Kubernetes

Kubernetes is built around a single REST API. Every object has apiVersion, kind, metadata (name, namespace, labels, annotations, a resourceVersion used for optimistic concurrency), a spec written by the user and a status written by controllers. The kube-apiserver is the only component that talks to etcd; every other component - scheduler, kube-controller-manager, cloud-controller-manager, kubelet on each node - is a client that uses list-and-watch streams (wrapped in "informers" with local caches) to react to changes. A request passes through authentication (client certificates, bearer tokens, OIDC), authorization (usually RBAC plus the Node authorizer), mutating admission, schema validation and validating admission before it is persisted. Admission is where most policy lives: Pod Security Admission, ValidatingAdmissionPolicy written in CEL, and webhooks such as Kyverno or OPA Gatekeeper.

Scheduling happens in two phases: filtering removes nodes that cannot host the pod (insufficient requested CPU or memory, taints, node affinity, volume topology), and scoring ranks the rest before the scheduler writes a binding. The kubelet then asks the container runtime over CRI to create the pod sandbox and containers, while CNI plugins (Calico, Cilium and others) give each pod a routable IP in a flat network. Services provide stable virtual IPs implemented by kube-proxy with iptables, IPVS or nftables rules, or by eBPF in some CNIs; Ingress and the newer Gateway API handle L7 routing. Custom Resource Definitions let anyone add new kinds, and the operator pattern pairs a CRD with a controller that encodes operational knowledge, for example for databases.

The project ships three minor releases a year, and each minor version receives patches for roughly 14 months, so clusters left unupgraded fall out of support quickly; managed offerings (EKS, AKS, GKE) impose their own support windows. Notable breaking changes include the removal of dockershim in 1.24 and of PodSecurityPolicy in 1.25, replaced by Pod Security Admission with the privileged, baseline and restricted profiles.

Default settings are permissive in ways that surprise newcomers. Secrets are stored base64-encoded, not encrypted, unless an EncryptionConfiguration (ideally with a KMS provider) is set on the API server; any identity allowed to create pods in a namespace can read every Secret there by mounting it; service-account tokens are mounted into pods unless automountServiceAccountToken is disabled; all pods can reach all pods until a NetworkPolicy selects them; and audit logging is off until an audit policy is supplied. The CIS Kubernetes Benchmark, NSA/CISA Kubernetes Hardening Guidance and NIST SP 800-190 are the usual audit baselines. Kubernetes implements container orchestration but deliberately leaves build, image supply chain, CI and application-level concerns to other tools.