Certified Kubernetes & Cloud-Native Associate
(KCNA)
Notes by Syed Ali Hussain
AIOps Diploma
Introduction to Kubernetes
• Kubernetes (K8s) is an open-source container orchestration platform for
automating deployment, scaling, and management of containerized applications.
• It abstracts infrastructure, allowing applications to run seamlessly across different
environments.
Kubernetes Architecture
• Master Node: Manages the cluster, scheduling workloads, and maintaining
desired states.
o Components: API Server, Controller Manager, Scheduler, etcd.
• Worker Nodes: Run the application workloads.
o Components: Kubelet, Kube Proxy, Container Runtime (e.g., Docker,
containerd).
Key Kubernetes Concepts
a) Pods
• The smallest deployable unit in Kubernetes.
• Can contain one or more containers sharing networking and storage.
b) Deployments
• Manages ReplicaSets to ensure desired state.
• Supports rolling updates and rollbacks.
c) Services
• Exposes a set of pods to network traffic.
• Types: ClusterIP (default), NodePort, LoadBalancer, ExternalName.
d) Namespaces
• Logical partitions within a cluster to manage resources efficiently.
• Useful for multi-tenancy and isolation.
Scheduling Workloads
a) Node Selectors
A simple way to constrain a pod to run on nodes with specific labels.
Example:
b) Node Affinity
More flexible than node selectors, supporting rules like preferred and required
constraints. It Uses node affinity in the pod spec.
Example:
Resource Limits
• Requests: Minimum amount of CPU/memory guaranteed for a pod.
• Limits: Maximum amount of CPU/memory a pod can use.
Example:
DaemonSets
• Ensures a copy of a pod runs on all or some nodes in a cluster.
• Useful for logging, monitoring, and networking applications.
Example:
Static Pods
• Pods managed directly by the Kubelet on a node, not by the API Server.
• Defined in manifest files stored at /etc/kubernetes/manifests/.
• Typically used for control plane components like API Server and etcd.
Multiple Schedulers
• Kubernetes allows multiple schedulers apart from the default one.
• Custom schedulers can be created to handle specialized workloads.
• To use a custom scheduler, specify schedulerName in the pod spec.
Example:
Kubernetes Security Overview
• Authentication: Who are you? (Certificates, service accounts, etc.)
• Authorization: What can you do? (RBAC, ABAC, Node Authorization,
Webhooks)
• Admission Control: Policy enforcement before scheduling.
• Network Policies: Control traffic between pods.
• Secrets Management: Store sensitive data securely.
Authorization Mechanisms
a) Node Authorization
• Grants permissions based on the node’s identity.
b) Role-Based Access Control (RBAC)
• Uses Roles and RoleBindings to grant permissions.
c) Attribute-Based Access Control (ABAC)
• Policy-driven access control.
d) Webhook Authorization
• External service decides if the request is authorized.
Cluster Roles and Service Accounts
• Cluster Roles: Provide permissions cluster-wide.
• Service Accounts: Grant pods permissions to access API Server resources.
Networking in Kubernetes
a) Network Policies
• Define rules for pod communication.
b) Cluster Networking
• Uses CNI (Container Network Interface) plugins.
c) Pod Networking & DNS
• Pods communicate via a flat network.
• DNS services resolve pod/service names.
Advanced Concepts
a) Sidecars & Envoys
• Helper containers that enhance application functionality.
b) Monolithic vs Microservices
• Monolithic: Single large application.
• Microservices: Small, independently deployable services.
c) Service Mesh
• Manages service-to-service communication.
Autoscaling
• Horizontal Pod Autoscaler (HPA): Scales pods based on CPU/memory.
• Vertical Pod Autoscaler (VPA): Adjusts pod resource requests/limits.
• Cluster Autoscaler: Adjusts cluster size based on demand.
Observability & Cost Management
a) Serverless
• Deploying applications without managing infrastructure.
b) Open Standards
• Ensuring compatibility and interoperability in cloud-native environments.
c) Observability
• SLI (Service Level Indicator): Measurable metric.
• SLO (Service Level Objective): Target for SLI.
• SLA (Service Level Agreement): Contractual performance guarantee.
d) Cost Management
• Optimizing resource utilization to minimize cloud costs.
Let’s connect on LinkedIn:
[Link]