Orchestration

Kubernetes Orchestration: The Captain of the Container Ship

Updated June 2026
Server Cluster Racks Networking Setup
Kubernetes coordinates, manages, and scales thousands of Docker containers across a server cluster automatically.

Docker is a fantastic tool for creating and running containerized boxes on your computer. But what happens when tech giants like Spotify, Netflix, or BookMyShow need to run thousands of containers simultaneously across hundreds of cloud servers? Managing them manually, checking if they crash, and connecting them to the network becomes a logistical nightmare.

This is why we use Kubernetes (often called K8s). It acts as the ultimate automated supervisor for all your containers.

The Cargo Ship Captain Metaphor

If a single Docker container is a standardized metal shipping box, then a large web application is a massive cargo ship loaded with 10,000 boxes. If boxes are loaded incorrectly, the ship will tip over. If a box starts leaking or falls off, the cargo is lost. You need a captain to supervise everything.

Kubernetes is the Cargo Ship Captain. K8s coordinates where to stack containers based on server capacity (RAM and CPU), monitors if containers crash and restarts them, and acts as a harbor master directing network traffic so everything moves smoothly.

Real-World Example: Hotstar During an IPL Cricket Match

Imagine Hotstar is streaming an IPL cricket final. On a normal weekday morning, only 1,000 users are active, so Hotstar runs its application on just 5 container instances to save cloud hosting costs.

Suddenly, the match starts and 1 crore (10 million) fans log in simultaneously to stream the game. The 5 containers immediately get overloaded and will crash. Hotstar engineers don't have time to manually buy new servers or start containers one by one.

The Kubernetes Solution: Kubernetes detects that container CPU usage is spiking past 80%. It automatically spins up 5,000 new streaming container replicas across dozens of cloud servers in seconds. Once the match finishes and fans log off, Kubernetes automatically scales down and deletes the extra containers to save money. That is K8s automation!

The Core Vocabulary of Kubernetes

Kubernetes uses specific names for its parts. Let's break down the core hierarchy from the smallest unit to the largest system:

Pod

The smallest deployable unit in K8s. A Pod is a wrapper (like a peanut shell) that holds your running Docker container (the peanut).

Node

A single worker computer or virtual machine (like an AWS EC2 instance) that physically hosts and runs the Pods.

Cluster

The brain. A collection of multiple Nodes controlled by a master control plane working together as a single supercomputer.

Deployment

The manager. You tell the deployment: "Keep 3 copies of my app running." If a server dies, the deployment immediately spawns a replacement.

7 Everyday kubectl Commands Every Engineer Needs

To control Kubernetes, you use a CLI tool called kubectl (pronounced "cube control"). Here is the cheat sheet of the 7 commands you will use daily:

Purpose kubectl Command Real-World Analogy & Example
List Running Pods kubectl get pods Lists all active app containers and shows if they are healthy or crashing.
Example: kubectl get pods (Shows names, status, and restarts).
List Server Nodes kubectl get nodes Lists all the physical/virtual computer servers linked to the cluster.
Example: kubectl get nodes
Deploy/Modify Apps kubectl apply -f <file.yaml> Feeds a YAML configuration blueprint to the cluster to create or update resources.
Example: kubectl apply -f deployment.yaml
Delete Resources kubectl delete -f <file.yaml> Deletes deployed resources described in the YAML file from the cluster.
Example: kubectl delete -f deployment.yaml
View Application Logs kubectl logs <pod-name> Displays stdout logs from your app container to debug errors or warnings.
Example: kubectl logs my-web-pod-a1b2
Describe Resource Details kubectl describe pod <pod-name> Prints detailed metadata, events, and configuration errors for troubleshooting.
Example: kubectl describe pod my-web-pod-a1b2
Scale Manually kubectl scale --replicas=<N> deploy/<name> Tells K8s to immediately spin up or scale down your app to exactly N copies.
Example: kubectl scale --replicas=10 deployment/my-api

Pro-Tip: Pod Self-Healing

In Kubernetes, never restart a pod manually! If you delete a crashing pod using kubectl delete pod <name>, the supervising Deployment will instantly spawn a brand new pod with a fresh IP address to replace it. K8s is self-healing!

