# Glossary — Kubernetes

The canonical vocabulary for this course. Opinionated and repo-flavoured. Once a term is
defined here, every lesson uses it this way. Terms marked *(Part N)* are taught in that part.

---

### Kubernetes (K8s)
An open-source system for automating deployment, scaling, and management of containerised
applications. You declare **desired state**; Kubernetes continuously **reconciles** actual
state toward it. *Repo: the kind cluster from Course 1; prod runs on GKE (Course 7).*

### Declarative / desired state
You describe *what* you want (5 replicas of this image), not *how* to get there. The object's
**spec** is desired; its **status** is observed. Controllers close the gap.

### Control loop / reconciliation
The core pattern: a controller observes actual state, compares to spec, and acts to converge
them — forever. "Kubernetes is control loops all the way down." *(Lesson 1)*

### Object / resource
A persisted entity in the cluster (Pod, Deployment, Service, …) with `apiVersion`, `kind`,
`metadata`, `spec`, `status`. Created by `kubectl apply` — or, here, by Skaffold/Helm.

### Control plane *(Lesson 2)*
The cluster's brain: **kube-apiserver** (the API front door), **etcd** (key-value store of all
state), **kube-scheduler** (assigns Pods to Nodes), **kube-controller-manager** (runs the
controllers).

### Node *(Lesson 2)*
A worker machine. Runs **kubelet** (the agent that starts/monitors Pods and reports status) and
**kube-proxy** (programs Service networking). The container runtime (containerd) runs here too.

### Pod *(Lesson 3)*
The smallest deployable unit — one or more containers that **share a network namespace (one IP)
and storage**, always scheduled together. Ephemeral: it can die and be replaced. *Repo: one Pod
runs the `build/server` container for a service.*

### ReplicaSet *(Lesson 4)*
A controller that keeps a specified **number of identical Pod replicas** running. You rarely
create one directly — a Deployment manages it.

### Deployment *(Lesson 4)*
The usual way to run a stateless workload: declarative updates over ReplicaSets, with
**rolling updates**, rollbacks, and scaling. *Repo: most backend services are Deployments.*

### Rolling update *(Lesson 4)*
Zero-downtime update: a new ReplicaSet is scaled up while the old is scaled down, replacing
Pods gradually (bounded by `maxSurge`/`maxUnavailable`).

### Service *(Lesson 5)*
A stable network endpoint (name + virtual IP) fronting a changing set of Pods, selected by
label. Types: **ClusterIP** (in-cluster, default), **NodePort**, **LoadBalancer**, and
**headless** (no VIP; DNS returns Pod IPs — used with StatefulSets).

### Cluster DNS *(Lesson 5)*
In-cluster DNS lets Pods reach a Service by name: `svc.namespace.svc.cluster.local`. The K8s
analogue of Course 1's Docker-network service-name resolution.

### ConfigMap *(Lesson 6)*
Non-secret config as key-values, injected as env vars or mounted files. Config out of the image.

### Secret *(Lesson 6)*
Like a ConfigMap but for sensitive data (base64, not encrypted at rest by default). *Repo:
secrets are SOPS-encrypted in git and decrypted at deploy (Course 3 / secrets).*

### StatefulSet *(Lesson 7)*
For workloads needing **stable network identity + ordered, persistent** Pods (`pod-0`,
`pod-1`, …), each with its own PersistentVolume. *Repo: `tom` and **`conversationmgmt`** (the
learner's service) are StatefulSets; most others are Deployments.*

### Probe *(Lesson 8)*
A health check the kubelet runs on a container. **liveness** ("is it stuck?" → restart),
**readiness** ("should it get traffic?" → gate Service endpoints), **startup** ("has it
finished booting?" → hold off the other two). *Repo: `grpc_health_probe` (baked into the image,
Course 1 L2).*

### Requests & limits *(Lesson 8)*
**request** = guaranteed resource reserved for scheduling; **limit** = hard ceiling (CPU
throttled, memory over-limit → OOMKilled). Drive scheduling and QoS.

### HorizontalPodAutoscaler (HPA) *(Lesson 9)*
Scales replica count up/down to hit a metric target (e.g. CPU %). A control loop, ~15s period.

### VerticalPodAutoscaler (VPA) *(Lesson 9)*
Adjusts a Pod's requests/limits (its *size*) rather than the count.

### KEDA / ScaledObject *(Lesson 9)*
Kubernetes Event-Driven Autoscaling: scales on **external event sources** (Kafka lag,
Prometheus metric, queue depth) and can **scale to zero**. A `ScaledObject` CRD wraps a target
workload and generates an HPA for the 1→N range. *Repo: the primary autoscaler.*

### Label & selector *(Lesson 10)*
Key-value tags on objects (`app: bob`), and the queries that match them. The glue: Services,
ReplicaSets, and Deployments all find their Pods by selector.

### Node affinity / taints & tolerations *(Lesson 10)*
**Affinity** attracts Pods to nodes with certain labels; **taints** repel Pods unless they
carry a matching **toleration**. How you steer *where* Pods land.

### PodDisruptionBudget (PDB) *(Lesson 11)*
Caps how many Pods of an app may be **voluntarily** down at once (`minAvailable` /
`maxUnavailable`) — protects availability during node drains/upgrades.

### Graceful termination *(Lesson 11)*
On delete, a Pod gets SIGTERM + a grace period (and `preStop` hook) before SIGKILL — time to
finish in-flight work.

### Namespace *(Lesson 12)*
A virtual cluster partition for names, quotas, and access. *Repo: `{ENV}-{ORG}-backend`, e.g.
`local-manabie-backend` (Course 1 L5).* (Distinct from a *Linux* namespace — Course 1 L1.)

### RBAC / Role / RoleBinding *(Lesson 12)*
Role-Based Access Control: a **Role** (or ClusterRole) lists allowed verbs on resources; a
**RoleBinding** grants it to a user/group/ServiceAccount.

### ServiceAccount *(Lesson 12)*
An identity for Pods (not humans). *Repo: annotated for GCP **Workload Identity** so Pods
authenticate to Google APIs without long-lived keys (Course 7).*

### kubectl
The CLI that talks to the api-server. `get` / `describe` / `apply` / `logs` / `rollout` /
`exec`. *Repo: `sk.bash` uses `kubectl rollout restart` after a deploy (Course 1 L8).*