Kubernetes Basics Without the YAML Trauma
Kubernetes orchestrates containers across nodes—self-healing, scaling, rolling updates. It is also operational overhead. Learn the primitives before Helm charts become copy-paste mysteries.
Core Objects
- Pod: One or more containers sharing network/storage
- Deployment: Manages replica count and rolling updates
- Service: Stable DNS/load balancer to pods
- Ingress: HTTP routing and TLS termination
- ConfigMap/Secret: Configuration and sensitive data
# Minimal deployment
apiVersion: apps/v1
kind: Deployment
metadata:
name: api
spec:
replicas: 3
selector:
matchLabels:
app: api
template:
metadata:
labels:
app: api
spec:
containers:
- name: api
image: myregistry/api:1.2.0
ports:
- containerPort: 8080
resources:
requests:
memory: "256Mi"
cpu: "250m"
limits:
memory: "512Mi"
cpu: "500m"When You Actually Need K8s
Multiple services scaling independently, zero-downtime deploys across zones, or team already running EKS/GKE. Skip K8s for single VPS Laravel apps—a well-configured docker-compose on EC2 beats premature orchestration.
Start with managed clusters (EKS, GKE, DOKS). Self-managed control planes are a career, not a weekend project.
Learning Path That Works
Install minikube or kind locally. Deploy a sample app, break it, fix it. Learn kubectl describe and logs before Helm—understanding raw YAML prevents copy-paste disasters when charts need customization.
Resource requests and limits are not optional. Unbounded pods get OOMKilled under node pressure without warning. Start conservative, watch actual usage in metrics-server, tune over two sprints.
Ingress controllers (nginx, traefik) and cert-manager for Let's Encrypt solve 80% of external exposure needs. Do not expose NodePort services directly to the internet in production—please.
Network policies default-deny between namespaces in production clusters once basics work—many breaches lateral-move because every pod talks to every pod on flat network. Start permissive in dev, tighten staging, enforce production before SOC2 auditor asks.
Managed vs Self-Hosted
EKS control plane cost is fixed monthly regardless of cluster size—small clusters often cheaper on DigitalOcean or Linode managed K8s until scale justifies AWS integration depth. Evaluate honestly: three microservices do not require Kubernetes; docker-compose on two VMs may suffice two more years.
Upgrade cluster version on schedule—supported versions window is roughly 14 months; falling behind blocks security patches and new node types. Plan upgrade game days in staging with chaos tests validating pod disruption budgets work.
Learn raw manifests before Helm—template output hides debugging details until you understand Deployments and Services. Namespace isolation prevents accidental cross-team outages from release name collisions in shared early clusters.
Storage and Stateful Workloads
StatefulSets and persistent volumes add complexity—default to stateless deployments until data locality is required. Backup PVC snapshots before cluster upgrades. MySQL inside Kubernetes is possible but managed RDS often reduces operational load for small teams learning orchestration simultaneously with shipping product features.
Set PodDisruptionBudgets before first production deploy—cluster upgrades evict pods without warning otherwise. minAvailable: 1 on two-replica deployments prevents total outage during node drains. Learn this after first painful upgrade, or before—your choice.
Install metrics-server before HPA autoscaling—without metrics, HorizontalPodAutoscaler waits forever while traffic overwhelms fixed replica count during launch day traffic spike marketing promised would be modest.
Practice kubectl drain and cordon on staging quarterly so production node maintenance feels routine. Bookmarking a cheat sheet helps, but muscle memory from rehearsal prevents panic when mandatory cloud upgrades land in your inbox on a Friday.
Label every manifest with app, environment, and owner tags—searching blind in a shared cluster without labels wastes hours during incidents.
Essential kubectl Commands
Day-one debugging: kubectl get pods -A, kubectl logs -f deployment/api, kubectl rollout status deployment/api, and kubectl describe pod on CrashLoopBackOff. Keep kubeconfig per environment—mixing prod and staging contexts causes accidental production deletes.
Practice node drain and cordon on staging quarterly so production maintenance during cloud provider upgrades feels routine instead of panic.
Frequently Asked Questions
How is Kubernetes different from Docker Compose?
Compose runs on one host for dev/simple prod. Kubernetes schedules across many nodes with health checks, autoscaling, and service discovery.
What is a namespace?
Logical isolation within a cluster—use dev/staging/prod namespaces or separate clusters for stronger isolation.
How do I debug crashing pods?
kubectl logs pod/name --previous, kubectl describe pod/name for events, and check liveness probe misconfiguration first.