Next Steps on Your DevOps Journey

Now that you can run containerized clusters at scale using Kubernetes, you run into another DevOps roadblock: How do we write down all these server networks, K8s clusters, and databases as reusable code blueprints rather than clicking buttons on cloud dashboards? Enter Terraform (Infrastructure as Code)!

Test Your Knowledge

Answer these 35 questions to check your understanding of this module. Click on an option to reveal the correct answer instantly.

Question 1 of 35
What is a Pod?
A. A virtual machine
B. The smallest deployable unit
C. A node
D. A cluster
Explanation: A Pod is the smallest and simplest Kubernetes object.
Question 2 of 35
Which tool is the CLI for Kubernetes?
A. kubecmd
B. kubectl
C. k8s-cli
D. kubeadm
Explanation: kubectl is the command line tool for communicating with the cluster.
Question 3 of 35
What manages the state of the cluster?
A. etcd
B. scheduler
C. controller-manager
D. kubelet
Explanation: etcd is a consistent and highly-available key value store for cluster data.
Question 4 of 35
What component runs on every node and starts pods?
A. kube-proxy
B. kubelet
C. api-server
D. etcd
Explanation: The kubelet ensures that containers are running in a Pod.
Question 5 of 35
What resource ensures a specified number of pod replicas are running?
A. Pod
B. Service
C. ReplicaSet (or Deployment)
D. Ingress
Explanation: A ReplicaSet ensures that a specified number of pod replicas are running.
Question 6 of 35
Which service type exposes the service on each Node’s IP?
A. ClusterIP
B. NodePort
C. LoadBalancer
D. ExternalName
Explanation: NodePort exposes the Service on the same port of each selected Node.
Question 7 of 35
What is a Namespace?
A. A physical server
B. A virtual cluster
C. A network rule
D. A storage type
Explanation: Namespaces provide a mechanism for isolating groups of resources.
Question 8 of 35
What is used to define Kubernetes objects?
A. JSON/YAML
B. HTML
C. XML
D. Java
Explanation: K8s resources are typically defined in YAML or JSON files.
Question 9 of 35
How do you list all pods?
A. kubectl list pods
B. kubectl get pods
C. kubectl show pods
D. kubectl view pods
Explanation: kubectl get pods lists all pods in the namespace.
Question 10 of 35
What is a ConfigMap?
A. A map of the network
B. Object to store non-confidential data
C. A secret storage
D. A mapping of ports
Explanation: ConfigMaps store non-confidential data in key-value pairs.
Question 11 of 35
What is a Secret?
A. Hidden pod
B. Object to store sensitive data
C. Private network
D. Hidden log
Explanation: Secrets are used to store sensitive information like passwords or keys.
Question 12 of 35
What is a DaemonSet?
A. Runs a copy of a pod on all nodes
B. Runs a background process
C. Manages database
D. Manages networking
Explanation: A DaemonSet ensures that all (or some) Nodes run a copy of a Pod.
Question 13 of 35
What does "kubectl apply -f" do?
A. Deletes resources
B. Creates/Updates resources from a file
C. Formats a file
D. Filters output
Explanation: It applies a configuration change to a resource from a file.
Question 14 of 35
What is an Ingress?
A. A firewall
B. Internal load balancer
C. Manages external access to services (HTTP/S)
D. A database connector
Explanation: Ingress exposes HTTP and HTTPS routes from outside the cluster to services.
Question 15 of 35
What is a StatefulSet used for?
A. Stateless apps
B. Stateful apps (like databases)
C. Batch jobs
D. One-time tasks
Explanation: StatefulSet manages stateful applications with stable identities.
Question 16 of 35
What is a PersistentVolume?
A. RAM storage
B. Storage that survives pod restart
C. Temporary cache
D. Network bandwidth
Explanation: PV is a piece of storage in the cluster that has a lifecycle independent of any Pod.
Question 17 of 35
How do you check logs of a pod?
A. kubectl logs
B. kubectl read
C. kubectl cat
D. kubectl monitor
Explanation: kubectl logs prints the logs for a container in a pod.
Question 18 of 35
What is a Liveness Probe?
A. Checks if pod is ready to accept traffic
B. Checks if container is running
C. Checks if node is alive
D. Checks network speed
Explanation: It checks if the container is running; if it fails, K8s restarts the container.
Question 19 of 35
What is a Readiness Probe?
A. Checks if pod is ready to accept traffic
B. Checks if container is alive
C. Checks disk space
D. Checks CPU
Explanation: It determines if a container is ready to accept service requests.
Question 20 of 35
What is "Minikube"?
A. A small pod
B. A tool to run K8s locally
C. A minimal container
D. A reduced kubectl
Explanation: Minikube implements a local Kubernetes cluster.
Question 21 of 35
What is a Job in K8s?
A. A background service
B. A scheduled task that runs to completion
C. A recruitment post
D. A network task
Explanation: A Job creates one or more Pods and ensures that a specified number of them successfully terminate.
Question 22 of 35
What is a CronJob?
A. A time-based job scheduler
B. A continuous service
C. A database backup
D. A monitoring tool
