Reference · Glossary

Glossary

Every term this course leans on without stopping to define it mid-lesson, gathered into one alphabetical, searchable page — core Kubernetes objects, control-plane components, the sixteen tool guides, and the vocabulary of the CKA, CKAD, CKS, KCNA, and KCSA certification domains.

☺ Explain it like I'm 10

If a lesson uses a word you don't recognize — reconciliation, admission controller, sidecar — it's defined here in one or two sentences, not buried three paragraphs into a page you've already left. Search the box below or scan the list; nothing here assumes you already know the acronym.

Admission controllerA piece of code that intercepts a request to the Kubernetes API server after authentication and authorization but before the object is persisted to etcd, and can mutate or reject it. Pod Security Admission and most policy engines (Gatekeeper, Kyverno) run as admission controllers.

Affinity and anti-affinityScheduling rules that attract (affinity) or repel (anti-affinity) a Pod relative to labels on nodes or on other Pods — for example, spreading replicas of the same Deployment across nodes so one node failure can't take all of them down. Expressed as requiredDuringScheduling (hard) or preferredDuringScheduling (soft).

API server (kube-apiserver)The single control-plane component every other piece of Kubernetes — kubectl, controllers, the scheduler, kubelets — talks to. It's the only component that reads from and writes to etcd directly, and it authenticates, authorizes, and admits every request before it's persisted.

AppArmorA Linux kernel security module that confines a process to a named profile of allowed file, network, and capability operations. Kubernetes can attach an AppArmor profile to a container as one layer of the CKS System Hardening domain, alongside seccomp.

Audit loggingA structured, chronological record the API server can write of every request made against it — who did what, to which resource, when, and whether it was allowed. Reviewing audit logs for anomalous activity is part of the CKS Monitoring, Logging and Runtime Security domain.

Base imageThe starting container image a Dockerfile builds on top of with a FROM line. Minimizing its footprint — fewer packages, a smaller attack surface, ideally a distroless or scratch image — is a named CKS Supply Chain Security competency.

Behavioral analyticsDetecting an attack by its runtime behavior — an unexpected process spawning inside a container, a shell opened where none should exist — rather than by a known signature. A CKS Monitoring, Logging and Runtime Security competency, commonly implemented with a tool like Falco.

Blue/green deploymentA deployment strategy that runs two complete environments side by side and cuts traffic over from the old ("blue") to the new ("green") version at once. In Kubernetes it's usually built from primitives — two Deployments and a Service selector flip — rather than a dedicated built-in object, which is why CKAD's Application Deployment domain tests it as a pattern, not an API.

Bootstrap tokenA short-lived, single-purpose credential kubeadm generates so a new node can authenticate to the API server just long enough to complete kubeadm join, without needing a full kubeconfig up front.

CalicoA CNI plugin providing Pod networking and, distinctively, NetworkPolicy enforcement (including its own extended GlobalNetworkPolicy CRDs) at L3/L4, with both an iptables and an eBPF dataplane. See the Calico tool guide.

Canary releaseA deployment strategy that routes a small slice of production traffic to a new version while the rest keeps serving the old one, so a regression is caught while it can only harm a fraction of users. Like blue/green, Kubernetes has no dedicated canary object — it's built from two Deployments, matching labels, and a Service that load-balances across both.

cert-managerA cluster add-on that automates issuing, renewing, and attaching TLS certificates to Kubernetes resources — most commonly Ingress objects — by talking to an issuer such as Let's Encrypt via ACME or an internal CA. See the cert-manager tool guide.

CgroupA Linux kernel feature (control group) that limits and accounts for a process's use of CPU, memory, and other resources. Container runtimes implement Pod resource requests and limits by writing them into cgroups.

CiliumA CNI plugin built on eBPF, giving Pod networking, identity-aware NetworkPolicy (including L7 rules), observability, and optional service-mesh functionality without a sidecar proxy per Pod. See the Cilium tool guide.

CIS BenchmarkA published, consensus set of hardening recommendations from the Center for Internet Security. The Kubernetes CIS Benchmark covers control-plane and node configuration; reviewing a cluster against it — typically with kube-bench — is a named CKS Cluster Setup competency.

CKA (Certified Kubernetes Administrator)A performance-based, two-hour exam on live clusters, graded on end state. Its curriculum (v1.35) sums to five domains: Cluster Architecture, Installation and Configuration 25%; Workloads and Scheduling 15%; Services and Networking 20%; Storage 10%; Troubleshooting 30% — 27 published competencies in all. See the course's Certifications overview.

