to. | Running Kubernetes Locally |
kubectl apply (client-side vs Server-Side Apply) | Client-side apply computes the diff to send by comparing to a last-applied-configuration annotation stored on your machine’s prior run; Server-Side Apply (--server-side) instead has the API server itself merge the request field-by-field against managedFields — mixing the two on the same object is exactly what produces a field-manager conflict. | kubectl & Declarative YAML |
kubectl debug | Attaches an ephemeral container (or a whole separate debug Pod, for a Node) to troubleshoot a running Pod or Node without restarting or replacing anything already there — the fix for a distroless image where kubectl exec ... -- sh fails with no shell in $PATH. | Logging & Metrics |
kubectl explain / kubectl diff | kubectl explain <kind>.<field.path> checks a field actually exists against the live API server’s schema (an invented field prints a real “does not exist” error); kubectl diff shows exactly what an apply would change before you commit to it. | kubectl & Declarative YAML |
| kubelet | The Node agent that registers the Node with the API server, receives Pod specs assigned to it, and drives the container runtime (via the CRI) to actually start, stop, and probe the containers inside each Pod. | Architecture: Control Plane & Nodes |
| Kustomize | A patch-based, template-free way to customize a base set of plain manifests per environment (overlays with strategic merge or JSON patches); built into kubectl since 1.14 (kubectl apply -k) as an alternative to Helm’s templating approach — this course teaches Helm’s Chart/Release model as the primary packaging tool. | Helm Package Management |
| Term | Meaning | Lesson |
|---|---|---|
| label | A key/value pair on an object’s metadata used to identify and select it — a Service, ReplicaSet, or NetworkPolicy all pick their targets through a label selector, never through a name or a fixed list. | kubectl & Declarative YAML |
LimitRange | Namespace-scoped defaults and bounds for individual Pods/containers — quietly injects a requests/limits value onto a container that never specified one, and can also cap the maximum/minimum any container in the namespace is allowed to request. | Namespaces & Resource Quotas |
| liveness probe / readiness probe | A liveness probe failing restarts the container (kubelet decides it’s stuck); a readiness probe failing removes the Pod from a Service’s Endpoints/EndpointSlice without restarting it — pointing both at the identical endpoint with no startupProbe on a slow-warming container causes a self-inflicted restart loop. | Probes: Liveness, Readiness & Startup |
metrics-server | Collects CPU/memory usage from every kubelet and exposes it through the metrics.k8s.io API — enough to power kubectl top and CPU/memory-based HPA, but it keeps no history and isn’t a substitute for Prometheus. | Logging & Metrics |
| minikube | Runs a single- or multi-node cluster inside a VM or container driver of your choice, with a rich built-in addon ecosystem (minikube addons enable dashboard/ingress/metrics-server) enabled with one command each. | Running Kubernetes Locally |
MutatingAdmissionPolicy | CEL-based, in-process object mutation during admission — stable since Kubernetes 1.36 (no feature gate needed), requiring a spec.reinvocationPolicy; covers many cases that used to need a full mutating webhook server. | Pod & Cluster Security |
| Term | Meaning | Lesson |
|---|---|---|
| namespace | A way to divide one cluster into multiple virtual clusters for names, RBAC, and quotas — most objects (Pods, Services, ConfigMaps, …) live inside exactly one namespace, but some (Nodes, PersistentVolumes, CRDs themselves) are cluster-scoped and live outside all of them. | Namespaces & Resource Quotas |
ndots | The Pod DNS config option (default 5) controlling how many dots a name needs before the resolver tries it as absolute first instead of appending the cluster’s search domains — a short Service name like my-svc has fewer than 5 dots, so every lookup tries several search-domain suffixes before (or instead of) the plain external name. | DNS & Service Discovery |
| NetworkPolicy | An allow-list rule selecting Pods by label and permitting specific ingress/egress traffic to/from them — the cluster’s default is a flat, fully open network, so a NetworkPolicy only restricts anything once the CNI plugin actually enforces policy objects (not every CNI does). | Network Policies |
| Operator | The pattern of pairing a CRD with a controller that encodes real operational knowledge (backup, failover, version upgrades) into the reconcile loop — a CRD alone is just a schema; the controller is what turns it into an Operator. | Operators & Custom Resources |
| Term | Meaning | Lesson |
|---|---|---|
| Pod | The smallest deployable unit: one or more containers that share a network namespace (one IP, localhost between them) and can share volumes — never created directly in production, always through a controller like a Deployment. | Pods: the Atomic Unit |
| PodDisruptionBudget (PDB) | Declares minAvailable or maxUnavailable for a set of Pods, and any voluntary eviction path (kubectl drain, the Eviction API, Cluster Autoscaler scale-down) must respect it — it gives zero protection against scheduler preemption or kubelet node-pressure eviction, which never go through the Eviction API at all. | Pod Disruption & Cluster Autoscaling |
