Working with Container Orchestration
1. Understanding Container Orchestration
| Capability | Detail |
|---|---|
| Scheduling | Place containers on nodes |
| Self-healing | Restart, reschedule |
| Scaling | HPA/VPA, cluster autoscaler |
| Service discovery | Built-in DNS |
| Standard | Kubernetes |
2. Defining Service Manifests
Example: Kubernetes Deployment + Service
apiVersion: apps/v1
kind: Deployment
metadata: { name: orders }
spec:
replicas: 3
selector: { matchLabels: { app: orders } }
template:
metadata: { labels: { app: orders } }
spec:
containers:
- name: app
image: registry/orders:1.4.0
ports: [{ containerPort: 8080 }]
readinessProbe: { httpGet: { path: /readyz, port: 8080 } }
resources: { requests: { cpu: 200m, memory: 256Mi }, limits: { cpu: 1, memory: 512Mi } }
---
apiVersion: v1
kind: Service
metadata: { name: orders }
spec:
selector: { app: orders }
ports: [{ port: 80, targetPort: 8080 }]
3. Managing Service Replicas
| Aspect | Detail |
|---|---|
| replicas | Static count |
| HPA | Auto on metrics |
| PDB | Min available during disruptions |
| Anti-affinity | Spread across nodes/zones |
4. Implementing Health Checks
| Probe | Action |
|---|---|
| liveness | Restart container |
| readiness | Remove from Service endpoints |
| startup | Delay other probes |
5. Using Resource Limits
| Field | Detail |
|---|---|
| requests | Scheduler reservation |
| limits | Hard cap (OOMKill, throttle) |
| QoS | Guaranteed / Burstable / BestEffort |
| Tip | JVM: -XX:MaxRAMPercentage |
6. Implementing Service Discovery
| Mechanism | Detail |
|---|---|
| CoreDNS | svc.namespace.svc.cluster.local |
| Headless Service | Per-pod DNS for stateful |
| Mesh | Sidecar / ambient L7 routing |
7. Managing Configuration
| Resource | Use |
|---|---|
| ConfigMap | Non-secret config |
| Mount | File or env |
| Reload | Subscribe / restart |
8. Handling Secrets
| Approach | Detail |
|---|---|
| Secret resource | base64; enable etcd encryption |
| External Secrets Operator | Sync from Vault / SM / KMS |
| CSI Secret Store | Mount directly |
9. Implementing Rolling Updates
| Setting | Detail |
|---|---|
| strategy | RollingUpdate (default) |
| maxSurge | 25% typical |
| maxUnavailable | 0 for critical |
10. Using Persistent Storage
| Object | Detail |
|---|---|
| PV / PVC | Claim storage |
| StorageClass | Dynamic provisioning |
| StatefulSet | Stable identity + per-pod PVC |
| CSI driver | EBS, GCE PD, Ceph, Longhorn |
11. Implementing Auto-Scaling
| Layer | Tool |
|---|---|
| Pod horizontal | HPA |
| Pod vertical | VPA |
| Event-driven | KEDA |
| Node | Cluster Autoscaler / Karpenter |
12. Managing Namespaces and Multi-Tenancy
| Element | Detail |
|---|---|
| Namespace | Isolation boundary |
| ResourceQuota | Cap per ns |
| LimitRange | Defaults per pod |
| NetworkPolicy | L3/L4 isolation |
| vCluster / Capsule | Stronger tenancy |