CKAD (Certified Kubernetes Application Developer)A performance-based, two-hour exam with no prerequisite, curriculum (v1.35) weighted: Application Design and Build 20%; Application Deployment 20%; Application Observability and Maintenance 15%; Application Environment, Configuration and Security 25%; Services and Networking 20% — 24 published competencies. See the CKAD blueprint.

CKS (Certified Kubernetes Security Specialist)A performance-based, roughly two-hour exam that requires an active, non-expired CKA to sit. Curriculum (v1.34): Cluster Setup 15%; Cluster Hardening 15%; System Hardening 10%; Minimize Microservice Vulnerabilities 20%; Supply Chain Security 20%; Monitoring, Logging and Runtime Security 20%. See the CKS blueprint.

Cluster AutoscalerA control-plane-adjacent component that adds or removes worker nodes based on unschedulable Pods and node utilization, so the Horizontal Pod Autoscaler always has capacity to scale into. See the Cluster Autoscaler tool guide and compare with Karpenter.

ClusterRole / ClusterRoleBindingThe cluster-scoped counterparts of Role and RoleBinding: a ClusterRole's rules apply cluster-wide (or, via a RoleBinding, can be reused inside a single namespace), and a ClusterRoleBinding grants it to a subject across the whole cluster. See RBAC.

CNCF (Cloud Native Computing Foundation)The Linux Foundation project that hosts Kubernetes and most of its surrounding ecosystem, and runs the maturity ladder every hosted project climbs: Sandbox → Incubating → Graduated. KCNA's Cloud Native Architecture domain tests familiarity with this ladder directly.

CNI (Container Network Interface)The plugin interface Kubernetes uses to wire up Pod networking — assigning IPs, attaching interfaces, and (for CNI plugins that support it) enforcing NetworkPolicy. Calico and Cilium are both CNI plugins; the interface itself is the extension point named in the CKA Cluster Architecture domain.

ConfigMapAn API object that stores non-secret configuration data — key/value pairs, whole config files — separately from container images, so the same image can run with different configuration in different environments. Consumed as environment variables or a mounted volume.

ContainerA lightweight, portable process that packages an application with its dependencies and shares the host kernel, giving it consistent behavior from a laptop to a CI runner to a production node. The unit Kubernetes schedules is one layer up: the Pod.

Container registryA versioned store for container images — Docker Hub, a cloud provider's registry, or a self-hosted one — that a cluster pulls from. Restricting a cluster to permitted registries and requiring signed, validated images is a named CKS Supply Chain Security competency.

Container runtimeThe software that actually creates and runs a container from an image on a node — containerd or CRI-O, in nearly every modern cluster — invoked by the kubelet through the CRI.

containerdA CRI-compliant container runtime that Kubernetes talks to via the kubelet to pull images and run containers — the default runtime on most managed and self-hosted clusters today. See the containerd tool guide.

Control planeThe set of components that make cluster-wide decisions and hold cluster state — the API server, etcd, the scheduler, and the controller manager — as distinct from the worker nodes that actually run workloads.

ControllerA control loop that watches the actual state of one or more resource types via the API server and drives it toward the declared desired state. The Deployment, ReplicaSet, and Job controllers, plus any custom Operator, all follow this same reconciliation pattern.

CoreDNSThe default cluster DNS add-on, giving every Service and (optionally) every Pod a resolvable in-cluster DNS name, so workloads discover each other by name instead of tracking IPs. Named explicitly in the CKA Services and Networking domain.

CosignA Sigstore tool for signing and verifying container images and other OCI artifacts, letting a cluster's admission policy reject any image that isn't signed by a trusted key. The reference tool for the CKS "sign and validate artifacts" competency.

CRD (Custom Resource Definition)An API object that registers a brand-new resource type with the API server — kind: Certificate, kind: HelmRelease — so it can be created, listed, and watched exactly like a built-in object such as Pod or Service. The extension mechanism an Operator is built around.

CRI (Container Runtime Interface)The plugin interface the kubelet uses to talk to whatever container runtime is installed on a node, decoupling Kubernetes itself from any one runtime implementation. Named alongside CNI and CSI in the CKA Cluster Architecture domain's "extension interfaces" competency.

CronJobAn API object that creates a Job on a repeating schedule expressed in cron syntax, for tasks that need to run periodically — a nightly backup, an hourly report — rather than continuously or exactly once.

