Kubernetes administration

Correct — pods run on the worker nodes; that is their whole job.

Correct — isolating the brain from the muscle keeps the cluster stable under load.

Correct — apply reconciles the live object toward your file; create is one-shot.

Correct — it prints the YAML the command would create, so you save and edit it.

Correct — who are you, may you, is it allowed by policy, then write to etcd.

Correct — 403 means you are known but not permitted.

Correct — etcd is the single source of truth for the cluster.

Correct — Raft needs a majority to commit; 3 tolerate 1 failure, 5 tolerate 2.

Correct — this reconcile loop is the heart of Kubernetes.

Correct — garbage collection follows owner references down the tree.

Correct — the kubelet takes pod specs and drives the runtime to start them.

Correct — it sets up iptables/IPVS to turn a ClusterIP into an endpoint.

Correct — this shared context is exactly what makes sidecars possible.

Correct — with no controller, there is nothing to replace it.

Correct — it adds or removes pods until the count matches.

Correct — apps/v1 validates the template labels against the selector; a mismatch fails with `selector` does not match template `labels`, so nothing is created.

Correct — Deployment → ReplicaSet → Pods; you drive the top.

Correct — rollout undo simply re-scales a previous ReplicaSet.

Correct — most per-team controls attach at the namespace.

Correct — namespaces separate names and defaults, not traffic.

Correct — new pods come up before old ones leave, so there is no gap.

Correct — the old ReplicaSet is retained, so it just scales back up.

Correct — used only when two versions cannot safely run at once.

Correct — two versions run; you flip traffic by changing the selector.

Correct — Jobs are for finite, run-to-completion work.

Correct — safe for jobs that must not overlap.

Correct — command → ENTRYPOINT, args → CMD.

Correct — args maps to CMD, the default arguments.

Correct — it keeps settings out of the image so one image runs everywhere.

Correct — run kubectl rollout restart, or mount it as a file instead.

Correct — anyone who can read it can decode it instantly.

Correct — a file is read only by code that opens it.

Correct — each must exit 0 before the next, and all before the app.

Correct — it blocks the pod until the init step passes.

Correct — the helper shares the pod’s network and files with the app.

Correct — a pod scales and deploys as one unit — split them.

Correct — it adjusts replicas to keep the metric near target.

Correct — utilization is a percentage of the request, so it is required.

Correct — filter drops nodes that cannot run it; scoring ranks the survivors.

Correct — describe shows which predicate rejected every node.

Correct — the kubelet there just runs it.

Correct — no scheduler means no automatic placement.

Correct — Services, ReplicaSets, and scheduling all rely on label selection.

Correct — a classic cause of a Service with zero endpoints.

Correct — the toleration is the pod opting back in.

Correct — NoSchedule blocks new pods; NoExecute removes existing ones too.

Correct — the counterpart to taints.

Correct — no matching node means it cannot be placed.

Correct — anti-affinity keeps copies apart.

Correct — hostname = per-node, zone = per-zone.

Correct — skew is the allowed difference between domains.

Correct — that is how critical pods always schedule.

Correct — requests are what it reserves and places against.

Correct — the kernel kills a container that exceeds its memory limit.

Correct — ideal for log shippers, agents, and CNI.

Correct — the toleration lets it land on tainted nodes.

Correct — no API server or scheduler is involved.

Correct — the kubelet reloads it from disk on save.

Correct — it names the scheduler that should place the pod.

Correct — nothing ever places it.

Correct — this flat-network rule underlies everything.

Correct — front pods with a Service for a stable address.

Correct — the kubelet calls it when a pod starts.

Correct — the kubelet will not schedule pods it cannot give a network.

Correct — a Service load-balances to the currently healthy pods.

Correct — a label mismatch or a failing readiness probe.

Correct — the kernel DNATs it to a ready endpoint.

Correct — each node programs its own Service rules.

Correct — names resolve to the Service’s IP.

Correct — pods cannot reach kube-dns once caches expire.

Correct — the object is only rules; a controller acts on them.

Correct — each rule maps a host/path to a Service.

Correct — infra, ops, and app teams each own a resource.

Correct — a controller must implement them.

Correct — volumes are how you keep data across restarts.

Correct — good for sharing files between a pod’s containers.

Correct — the pod names the claim, never the disk.

Correct — kubectl describe pvc shows the exact reason.

Correct — a claim triggers the provisioner to mint a PV.

Correct — avoids stranding a volume in the wrong failure domain.

Correct — two pods on the same node can share an RWO volume.

Correct — convenient for scratch, dangerous for a database.

Correct — db-0 keeps its volume and DNS name across reschedules.

Correct — clean them up explicitly if you truly mean to.

Correct — the result is a username and a set of groups.

Correct — identity comes from the credential, not a cluster object.

Correct — each presents and verifies a cert.

Correct — run kubeadm certs check-expiration ahead of time.

Correct — a context ties a user to a cluster and default namespace.

Correct — never distribute it; issue scoped kubeconfigs instead.

Correct — the default is deny.

Correct — the reuse trick: define once, grant per namespace.

Correct — you bind RBAC to it to give a pod API access.

Correct — set automountServiceAccountToken: false where the API is not needed.

Correct — the last gate before an object is persisted.

Correct — scope it narrowly and exclude kube-system.

Correct — the core container-hardening controls.

Correct — set runAsUser to a real non-root UID as well.

Correct — label the namespace with a mode and a profile.

Correct — find offenders before you block anyone.

Correct — NetworkPolicies add the allowlist you need.

Correct — some CNIs (e.g. Flannel) do not, leaving policies inert.

Correct — a short-lived snapshot source.

Correct — it is not built in.

Correct — it reads the previous, crashed container’s output.

Correct — Fluent Bit/Vector into Loki or Elasticsearch.

Correct — FailedScheduling, ImagePullBackOff, Unhealthy, and so on.

Correct — its recent events are listed at the bottom.

Correct — use kubectl debug with an ephemeral tools container.

Correct — troubleshoot minimal images without rebuilding.

Correct — stop new pods, then evict the existing ones gracefully.

Correct — and --delete-emptydir-data when scratch volumes exist.

Correct — move pods off first, then patch and return the node.

Correct — about five minutes, not instant — so drain first when planned.

Correct — which is why the control plane is upgraded first.

Correct — then the nodes, one by one.

Correct — after checking kubeadm upgrade plan.

Correct — one node at a time.

Correct — it holds all cluster state; losing it loses everything.

Correct — restoring over a live etcd corrupts it.

Correct — stop at the first “no.”

Correct — Pending/ImagePull/CrashLoop reasons live in Events.

Correct — no endpoints = no ready, label-matched pod.

Correct — bad config, a missing secret, a failed dependency, or OOMKilled.

Correct — inspect the apiserver/etcd containers directly.

Correct — kubeadm certs check-expiration catches it beforehand.

Correct — check systemctl status kubelet and its journal.

Correct — it taints the node and evicts pods; watch image/log growth.

Correct — test each link in the order a packet travels.

Correct — the most common self-inflicted network outage.