Kubernetes Administration.
Cheat sheet.

Comprehensive guide to Kubernetes administration covering cluster management, workload deployment, networking, storage, and security. Master kubectl commands, YAML manifests, RBAC, and troubleshooting techniques. Essential knowledge for managing production Kubernetes clusters and demonstrating container orchestration expertise.

Architecture Components

• Control Plane: API Server, etcd, Scheduler, Controller Manager, Cloud Controller Manager
• Worker Nodes: kubelet, kube-proxy, Container Runtime

Key Objects

• Pod: Smallest deployable unit (one or more containers)
• Service: Stable network endpoint for pods
• Deployment: Manages ReplicaSets and provides declarative updates
• Namespace: Virtual cluster for resource isolation

Basic Syntax

kubectl [command] [TYPE] [NAME] [flags]

Context & Config

kubectl config get-contexts              # List contexts
kubectl config use-context <name>        # Switch context
kubectl config current-context           # Show current context
kubectl config set-context --current --namespace=<ns>  # Set default namespace

Quick Commands

kubectl get all -A                       # All resources in all namespaces
kubectl api-resources                    # List all resource types
kubectl explain pod.spec                 # Get field documentation
kubectl get nodes -o wide               # Node details with IP

Create Pod

# pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
  labels:
    app: nginx
spec:
  containers:
  - name: nginx
    image: nginx:1.21
    ports:
    - containerPort: 80

kubectl apply -f pod.yaml
kubectl run nginx --image=nginx:1.21    # Quick create
kubectl run test --image=busybox --rm -it -- /bin/sh  # Temporary debug pod

Pod Operations

kubectl get pods -o wide                 # List with node info
kubectl describe pod <pod-name>          # Detailed info
kubectl logs <pod-name> -c <container>   # Container logs
kubectl logs <pod-name> --previous       # Previous container logs
kubectl exec -it <pod-name> -- /bin/bash # Shell access
kubectl port-forward <pod-name> 8080:80  # Port forwarding
kubectl cp file.txt <pod-name>:/tmp/     # Copy files

Create Deployment

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.21
        ports:
        - containerPort: 80

Deployment Commands

kubectl create deployment nginx --image=nginx:1.21 --replicas=3
kubectl scale deployment nginx --replicas=5
kubectl set image deployment/nginx nginx=nginx:1.22
kubectl rollout status deployment/nginx
kubectl rollout history deployment/nginx
kubectl rollout undo deployment/nginx --to-revision=2
kubectl autoscale deployment nginx --min=2 --max=10 --cpu-percent=80

Service Types

• ClusterIP: Internal cluster access (default)
• NodePort: External access via node ports (30000-32767)
• LoadBalancer: Cloud provider load balancer
• ExternalName: DNS CNAME redirect

Create Service

# service.yaml
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
  ports:
  - port: 80
    targetPort: 80
  type: ClusterIP

kubectl expose deployment nginx --port=80 --type=ClusterIP
kubectl expose deployment nginx --port=80 --type=NodePort
kubectl get svc nginx-service -o yaml
kubectl get endpoints

Ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
spec:
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx-service
            port:
              number: 80

PersistentVolume & PersistentVolumeClaim

# pv.yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-data
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: /data
---
# pvc.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-data
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi

Volume Types

• emptyDir: Temporary directory
• hostPath: Node filesystem
• persistentVolumeClaim: Dynamic provisioning
• configMap/secret: Configuration data

Pod with Volume

spec:
  volumes:
  - name: data-volume
    persistentVolumeClaim:
      claimName: pvc-data
  containers:
  - name: app
    volumeMounts:
    - name: data-volume
      mountPath: /data

ConfigMap

kubectl create configmap app-config --from-literal=key1=value1
kubectl create configmap app-config --from-file=config.properties
kubectl get configmap app-config -o yaml

# Using in Pod
spec:
  containers:
  - name: app
    env:
    - name: CONFIG_KEY
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: key1
    volumeMounts:
    - name: config-volume
      mountPath: /config
  volumes:
  - name: config-volume
    configMap:
      name: app-config

Secrets

kubectl create secret generic db-secret --from-literal=password=abc123
kubectl create secret tls tls-secret --cert=cert.pem --key=key.pem
kubectl get secret db-secret -o jsonpath='{.data.password}' | base64 -d

# Using in Pod
spec:
  containers:
  - name: app
    env:
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: password

SecurityContext

spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  containers:
  - name: app
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        add: ["NET_ADMIN"]

Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: web-netpol
spec:
  podSelector:
    matchLabels:
      app: web
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - port: 80

Pod Security Standards

# Namespace label for Pod Security
metadata:
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

Resource Requests & Limits

spec:
  containers:
  - name: app
    resources:
      requests:
        memory: "256Mi"
        cpu: "250m"
      limits:
        memory: "512Mi"
        cpu: "500m"

ResourceQuota

apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    persistentvolumeclaims: "2"

LimitRange

apiVersion: v1
kind: LimitRange
metadata:
  name: mem-limit-range
spec:
  limits:
  - default:
      memory: 512Mi
    defaultRequest:
      memory: 256Mi
    type: Container

Basic Monitoring

kubectl top nodes                        # Node resource usage
kubectl top pods                         # Pod resource usage
kubectl top pods --containers            # Container-level metrics

Logging

kubectl logs <pod-name>                  # Current logs
kubectl logs <pod-name> -f               # Follow logs
kubectl logs <pod-name> --tail=100       # Last 100 lines
kubectl logs <pod-name> --since=1h       # Logs from last hour
kubectl logs -l app=nginx --all-containers  # Logs from all containers

Events

kubectl get events --sort-by='.lastTimestamp'
kubectl get events --field-selector type=Warning
kubectl describe pod <pod-name>          # Shows events at bottom