CSI (Container Storage Interface)The plugin interface storage vendors implement so their volume systems work with Kubernetes without code changes to Kubernetes itself — the extension point behind most StorageClasses in a real cluster.

DaemonSetAn API object that ensures exactly one copy of a Pod runs on every node (or every node matching a selector) — the pattern used for node-level agents like a log collector, a CNI plugin, or a monitoring exporter.

Declarative configurationDescribing the end state you want ("three replicas of this image should exist") and letting a controller figure out how to get there, as opposed to imperative commands that specify each step. kubectl apply and every YAML manifest in this course are declarative.

DeploymentThe API object almost every stateless workload is described with: it manages a ReplicaSet on your behalf and adds rolling updates, rollbacks, and declarative scaling on top of it. You describe the desired Pod template and replica count; the Deployment controller reconciles reality to match.

Desired stateWhat you declared in a manifest, stored in etcd — as opposed to actual state, what's really running. Every Kubernetes controller exists to close the gap between the two; see reconciliation loop.

DNS (cluster DNS)See CoreDNS — the add-on that provides it.

Downward APIA mechanism for exposing a Pod's own metadata — its name, namespace, labels, resource requests — to the container running inside it, as environment variables or a mounted file, without the container needing to call the API server itself.

EndpointSliceThe scalable object that backs a Service, tracking the set of Pod IPs (and readiness) that currently match its selector. Superseded the older, single-object Endpoints resource for clusters with large numbers of backend Pods.

Ephemeral containerA container added to an already-running Pod temporarily, purely for interactive debugging — it shares the Pod's namespaces but isn't part of the Pod's normal spec and can't be restarted. The standard way to poke inside a distroless Pod that has no shell of its own.

etcdThe distributed, consistent key-value store that is the single source of truth for all cluster state — every object the API server persists lives here. Only the API server talks to etcd directly; everything else goes through it.

EvictionRemoving a running Pod from a node, either voluntarily (the eviction API, respecting a PodDisruptionBudget — used by kubectl drain) or involuntarily (the kubelet evicting Pods under node memory or disk pressure).

FalcoAn open-source runtime security tool that watches kernel and Kubernetes API events against a rule set and alerts on suspicious behavior — an unexpected shell in a container, a write to a sensitive path. See the sibling DevSecOps course's Falco tool guide.

FinalizerA key on an object's metadata that blocks its actual deletion from etcd until a controller has finished cleanup work and removed the finalizer itself — the mechanism behind a Namespace or PVC that appears "stuck" in Terminating.

Gateway APIA newer, role-oriented set of Kubernetes APIs (GatewayClass, Gateway, HTTPRoute) for modeling ingress and service-mesh traffic routing, designed as a more expressive, portable successor to the older Ingress object. Named explicitly in the CKA Services and Networking domain.

GitOpsAn operating model that treats a Git repository as the single source of truth for a cluster's declarative state, with an in-cluster agent (Argo CD, Flux) continuously reconciling the live cluster to match what's committed. Every change ships as a pull request rather than a direct kubectl apply.

Golden KubestronautThe Linux Foundation's top Kubernetes-ecosystem credential tier: it requires holding all five Kubestronaut certifications (KCNA, KCSA, CKA, CKAD, CKS) plus the other nine CNCF certifications and the LFCS. Not covered on this platform — see the sibling Golden Astronaut course.

gVisorA sandboxed container runtime that interposes a user-space kernel between a container and the host kernel, shrinking the syscall surface a compromised container can attack. Used via a Kubernetes RuntimeClass, and named directly in CKS's isolation-techniques competency.

HA control plane (high-availability control plane)Running multiple API server, etcd, and controller-manager instances (usually three or five for etcd, for quorum) behind a load balancer, so a single control-plane node failing doesn't take the cluster's brain down with it. A named CKA Cluster Architecture competency.

Headless ServiceA Service created with clusterIP: None, which skips load-balancing and instead returns the individual Pod IPs directly from DNS — the pattern StatefulSets use so each replica gets its own stable, resolvable identity.

HelmThe de facto package manager for Kubernetes: it templates a set of manifests into a versioned, installable, upgradable unit called a chart, and tracks each install as a release. Named explicitly in both the CKA and CKAD curricula. See the Helm tool guide.

Horizontal Pod Autoscaler (HPA)A controller that changes a workload's replica count up or down based on observed metrics — CPU and memory by default via metrics-server, or a custom/external metric. Contrast with the Vertical Pod Autoscaler, which resizes Pods instead of adding more of them.