Explanation: A CronJob creates Jobs on a repeating schedule.
Question 23 of 35
How do you enter a shell inside a pod?
A. kubectl ssh
B. kubectl exec -it
C. kubectl enter
D. kubectl shell
Explanation: kubectl exec -it -- /bin/bash allows interactive shell access.
Question 24 of 35
What is Helm?
A. A dashboard
B. A package manager for Kubernetes
C. A monitoring tool
D. A network plugin
Explanation: Helm helps you manage Kubernetes applications.
Question 25 of 35
What component schedules pods to nodes?
A. kube-scheduler
B. kube-controller
C. etcd
D. api-server
Explanation: kube-scheduler watches for newly created Pods and selects a node for them.
Question 26 of 35
What is a key characteristic of Init Containers in a Pod?
A. They run in parallel with application containers.
B. They must run sequentially and complete successfully before application containers start.
C. They do not support resource request limits.
D. They reboot automatically if the main container fails.
Explanation: Init containers run before the app container starts. If an init container fails, kubelet restarts the Pod until it succeeds.
Question 27 of 35
Which controller is best suited for deploying stateful workloads that require stable network identifiers and persistent storage?
A. Deployment
B. DaemonSet
C. StatefulSet
D. ReplicaSet
Explanation: StatefulSet manages pods with sticky network IDs and stable disk storage matching pods dynamically across rescheduling.
Question 28 of 35
What is a Headless Service in Kubernetes?
A. A service without ports configured.
B. A service with clusterIP set to "None", returning pod IP addresses directly via DNS.
C. An internal load balancer without public external ingress routing.
D. A service that maps to an external hostname only.
Explanation: Headless services allow direct networking to pods by returning the list of backing Pod IPs through DNS queries, bypassing single IP load-balancing.
Question 29 of 35
Which resource manages Layer 7 HTTP/HTTPS external access to Kubernetes services, supporting path-based routing?
A. Service NodePort
B. Ingress
C. LoadBalancer
D. CoreDNS
Explanation: Ingress defines Layer 7 routing rules to expose services. An Ingress Controller fulfills these rules (e.g. NGINX Ingress Controller).
Question 30 of 35
How do mounted Secret updates behave differently from Secrets exposed as environment variables?
A. Mounted Secrets updates sync automatically on disk; environment variable Secrets require a container restart to update.
B. Environment variable Secrets update instantly without system reloads.
C. Mounted Secrets require manual trigger reloads on API server.
D. Neither updates without delete operations.
Explanation: kubelet regularly syncs changes to mounted volumes. Environment variables are set during process generation and cannot update dynamically.
Question 31 of 35
What is the difference between a Liveness Probe and a Readiness Probe?
A. Liveness probe routes traffic; Readiness probe reboots the Pod.
B. Liveness probe restarts a failed container; Readiness probe determines if the container can accept service traffic.
C. Both monitor host nodes only.
D. Readiness probe runs before init containers start.
Explanation: Liveness probes keep containers running (restarts container on failure). Readiness probes govern when traffic routes to a pod endpoint.
Question 32 of 35
What is the effect of the "Retain" reclaim policy on a PersistentVolume (PV)?
A. The PV is deleted automatically when the PVC is removed.
B. The PV remains intact but becomes unavailable to other PVCs until manually scrubbed.
C. The storage drive is formatted instantly.
D. It copies PV data to a backup namespace.
Explanation: Under Retain policy, when a PVC is deleted, the PersistentVolume still exists, holding data, and requires administrative clean-up.
Question 33 of 35
How do you implement a default-deny ingress network policy for a namespace?
A. Create a NetworkPolicy with an empty ingress selector array (Ingress: []).
B. Set namespace isolation parameter to true.
C. Disable Service IP routing tables.
D. Delete all ingress controllers in the cluster.
Explanation: Defining a policy with podSelector {} and an empty ingress policy array isolates all pods in that namespace, denying all inbound traffic.
Question 34 of 35
How do Taints and Tolerations differ from Node Affinity?
A. Node affinity repels pods; taints attract them.
B. Node affinity attracts pods to nodes; Taints allow nodes to repel certain pods unless they tolerate the taint.
C. Taints schedule pods using geographic locations.
D. They are deprecated in Kubernetes v1.24+.
Explanation: Node affinity instructs scheduler where pods prefer or must go. Taints/tolerations ensure pods are not scheduled on inappropriate nodes.
Question 35 of 35
Which Quality of Service (QoS) class is assigned to a Pod when resource requests and limits are identical?
A. Guaranteed
B. Burstable
C. BestEffort
D. Dedicated
Explanation: If every container in a pod has requests and limits matching for CPU and Memory, it is classified as Guaranteed QoS.