Common Issues & Solutions

Pod Not Starting

kubectl describe pod <pod-name>          # Check events
kubectl logs <pod-name> --previous       # Check crash logs
kubectl get pod <pod-name> -o yaml       # Check full spec

Common Pod States

• Pending: Waiting for scheduling
• CrashLoopBackOff: Container repeatedly crashing
• ImagePullBackOff: Cannot pull image
• CreateContainerConfigError: ConfigMap/Secret missing

Debugging Commands

kubectl run debug --image=busybox -it --rm -- /bin/sh
kubectl debug <pod-name> -it --image=busybox --target=<container>
kubectl exec <pod-name> -- nslookup kubernetes.default
kubectl exec <pod-name> -- cat /etc/resolv.conf

Node Management

kubectl cordon <node-name>               # Mark unschedulable
kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data
kubectl uncordon <node-name>             # Mark schedulable
kubectl taint nodes <node> key=value:NoSchedule
kubectl taint nodes <node> key:NoSchedule-  # Remove taint

etcd Backup & Restore

# Backup
ETCDCTL_API=3 etcdctl snapshot save snapshot.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# Verify
ETCDCTL_API=3 etcdctl snapshot status snapshot.db

# Restore
ETCDCTL_API=3 etcdctl snapshot restore snapshot.db \
  --data-dir=/var/lib/etcd-backup

Certificate Management

kubeadm certs check-expiration
kubeadm certs renew all
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -text -noout

ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-sa
  namespace: default

Role & RoleBinding

# Role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
---
# RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
subjects:
- kind: ServiceAccount
  name: app-sa
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

ClusterRole & ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]

RBAC Commands

kubectl create serviceaccount app-sa
kubectl create role pod-reader --verb=get,list --resource=pods
kubectl create rolebinding read-pods --role=pod-reader --serviceaccount=default:app-sa
kubectl auth can-i create pods --as=system:serviceaccount:default:app-sa
kubectl auth can-i '*' '*' --all-namespaces  # Check admin access

StatefulSets

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  serviceName: "nginx"
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 1Gi

DaemonSets

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd
spec:
  selector:
    matchLabels:
      app: fluentd
  template:
    metadata:
      labels:
        app: fluentd
    spec:
      containers:
      - name: fluentd
        image: fluentd

Jobs & CronJobs

# Job
apiVersion: batch/v1
kind: Job
metadata:
  name: backup
spec:
  template:
    spec:
      containers:
      - name: backup
        image: backup-image
        command: ["backup.sh"]
      restartPolicy: OnFailure
  backoffLimit: 3
---
# CronJob
apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: backup-image
          restartPolicy: OnFailure

Pod Disruption Budget

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: web-pdb
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: web

Horizontal Pod Autoscaler

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

Must-Know Technical Concepts

1. Architecture Components

   • Control plane: API Server, etcd, Scheduler, Controller Manager
   • Data plane: kubelet, kube-proxy, container runtime
   • Understand component interactions and failure scenarios

2. Workload Resources

   • Deployment vs StatefulSet vs DaemonSet use cases
   • Pod lifecycle and states
   • Init containers and sidecar patterns
   • Job/CronJob for batch processing

3. Networking Deep Dive

   • Service types and when to use each
   • Ingress controllers and routing
   • Network policies for microsegmentation
   • DNS resolution within cluster

4. Storage Concepts

   • PV/PVC lifecycle and binding
   • Storage classes and dynamic provisioning
   • Volume types and access modes
   • StatefulSet persistent storage

5. Security Implementation

   • RBAC design patterns
   • Pod Security Standards (replacing PSPs)
   • Secret management best practices
   • Network policies for zero-trust

Common Troubleshooting Scenarios

1. Pod not starting: Check events, logs, resource availability
2. Service not accessible: Verify selectors, endpoints, network policies
3. Storage issues: Check PV/PVC status, access modes, storage class
4. Performance problems: Review resource limits, node capacity, HPA
5. Security concerns: Implement RBAC, SecurityContext, Network Policies

Best Practices

• Always use resource limits and requests
• Implement health checks (liveness/readiness probes)
• Use namespaces for multi-tenancy
• Follow least privilege principle for RBAC
• Regular backups of etcd
• Use labels and selectors consistently
• Implement pod disruption budgets for HA
• Monitor cluster and application metrics

Quick Debugging Checklist

1. kubectl get events -A --sort-by='.lastTimestamp'
2. kubectl describe pod <pod-name>
3. kubectl logs <pod-name> --previous
4. kubectl get pods -o wide
5. kubectl top nodes && kubectl top pods
6. kubectl get all -A | grep -i error

Production Best Practices

1. Resource Management

   • Always set resource requests and limits
   • Implement ResourceQuotas per namespace
   • Use LimitRanges for defaults
   • Monitor resource utilization

2. High Availability

   • Multi-master control plane setup
   • Pod disruption budgets for updates
   • Anti-affinity rules for spreading
   • Regular etcd backups

3. Security Hardening

   • Enable RBAC and audit logging
   • Use Pod Security Standards
   • Implement network policies
   • Scan images for vulnerabilities
   • Rotate certificates regularly

4. Operational Excellence

   • GitOps for deployment management
   • Implement proper labeling strategy
   • Use namespaces for multi-tenancy
   • Automate with operators
   • Monitor with Prometheus/Grafana

Key Interview Differentiators

• Experience with production cluster upgrades
• Understanding of CNI plugins (Calico, Cilium)
• Knowledge of service mesh (Istio, Linkerd)
• Ability to debug complex networking issues
• Experience with CKA/CKAD certification topics

Golden Rule: In Kubernetes, everything is declarative. Focus on understanding the desired state model and how controllers work to achieve it. Always test changes in non-production first and maintain comprehensive monitoring.