An overview of Kubernetes.
Kubernetes (k8s) is a complex container orchestration system that involves many core concepts and resource objects.
Below is a list of the main Kubernetes concepts, grouped by function:
1. Basic core concepts
| Concept | Role |
|---|
| Pod | The smallest deployable unit, containing one or more containers (which share the network/storage namespaces). |
| Node | A worker node (physical or virtual machine); the host that runs Pods. |
| Cluster | A Kubernetes cluster made up of multiple Nodes. |
| Namespace | A logical unit of resource isolation (e.g. dev/prod), used for multi-tenancy or environment isolation. |
2. Workloads
| Concept | Role |
|---|
| Deployment | Manages Pod replicas for stateless applications, with support for rolling updates and rollbacks. |
| StatefulSet | Manages stateful applications (e.g. databases), providing stable network identities and persistent storage. |
| DaemonSet | Ensures that one instance of a given Pod runs on every Node (e.g. a log collector). |
| ReplicaSet | Ensures that a specified number of Pod replicas are running (usually managed automatically by a Deployment). |
| Job | Runs a one-off task; the Pod exits once the task completes. |
| CronJob | A Job that runs on a schedule (similar to Linux Cron). |
3. Networking and access
| Concept | Role |
|---|
| Service | Provides Pods with a stable IP/DNS and load balancing; its types include: |
| - ClusterIP (access from within the cluster) |
| - NodePort (exposed through a port on the node) |
| - LoadBalancer (a cloud provider’s load balancer) |
| Ingress | Exposes services via HTTP/HTTPS routing rules (must be used together with an Ingress Controller). |
| Ingress Controller | The component that implements Ingress rules (e.g. Nginx, Traefik). |
| Endpoint | Records the list of IPs and ports of the Pods backing a Service (maintained automatically). |
| NetworkPolicy | Defines network access rules between Pods (like a firewall). |
4. Storage management
| Concept | Role |
|---|
| Volume | A storage volume mounted in a Pod (its lifecycle is tied to the Pod). |
| PersistentVolume (PV) | A cluster-level persistent storage resource (e.g. a cloud disk/NFS). |
| PersistentVolumeClaim (PVC) | A user’s request for a PV (like a “storage interface”). |
| StorageClass | Defines the storage types for dynamically provisioning PVs (e.g. standard/ssd). |
5. Configuration and security
| Concept | Role |
|---|
| ConfigMap | Stores non-sensitive configuration data (e.g. environment variables, config files). |
| Secret | Stores sensitive data (e.g. passwords, keys), Base64-encoded. |
| ServiceAccount | Assigns an identity to a Pod for access control (used together with RBAC). |
| RBAC | Role-based access control (Role/ClusterRole + RoleBinding). |
| ResourceQuota | Limits the resource usage of a Namespace (e.g. CPU/memory/number of Pods). |
| LimitRange | Limits the resource range of an individual Pod/container within a Namespace. |
6. Extension and operations
| Concept | Role |
|---|
| CustomResourceDefinition (CRD) | Custom resource types that extend the Kubernetes API. |
| Operator | An automated operations framework built on CRDs (e.g. for managing databases or middleware). |
| HorizontalPodAutoscaler (HPA) | Automatically scales the number of Pods based on metrics such as CPU/memory. |
| VerticalPodAutoscaler (VPA) | Automatically adjusts a Pod’s resource requests (CPU/memory). |
| Helm | The Kubernetes package manager; applications are defined and deployed via Charts. |
7. Monitoring and scheduling
| Concept | Role |
|---|
| Kubelet | The agent running on each Node, responsible for managing the Pod lifecycle. |
| kube-scheduler | The scheduler, which decides which Node a Pod runs on (based on resources, affinity, etc.). |
| kube-proxy | Maintains the network rules on a node (e.g. load balancing for Services). |
| Metrics Server | Collects cluster resource metrics (used by HPA/Dashboard). |
| Prometheus | A third-party monitoring system, commonly used for collecting Kubernetes metrics and alerting. |
| Grafana | Visualizes monitoring data (usually paired with Prometheus). |
8. Other important concepts
| Concept | Role |
|---|
| Label | Key-value labels used to classify and select resources (e.g. app=frontend). |
| Selector | Filters resources by Label (e.g. a Service selecting Pods). |
| Annotation | Non-identifying metadata (e.g. build info, configuration notes). |
| Taint/Toleration | Controls whether a Pod can be scheduled onto a specific Node (e.g. dedicated nodes). |
| Affinity/Anti-Affinity | Defines Pod scheduling preferences (e.g. “prefer running in the same availability zone”). |
Translated from the Chinese original.
