Kubernetes: Core Concepts

Deployments keep interchangeable Pods running, Services give them a stable address, Ingress routes outside traffic in, ConfigMaps and Secrets feed them configuration, and no Pod is ever precious.

A container-aware JVM sizes itself from cgroup limits, not the host; set the heap as a percentage of the limit, make request equal limit, and exit on OOM so Kubernetes restarts the pod cleanly.

Liveness failing means restart me, I am stuck; readiness failing means pause traffic to me, I am busy or not ready yet: never restart on a condition that is merely temporary.

A reactive chain is a lazy recipe that runs only when subscribed; StepVerifier subscribes and its terminal verify triggers execution and blocks until done, so forgetting to subscribe means the test passes having tested nothing.

OOMKilled is the cgroup limit cap on TOTAL memory (heap plus off-heap plus native), not just the heap your dashboard shows, so size limits to real peak and make the JVM container-aware.

Guaranteed Pods survive longest and BestEffort die first under memory pressure, and emptyDir is scratch space tied to the Pod, so it vanishes on restart or reschedule.

Give a container only the permissions it needs via securityContext, enforce it cluster-wide with the restricted Pod Security profile, and never run as root because root plus one exploit means node takeover.

Readiness controls traffic (remove from Service), liveness controls life (restart the container), and startup buys boot time for slow apps.

The control plane decides and records desired state, the worker nodes run workloads, and the scheduler places a pod by filtering then scoring nodes.

ConfigMap holds open settings, Secret holds sensitive values, and neither reliably takes effect without a Pod restart or a reloader because env vars are read once and file caches are stale.

Services give Pods a stable virtual IP, CoreDNS maps Service names to that IP, kube-proxy load-balances to Pod endpoints, and Ingress routes external HTTP to Services.

137 is SIGKILL (128 plus 9) and only says force-killed; read describe and events to tell OOMKill from a liveness-probe kill from a grace-timeout kill, then fix memory, probe, or shutdown respectively.

Running means the container is alive, not reachable; trace readiness, Service selector and endpoints, Ingress rules, NetworkPolicy, and load balancer health checks until you find the gap.

Pod is the unit, ReplicaSet keeps N copies, Deployment adds rolling updates for stateless apps, StatefulSet gives stable identity and storage for stateful apps, DaemonSet runs one per node, and Job runs a finite task to completion.

HPA scales replicas out, VPA scales each Pod up, Cluster Autoscaler scales nodes, KEDA scales on events to zero, and HPA plus VPA on the same CPU metric conflict.

Watch host resources on EC2, pod and node health on Kubernetes, heap and GC and latency on the JVM, and reach HA by combining multi-AZ redundancy with health-check failover and alerting on user-facing golden signals.