| PodSecurityPolicy (removed) | The original, built-in way to enforce a security baseline cluster-wide; removed in Kubernetes 1.25, replaced by Pod Security Admission enforcing the (unenforced-by-itself) Pod Security Standards at the namespace level. | Pod & Cluster Security |
| preemption | When no Node is feasible for a Pod, the scheduler’s PostFilter/DefaultPreemption step looks for lower-priority Pods to evict to make room — an involuntary disruption that bypasses PodDisruptionBudget entirely, unlike a voluntary drain. | The Scheduler & Resource Requests |
preStop hook | A command or HTTP call the kubelet runs before sending SIGTERM to a container during termination — commonly used to buy time for the container to stop accepting new traffic while its Pod is still being removed from Service Endpoints. | Pods: the Atomic Unit |
PriorityClass | Assigns an integer priority to a Pod; a higher-priority Pod can trigger preemption of lower-priority Pods when no Node is otherwise feasible, and priority also affects the order Pods are considered under resource pressure. | The Scheduler & Resource Requests |
| projected volume | Combines several volume sources (a ConfigMap, a Secret, a downward-API file, and a serviceAccountToken) into one mount point in a single Pod spec — the mechanism a modern bound ServiceAccount token actually arrives through. | Volumes & Volume Types |
| PSA / PSS (Pod Security Admission / Pod Security Standards) | Pod Security Standards define three baseline levels (privileged, baseline, restricted); Pod Security Admission (stable since Kubernetes 1.25) enforces one of them per namespace via a pod-security.kubernetes.io/enforce label — the built-in replacement for PodSecurityPolicy. | Pod & Cluster Security |
| PV / PVC (PersistentVolume / PersistentVolumeClaim) | A PersistentVolume is a piece of real storage provisioned in the cluster; a PersistentVolumeClaim is a Pod’s request for storage matching some size/access-mode/class — the PVC is what a Pod actually mounts, and it gets bound to a matching (or dynamically provisioned) PV behind the scenes. | PVs, PVCs & Storage Classes |
| Term | Meaning | Lesson |
|---|---|---|
| QoS class | Guaranteed, Burstable, or BestEffort — derived automatically from a Pod’s own requests/limits (never set directly), and it’s the first thing the kubelet consults to decide which Pod to evict first under real node memory pressure. | The Scheduler & Resource Requests |
| RBAC (Role / ClusterRole / RoleBinding / ClusterRoleBinding) | Role/ClusterRole declare what’s allowed (verbs on resources), namespaced or cluster-wide respectively; RoleBinding/ClusterRoleBinding declare who gets it, attaching a Role/ClusterRole to a user, group, or ServiceAccount — a ClusterRole can also be bound with a RoleBinding to scope its cluster-wide permissions down to one namespace. | RBAC & Service Accounts |
| reconcile / reconciliation loop | The core control-loop action: read desired state, read observed state, issue whatever API calls close the gap between them — repeated continuously, so a manual edit to a controller-managed field is simply overwritten on the next pass. | What is Kubernetes? |
ReferenceGrant | The Gateway API object (gateway.networking.k8s.io/v1beta1, not yet promoted to v1) that authorizes a cross-namespace reference — e.g. an HTTPRoute in one namespace pointing at a Service in another — requiring explicit opt-in from the target namespace rather than trusting the referencing object alone. | Ingress & Gateway API |
| Release (Helm) | One named, tracked instance of a Chart running in the cluster, with its own revision history — helm upgrade/helm rollback operate on the whole set of resources a Release manages together, not one Deployment at a time. | Helm Package Management |
| ReplicaSet | Keeps exactly replicas Pods matching its (immutable) selector running at all times — almost never created directly; a Deployment creates and manages ReplicaSets for you to get rolling updates on top of this fixed-count guarantee. | Deployments & ReplicaSets |
| requests / limits | requests is the floor the scheduler reserves against a Node’s Allocatable capacity (and the number QoS class is derived from); limits is the runtime ceiling the kubelet/cgroups enforce — exceeding a CPU limit throttles, exceeding a memory limit gets the container OOMKilled. | The Scheduler & Resource Requests |
| ResourceQuota | Namespace-scoped hard caps on total resource consumption (aggregate CPU/memory requests and limits, object counts) — where LimitRange bounds one Pod at a time, ResourceQuota bounds the whole namespace at once. | Namespaces & Resource Quotas |
| Term | Meaning | Lesson |
|---|---|---|
scheduler (kube-scheduler) | The control-plane component that picks which Node an unbound Pod runs on, through the filter/score/bind pipeline — it never runs anything itself, it only writes the binding decision back to the API server for kubelet to act on. | The Scheduler & Resource Requests |
| Secret | Same shape as a ConfigMap (key/value data consumed as env vars or a mounted volume) but intended for sensitive data — base64-encoded, not encrypted, by default, so it is not confidential at rest unless the cluster has encryption-at-rest configured separately. | ConfigMaps & Secrets |
securityContext | Per-container (or per-Pod) hardening settings — runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation: false, dropped Linux capabilities — the first, innermost layer of Pod hardening, independent of whatever Pod Security Admission level the namespace enforces. | Pod & Cluster Security |
