Kubernetes: Core Concepts, Cluster Architecture, and Workload Management

Kubernetes (K8s) is an open-source container orchestration platform designed to automate deploying, scaling, and operating application containers across clusters of nodes. This guide covers Kubernetes cluster architecture, core workloads (Pods, Deployments, StatefulSets), networking models (Services, Ingress), storage primitives, and declarative YAML manifests.

⚡ Quick Dive

Cluster Architecture Components

Component Layer Purpose
kube-apiserver Control Plane REST API gateway; validates and configures data for all objects
etcd Control Plane Consistent, highly-available distributed key-value store for cluster state
kube-scheduler Control Plane Selects optimal worker node for newly created pods
kube-controller-manager Control Plane Runs core controller loops (Node, ReplicaSet, Endpoints)
kubelet Worker Node Primary node agent; ensures containers are running in Pods
kube-proxy Worker Node Maintains network packet filtering rules (iptables/IPVS)
Container Runtime Worker Node Executes containers (e.g., containerd, CRI-O)

Essential kubectl Cheat Sheet

# Cluster & Context inspection
kubectl cluster-info
kubectl get nodes -o wide

# Workload operations
kubectl get pods -A                           # List all pods across all namespaces
kubectl logs -f deployment/my-app -n prod     # Stream logs from deployment
kubectl exec -it pod/my-app-7f89b-x2z -- sh   # Open interactive shell in pod
kubectl port-forward svc/my-service 8080:80   # Port-forward service to local port

# Declarative management
kubectl apply -f manifest.yaml                # Apply configuration
kubectl delete -f manifest.yaml               # Delete resources
kubectl rollout restart deployment/my-app     # Zero-downtime rolling restart

📖 Extended Guide

1. Kubernetes Cluster Architecture

┌──────────────────────────────────────────────────────────────────────────┐
│                          Control Plane (Master)                          │
│   ┌─────────────────┐    ┌─────────────────┐    ┌────────────────────┐   │
│   │ kube-apiserver  │◄──►│      etcd       │    │   kube-scheduler   │   │
│   └────────┬────────┘    └─────────────────┘    └────────────────────┘   │
│            │             ┌────────────────────────┐                      │
│            └────────────►│ kube-controller-manager│                      │
│                          └────────────────────────┘                      │
└────────────────────────────────────┬─────────────────────────────────────┘
                                     │ (HTTPS / gRPC)
       ┌─────────────────────────────┴─────────────────────────────┐
       ▼                                                           ▼
┌──────────────────────────────┐            ┌──────────────────────────────┐
│        Worker Node 1         │            │        Worker Node 2         │
│  ┌────────────────────────┐  │            │  ┌────────────────────────┐  │
│  │        kubelet         │  │            │  │        kubelet         │  │
│  └───────────┬────────────┘  │            │  └───────────┬────────────┘  │
│  ┌───────────┴────────────┐  │            │  ┌───────────┴────────────┐  │
│  │ Container Runtime / CRI│  │            │  │ Container Runtime / CRI│  │
│  └───────────┬────────────┘  │            │  └───────────┬────────────┘  │
│              ▼               │            │              ▼               │
│  ┌───────┐  ┌───────┐        │            │  ┌───────┐  ┌───────┐        │
│  │ Pod 1 │  │ Pod 2 │        │            │  │ Pod 3 │  │ Pod 4 │        │
│  └───────┘  └───────┘        │            │  └───────┘  └───────┘        │
└──────────────────────────────┘            └──────────────────────────────┘

2. Workload Controllers & Resource Hierarchy

  • Pod: The smallest deployable computing unit in Kubernetes. Represents one or more tightly coupled containers sharing network IP and storage volumes.
  • Deployment: Declarative controller that manages ReplicaSets, enabling declarative rolling updates, rollbacks, and self-healing.
  • StatefulSet: Manages stateful workloads (databases like PostgreSQL/Kafka) with stable network identities (pod-0, pod-1) and dedicated Persistent Volumes.
  • DaemonSet: Ensures a copy of a pod runs on every eligible worker node in the cluster (used for log collection fluentd or node monitoring node-exporter).

3. Kubernetes Networking & Service Discovery

Every pod receives its own unique cluster-routable IP address. Because pods are ephemeral, Services provide stable IP endpoints and load balancing:

[ Ingress Controller ] (Traffic In from Internet)
         │
         ▼
[ Service: ClusterIP ] (Stable Virtual IP: 10.96.0.10)
         │
         ├── Load Balances ──► [ Pod 1: 10.244.1.5 ]
         └── Load Balances ──► [ Pod 2: 10.244.2.8 ]

Service Types:

  1. ClusterIP (Default): Exposes the service on a cluster-internal IP. Accessible only within the cluster.
  2. NodePort: Exposes the service on each node's static port (30000-32767).
  3. LoadBalancer: Provisions an external cloud load balancer (AWS NLB, GCP Cloud LB).
  4. Ingress: Application-layer (L7) reverse proxy routing HTTP/HTTPS traffic to internal services based on domain hostnames and paths.

4. Complete Production Manifest (Deployment + Service + Ingress)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-service
  namespace: production
  labels:
    app: api-service
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api-service
  template:
    metadata:
      labels:
        app: api-service
    spec:
      containers:
      - name: web
        image: registry.example.com/api:v1.4.2
        ports:
        - containerPort: 8080
        resources:
          requests:
            cpu: "100m"
            memory: "128Mi"
          limits:
            cpu: "500m"
            memory: "512Mi"
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 10
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 15
          periodSeconds: 20
---
apiVersion: v1
kind: Service
metadata:
  name: api-service
  namespace: production
spec:
  type: ClusterIP
  selector:
    app: api-service
  ports:
  - port: 80
    targetPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  namespace: production
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
⌂ All Guides