Kubernetes in practice, from a fresh MicroK8s node to a secured, observable, reproducible setup.
Why the scheduler compares requests with allocatable instead of free memory, Pods Pending on Insufficient memory, reserving memory for the system, and a node memory budget.
Installing MicroK8s from a pinned snap channel, what runs inside the snap, waiting for readiness, kubectl without sudo, and collecting a diagnostic report.
Exporting the kubeconfig, contexts and merged KUBECONFIG files, and why the MicroK8s admin certificate (system:masters, ten years, not revocable) must not be shared.
Where MicroK8s keeps component flags, and how to make its containerd trust a registry with a private CA through certs.d/<host:port>/hosts.toml.
Enabling add-ons, how CoreDNS picks its upstream resolvers, and where hostpath volumes really live, including unenforced capacity and Delete reclaim.
The five objects behind almost every deployment, how controllers and label selectors tie them together, and which ones you write versus only observe.
How requests drive scheduling and limits are enforced by the kernel, OOMKilled vs CPU throttling, and how QoS classes decide eviction order.
How the JVM, Node.js, .NET and Go size their heap under a container limit, what lives outside the heap, and a sizing rule that avoids OOMKilled.
What each probe triggers, how timing fields combine, and the rules that keep probes from turning a slow dependency into an outage.
maxSurge and maxUnavailable with their rounding rules, what a broken rollout looks like, and when Recreate is the right choice.
Run-to-completion workloads: Never vs OnFailure, backoffLimit, deadlines, ttlSecondsAfterFinished, why re-applying a Job fails, and CronJobs.
get, describe, apply, delete, output formats, namespace flags and --dry-run for generating YAML, with the pitfalls that matter in daily work.
Registry credentials with dockerconfigjson Secrets, attaching them per Pod or ServiceAccount, and choosing an imagePullPolicy that is honest about what runs.
envFrom and valueFrom, precedence and key names, missing keys and CreateContainerConfigError, why changes do not reach running Pods, and service link variables.
What a Secret actually is, how kubectl builds one from an env file (and what it rejects), why base64 is not encryption, and who can really read it.
Why a rotated Secret reaches mounted files after about a minute but never reaches environment variables or subPath mounts, and why files leak less than env vars.
Mounting several Secrets into one directory with a projected volume, the silent last-source-wins key collision that comes with it, and how items/path keeps tenants apart.
How Services give Pods a stable address, the NodePort range and reaching it from outside the cluster, and when to use an Ingress instead.
Host and path routing with Ingress, what the MicroK8s ingress add-on installs now (Traefik), ingress-nginx end of life, and HTTPRoutes with the Gateway API.
Issuer vs ClusterIssuer, bootstrapping a private root CA inside the cluster, issuing Ingress certificates from it, and making clients trust it.
ACME issuers, the requirements of each challenge, wildcards and private clusters, debugging pending challenges, and shorter certificate lifetimes.
Service names inside and across namespaces, the search list and ndots, debugging resolution, and why egress policies can break DNS.
emptyDir, configMap, secret and projected volumes, and the mount mistakes that hide image files, freeze subPath content or fail with StartError.
Binding modes, the normal and the broken Pending, access modes, reclaim policies, and verifying that data survives Pod and node restarts.
What node-level backups, Velero and CSI snapshots can back up on a single node (Velero cannot read hostPath volumes), and timing a restore drill.
Why non-root containers get Permission denied on new volumes, how fsGroup works, when it does nothing (hostPath), and fsGroupChangePolicy.
Streaming a dump off the cluster with kubectl exec, restoring it, and a backup CronJob that really fails when the dump fails (the sh -e pipe trap).
Layering plain YAML with bases, overlays and optional components, labels vs commonLabels, and previewing with kubectl kustomize and kubectl diff.
Shared services and applications in separate namespaces, what crosses namespace boundaries, and an apply order that works on an empty cluster.
configMapGenerator and secretGenerator from literals, env files and files, merge and replace across layers, and how the hash suffix triggers rollouts.
The images transformer for registry and tag changes, and structuring one image as web, worker and migration roles.
Both patch formats, how lists with and without merge keys behave, targets by kind, name and labels, and the failure modes of each.
Restarting and force-deleting Pods safely, scaling to zero, and diagnosing a namespace stuck in Terminating by its finalizers.
Following a rollout in scripts, what rollout restart really does, revision history and change causes, and what rollout undo does and does not roll back.
A least-privilege identity for CI, a single-context kubeconfig, render, diff, apply and rollout status, and push vs pull (GitOps) deployments.
A bootstrap script that can be re-run safely: idempotent vs non-idempotent commands, the dry-run and apply pattern, explicit waits, and rebuild tests.
Phases, conditions and container states behind the STATUS column, where each status comes from, and what to check first for each.
The exact messages for a missing tag, denied credentials, an untrusted CA, an unresolvable host and a wrong architecture, and the fix for each.
Event types and fields, reading them in the right order (the sort-by pitfall), five-minute retention on MicroK8s, and exporting events.
A repeatable procedure: exit codes and reasons, logs of the previous attempt, events, and keeping a crashing container alive to inspect it.
Enabling metrics-server, what kubectl top numbers mean, comparing usage with requests and limits, and sizing from Prometheus history.
Running commands inside containers, ephemeral debug containers for images without a shell, and port-forward tunnels with their limits.
What the MicroK8s observability add-on installs (and its defaults), how ServiceMonitors are selected, and the release label that silently hides targets.
The shipped alert rules, writing rules for restarts, memory and disk, and routing alerts out of the default null receiver.
How container logs are collected, what the add-on ships (Loki 2.6 and end-of-life Promtail), migrating to Alloy, labels and LogQL.
runAsNonRoot, allowPrivilegeEscalation, dropping capabilities, seccomp and a read-only root filesystem, how to verify them, and what breaks.
The privileged, baseline and restricted levels, enforce, warn and audit modes, Deployments accepted while their Pods are rejected, and a safe rollout.
MicroK8s runs with AlwaysAllow until RBAC is enabled; Roles, bindings, testing with auth can-i, dangerous permissions, and replacing cluster-admin grants.
What the auto-mounted token is, when to disable it with automountServiceAccountToken, dedicated ServiceAccounts, and audience-bound tokens.
Default deny for ingress and egress, cross-namespace rules, AND vs OR selectors, and allowing DNS so egress policies do not break name resolution.