| selector | A label query (matchLabels/matchExpressions) that picks a dynamic set of objects — a Service picks its backing Pods this way, and it’s why Pods coming and going never require touching the Service itself. | Services: ClusterIP, NodePort, LoadBalancer |
| Server-Side Apply (SSA) | kubectl apply --server-side has the API server itself perform the three-way merge against managedFields, instead of kubectl computing it locally from a last-applied-configuration annotation — the model GitOps controllers use, and the source of a real, visible conflict when a human’s plain apply and a controller’s SSA touch the same field with different values. | kubectl & Declarative YAML |
| Service (ClusterIP / NodePort / LoadBalancer / ExternalName) | A stable virtual IP and DNS name in front of a changing set of Pods. ClusterIP (default) is internal-only; NodePort additionally opens the same port (30000-32767) on every Node; LoadBalancer additionally provisions an external cloud load balancer in front of the NodePort; ExternalName returns a CNAME to an external DNS name instead of load-balancing to any Pod at all. | Services: ClusterIP, NodePort, LoadBalancer |
| ServiceAccount | An identity Pods authenticate to the API server as (distinct from a human user) — every Pod runs as some ServiceAccount (default if none is set), and RBAC bindings against it are what actually scope what that Pod’s own kubectl/client calls are allowed to do. | RBAC & Service Accounts |
| sidecar container (native sidecar) | Since Kubernetes 1.29, an init container with restartPolicy: Always keeps running alongside the Pod’s main containers instead of exiting once — and, on Pod termination, native sidecars are stopped last, after the main containers, so a service mesh proxy or log shipper doesn’t disappear out from under the app it’s supporting. | Pods: the Atomic Unit |
| StatefulSet | Manages Pods with a stable, ordered identity (<name>-0, <name>-1, …) and a stable per-Pod PVC that follows that identity across rescheduling — what a database or anything needing “the same Pod, the same disk” every time actually needs, unlike a Deployment. | StatefulSets & DaemonSets |
startupProbe | Runs before liveness/readiness probes start counting at all, giving a slow-booting container room to finish starting — sized so failureThreshold * periodSeconds covers the worst-case boot time, or the liveness probe restarts the container mid-boot, resetting the clock every time. | Probes: Liveness, Readiness & Startup |
| StorageClass | Names a provisioner (almost always a CSI driver) plus parameters for dynamically creating a PersistentVolume on demand when a PVC references it — the alternative to hand-provisioning PVs upfront, and where a reclaim policy (Delete vs Retain) is set. | PVs, PVCs & Storage Classes |
| Term | Meaning | Lesson |
|---|---|---|
| taint / toleration | A taint on a Node repels Pods (NoSchedule, PreferNoSchedule, or NoExecute — which also evicts already-running Pods, optionally after tolerationSeconds); a matching toleration on a Pod is what lets it be scheduled there (or stay) anyway — the opposite direction from affinity, which a Pod uses to attract itself toward Nodes. | Node Affinity, Taints & Tolerations |
terminationGracePeriodSeconds | How long the kubelet waits between sending SIGTERM (and, in parallel, running any preStop hook) and force-killing a container with SIGKILL during Pod termination — set to 0, this skips the grace period entirely and is genuinely dangerous for anything that needs to shut down cleanly. | Pods: the Atomic Unit |
topologySpreadConstraints | Spreads Pods evenly across a named topology domain (zone, hostname, …) within a tunable maxSkew; matchLabelKeys (still beta as of Kubernetes 1.37) scopes the calculation to Pods from the current rollout only, and nodeTaintsPolicy: Honor (default Ignore) is needed so a tainted, unschedulable Node doesn’t still count as an empty topology domain. | Node Affinity, Taints & Tolerations |
ValidatingAdmissionPolicy | CEL-based, in-process validation during admission — stable since Kubernetes 1.30 — declaring what to check and how directly in the policy object, with a separate ...Binding object supplying paramRef/match scoping, avoiding the need for a full validating webhook server for many common checks. | Pod & Cluster Security |
values.yaml (Helm) | The Chart’s default configuration file, referenced from templates as {{ .Values.xxx }}; the same Chart deploys to dev, staging, and prod purely by overriding values.yaml at install time (a values override file or --set flags), never by editing the templates themselves. | Helm Package Management |
| VolumeSnapshot | A point-in-time snapshot of a PVC’s underlying storage (snapshot.storage.k8s.io, GA since Kubernetes 1.20), created through a CSI driver that supports snapshotting — the mechanism behind restoring or cloning a PVC to an earlier state. | PVs, PVCs & Storage Classes |
| VPA (VerticalPodAutoscaler) | Adjusts a container’s own requests/limits over time based on observed usage, instead of changing replica count the way HPA does — running HPA and VPA on the same metric for the same workload is a real, documented conflict, not a supported combination. | Pod Disruption & Cluster Autoscaling |
watch / resourceVersion | Every list response carries a resourceVersion; a client opens a watch from that point and receives a stream of add/update/delete events instead of polling — this is how every controller and informer notices a change instantly rather than on a fixed interval. | Architecture: Control Plane & Nodes |