Kubernetes Cheat Sheet

Cluster Architecture

Control Plane Components

kube-apiserver — front-door for all cluster ops; validates & processes REST requests
etcd — distributed key-value store; single source of truth for cluster state
kube-scheduler — watches unscheduled pods; picks best node based on resources & constraints
kube-controller-manager — runs control loops (Deployment, Node, Endpoint controllers)
cloud-controller-manager — cloud-provider-specific logic (LB, volumes, routes)

Node Components

kubelet — node agent; ensures containers in pods are running & healthy
kube-proxy — maintains network rules (iptables/IPVS) for Service routing
Container Runtime — containerd / CRI-O (Docker removed in k8s 1.24+)

Core Object Hierarchy

Label Selectors — the Glue of K8s ⭐

Essential kubectl Commands 🔥

Common Flags

Generate YAML Fast ⭐

Context & Kubeconfig

JSONPath & Custom Output

Complete Pod YAML Reference 🔥

Multi-container Pod Patterns

Sidecar — runs alongside main container (log shipper, proxy, sync)
Init Container — runs before main containers; must complete successfully first
Ambassador — proxy for main container (e.g. Envoy sidecar)
Adapter — standardizes output format from main container

💡 Containers in a pod share the same network namespace — communicate via localhost.

Resource Units

⚠️ Exceeding memory limit → OOMKilled. Exceeding CPU limit → throttled (not killed).

Deployment YAML 🔥

Rollout Commands

Update Strategies

Deployment vs ReplicaSet

ReplicaSet ensures N pods are always running — no update logic
Deployment manages ReplicaSets — adds rolling updates, rollback history
Never create a ReplicaSet directly — always use Deployment
During rollout: old RS scales down, new RS scales up simultaneously

Service Types 🔥

Service YAML

NodePort & LoadBalancer

DNS in Kubernetes ⭐

Ingress YAML — Path & Host Routing 🔥

Popular Ingress Controllers

ingress-nginx — most popular; nginx-based; rich annotation support
Traefik — auto-discovers services; built-in Let's Encrypt
AWS ALB Controller — creates ALBs on EKS
GCE Ingress — Google Cloud HTTP(S) LB on GKE
Istio Gateway — service mesh ingress with traffic management

💡 Ingress is just an API object — it needs an Ingress Controller installed to actually route traffic.

IngressClass (k8s 1.18+)

ConfigMap

Secret

⚠️ Secrets are base64, NOT encrypted by default. Use Sealed Secrets or external secret managers in prod.

Using ConfigMap & Secret in Pods

Secret Types

Storage Flow 🔥

PersistentVolumeClaim

StorageClass (Dynamic Provisioning) ⭐

Access Modes

Volume Types

<code>emptyDir</code> — ephemeral scratch space; deleted with pod
<code>hostPath</code> — mounts host directory (dangerous in prod)
<code>configMap / secret</code> — mount config as files
<code>persistentVolumeClaim</code> — attach a PVC
<code>nfs</code> — NFS share (RWX capable)
<code>projected</code> — combine multiple volume sources
<code>csi</code> — Container Storage Interface driver (EBS, EFS, Ceph…)

Namespace Commands

Namespace YAML + ResourceQuota

LimitRange (Per-pod defaults)

💡 LimitRange applies default resources to pods that don't specify them.

Default Namespaces

default — where objects go if no namespace is specified
kube-system — system components (coredns, kube-proxy, api-server)
kube-public — publicly readable; cluster-info ConfigMap
kube-node-lease — node heartbeat lease objects

RBAC Objects

Role + RoleBinding

ServiceAccount for Pods

💡 Pods get the default SA automatically — create dedicated SAs and grant minimal permissions.

Check Permissions

StatefulSet 🔥

💡 StatefulSet pods get stable names: db-0, db-1, db-2. Ordered create (0→N) & delete (N→0).

StatefulSet vs Deployment

DaemonSet

💡 DaemonSet guarantees one pod per node. Used for: log collectors, monitoring agents, CNI plugins, kube-proxy.

Job

CronJob

Cron Expression Quick Ref

Manual Scaling

HorizontalPodAutoscaler (HPA) 🔥

VPA & Cluster Autoscaler

HPA — horizontal: adds/removes pod replicas based on metrics
VPA (VerticalPodAutoscaler) — vertical: adjusts CPU/mem requests per pod
Cluster Autoscaler — adds/removes nodes when pods can't be scheduled
KEDA — event-driven autoscaling (queues, Kafka, cron, Prometheus)

⚠️ HPA requires metrics-server installed in the cluster.

Taints & Tolerations / Affinity

Probe Types 🔥

Probe Mechanisms

Probe Parameters

Container Lifecycle Hooks

💡 Use preStop + terminationGracePeriodSeconds for zero-downtime pod shutdown.

Helm Core Concepts

Essential Helm Commands 🔥

Chart Template Basics

Helm Debug & Dry Run

kubectl Master Cheat Table 🔥

Common Gotchas ⭐

ImagePullBackOff — wrong image name/tag or missing imagePullSecret for private registry
CrashLoopBackOff — container keeps crashing; check <code>kubectl logs --previous <pod></code>
Pending pod — no node with enough resources, or PVC not bound, or no matching node selector
Service not routing — selector labels don't match pod labels exactly
readinessProbe vs livenessProbe — only readiness removes pod from endpoints; liveness restarts
Resource limits missing — pods can starve other workloads; always set requests + limits
Secrets are base64, not encrypted — use Sealed Secrets / Vault / AWS SSM for real security
ClusterIP is not reachable from outside — use NodePort, LB, or Ingress
PVC stays Pending — no StorageClass available, or no PV matching the claim spec
kubectl apply vs create — always prefer <code>apply</code>; it's idempotent and tracks state
HPA has no effect — metrics-server not installed, or no resource requests defined on pods
Terminating namespace stuck — finalizers not cleaned; check <code>kubectl get ns -o yaml</code>

Security Best Practices

Use dedicated ServiceAccounts per app; disable auto-token-mount if not needed
Always define resource requests & limits — prevents resource starvation
Use NetworkPolicy to restrict pod-to-pod communication
Never run as root — set <code>runAsNonRoot: true</code> and <code>runAsUser: 1000</code>
Set readOnlyRootFilesystem: true in securityContext
Use Pod Security Admission (replaces PodSecurityPolicy in 1.25+)
Encrypt Secrets at rest using EncryptionConfiguration
Scan images with Trivy or Grype in CI/CD

Resource Shortnames