Real-Time Interview Questions & Answers

1. What is a Pod, and how does it relate to containers?

Answer: A Pod is the smallest deployable unit in Kubernetes. It represents a single instance of a running process and can contain one or more containers that share network namespaces, storage volumes, and IP addresses.

Example: “In our frontend pod, we deploy our main React container and a sidecar container that syncs assets from an S3 bucket.”

2. How do you troubleshoot a Pod stuck in `CrashLoopBackOff` status?

Answer: I run `kubectl logs ` to view application errors, and `kubectl describe pod ` to check events, configuration issues, resource limits, or failing health probes.

Example: “I debugged a CrashLoopBackOff error and found the app was crashing due to a typo in a database hostname ConfigMap.”

3. What is the difference between ClusterIP, NodePort, and LoadBalancer Service types?

Answer: `ClusterIP` exposes the service internally within the cluster. `NodePort` exposes the service on a static port on each Node IP. `LoadBalancer` creates an external cloud load balancer pointing to cluster nodes.

Example: “We configure a ClusterIP service for our internal payment API and a LoadBalancer service for our public-facing web gateway.”

4. What is Kubernetes Ingress, and why do we use it over LoadBalancer Services?

Answer: Ingress manages external HTTP/HTTPS access to services, offering URL routing, SSL termination, and name-based hosting. This avoids spinning up expensive LoadBalancers for every single service.

Example: “We deploy a single NGINX Ingress Controller to route traffic to `app.com/api` and `app.com/web` using path-based rules.”

5. What is the difference between ConfigMaps and Secrets, and how do you secure Secrets?

Answer: ConfigMaps store non-sensitive configuration data in plain text. Secrets store sensitive data (passwords, keys) encoded in Base64. Secrets should be encrypted at rest and accessed via RBAC controls.

Example: “We mount our DB credentials as environment variables from Kubernetes Secrets, keeping our configuration repo clean and secure.”

6. How do you update a Deployment in production without causing downtime?

Answer: Kubernetes Deployments use a rolling update strategy by default. It replaces old pods with new ones gradually, ensuring a minimum number of pods remain available throughout the update.

Example: “I run `kubectl set image deployment/web-app web=app:v2.0` to trigger a rolling update, maintaining 100% application uptime.”

7. What are Liveness, Readiness, and Startup Probes in Kubernetes?

Answer: Liveness probes check if a container needs to be restarted. Readiness probes determine if a container is ready to accept network traffic. Startup probes check if the application has completed its startup phase.

Example: “We configure a readiness probe on `/healthz` to prevent users from hitting our API containers before they load cache files.”

8. How do you scale a Deployment in Kubernetes?

Answer: I scale deployments manually using `kubectl scale` or automatically by configuring a Horizontal Pod Autoscaler (HPA) that monitors resource usage (CPU/Memory) or custom metrics.

Example: “I set up an HPA to scale our web api deployment between 2 and 10 replicas when average CPU usage exceeds 75%.”

9. What are Namespaces, and why should we use them?

Answer: Namespaces provide virtual isolation inside a single physical Kubernetes cluster. They help organize resources and allow setting resource quotas and network access control lists per environment.

Example: “We split our cluster into `dev`, `staging`, and `production` namespaces to prevent test runs from affecting production services.”

10. How do you debug a Pod stuck in `Pending` state?

Answer: I run `kubectl describe pod ` and look at the events at the bottom. A pending state usually indicates insufficient cluster resources, missing PV mounts, or node selector mismatches.

Example: “I resolved a pending pod issue by scaling our node pool, as the existing worker nodes had run out of allocatable CPU capacity.”

11. What is the function of the Kubelet on a worker node?

Answer: The Kubelet is an agent running on each worker node that communicates with the API server. It receives PodSpecs and ensures that the specified containers are running, healthy, and report status back.

Example: “When a node went offline, I checked `systemctl status kubelet` on the VM to verify if the agent process had crashed.”

12. What is a DaemonSet, and when would you use it?

Answer: A DaemonSet ensures that a copy of a specific Pod runs on all (or selected) nodes in the cluster. As nodes are added, pods are started on them.

Example: “We run Fluentbit as a DaemonSet to collect and forward system logs from every worker node to our centralized Elasticsearch index.”

13. What is the difference between CPU Requests and Limits in a PodSpec?

Answer: Requests define the minimum CPU guaranteed to a container for scheduling. Limits set the maximum CPU resources the container is allowed to consume before being throttled.

Example: “We set a CPU request of 250m and limit of 500m to ensure our backend pods perform well under peak load without starving others.”

14. What does OOMKilled mean, and how do you investigate it?

Answer: OOMKilled (Exit Code 137) means a container was terminated by the Linux kernel Out-Of-Memory killer because it exceeded its configured memory limit.

Example: “If `kubectl describe pod` shows OOMKilled, I check Grafana metrics to see if the app has memory leaks and adjust our container limits.”

15. How do you safely remove a node from the cluster for maintenance?

Answer: I run `kubectl cordon` to stop new pods from scheduling on it, and then run `kubectl drain` to evict and reschedule running pods to other healthy nodes.

Example: “I run `kubectl drain node-02 --ignore-daemonsets --delete-emptydir-data` to safely upgrade node kernel versions without service disruption.”
Live Sandbox

Don't Just Read. Code Live!

Practice what you just learned in our secure, zero-setup interactive labs. Boot up Linux containers, orchestrate AWS infrastructure, and run Docker right in your browser.

100% Free & Interactive for Growth School Community No Setup Required Real-time Terminal Feedback
Start Live Sandbox
ubuntu@growthschool:~

docker run -d -p 80:80 nginx

Unable to find image 'nginx:latest' locally...

latest: Pulling from library/nginx

Digest: sha256:4c087b3289aa6b185...

Status: Downloaded newer image for nginx:latest

Container running at http://localhost:80

_