HostPath volumeA volume type that mounts a path from the node's own filesystem directly into a Pod. Powerful for node-level agents, but a well-known privilege-escalation and node-tampering risk if allowed on untrusted workloads — Pod Security Standards' Baseline and Restricted levels forbid it.

Image pull policyA Pod field (Always, IfNotPresent, Never) controlling whether the kubelet re-pulls an image from the registry before starting a container, or trusts whatever's already cached on the node.

ImagePullSecretA Secret of type kubernetes.io/dockerconfigjson that gives the kubelet credentials to pull an image from a private registry, referenced by name from a Pod spec or a ServiceAccount.

IMDS protection (instance metadata service)Restricting Pod network access to a cloud provider's instance metadata endpoint (commonly 169.254.169.254), which otherwise can hand a compromised Pod the node's cloud credentials. A named CKS Cluster Setup competency: "protect node metadata and endpoints."

Immutable container / read-only root filesystemRunning a container with readOnlyRootFilesystem: true so nothing — including an attacker who gets code execution — can write to its filesystem at runtime, forcing any legitimate need for writable storage through an explicit, separately mounted volume. A CKS container-immutability-at-runtime competency.

IngressAn API object that describes HTTP(S) routing rules — host- and path-based — from outside the cluster to Services inside it, letting one external IP and Ingress controller front many Services instead of one LoadBalancer Service per app.

Ingress controllerThe component that actually implements Ingress objects — watching them and reconfiguring a real proxy (commonly NGINX). Ingress is inert without one running in the cluster. See the ingress-nginx tool guide.

Init containerA container that runs to completion before a Pod's main containers start, used to wait for a dependency or set up shared state on a volume. Multiple init containers run in order, one at a time; a failing one blocks the Pod from starting at all.

JobAn API object that runs a Pod (or several, in parallel) to completion exactly once, retrying on failure up to a configured limit, and considers itself done when the required number of Pods succeed — for a one-off task rather than a long-running service.

k9sA terminal UI for browsing and operating a cluster interactively — navigating resources, tailing logs, opening a shell — without typing a fresh kubectl command for every step. See the k9s tool guide.

KarpenterA node-autoscaling controller that provisions right-sized nodes directly from cloud APIs in response to unschedulable Pods, as an alternative to the group-based Cluster Autoscaler. See the Karpenter tool guide.

Kata ContainersA sandboxed container runtime that runs each container inside its own lightweight virtual machine, giving hardware-level isolation at some cost to startup time and density — the other named CKS isolation-technique option alongside gVisor.

KCNA (Kubernetes and Cloud Native Associate)A knowledge-based, multiple-choice, 90-minute exam with no prerequisites — the entry-level credential in the ladder. Curriculum: Kubernetes Fundamentals 44%; Container Orchestration 28%; Cloud Native Application Delivery 16%; Cloud Native Architecture 12%; 13 competencies. See the KCNA blueprint.

KCSA (Kubernetes and Cloud Native Security Associate)A knowledge-based, multiple-choice, 90-minute exam with no prerequisites, focused entirely on security. Curriculum: Kubernetes Cluster Component Security 22%; Kubernetes Security Fundamentals 22%; Kubernetes Threat Model 16%; Platform Security 16%; Overview of Cloud Native Security 14%; Compliance and Security Frameworks 10% — 42 competencies. See the KCSA blueprint.

kind (Kubernetes in Docker)A tool that runs a full multi-node Kubernetes cluster as a set of Docker containers on a single machine — fast to spin up and tear down, and the standard way to build a disposable lab for practicing CKA/CKAD/CKS tasks. See the kind tool guide.

kubeadmThe standard tool for bootstrapping a conformant Kubernetes cluster from scratch — initializing the control plane, generating certificates and tokens, and joining worker nodes — and for later upgrading it. See the kubeadm tool guide.

kube-benchA tool that runs the CIS Kubernetes Benchmark's automated checks against a live cluster and reports pass/fail per control — the standard way the CKS "CIS benchmark review" competency is actually exercised.

kubeconfigA YAML file holding one or more clusters, users (credentials), and contexts (a cluster/user/namespace combination), which kubectl reads to know which cluster to talk to and as whom. Switching contexts is how one kubectl install operates against many clusters.

kubectlThe command-line client for the Kubernetes API — the tool nearly every task in this course, and every CKA/CKAD/CKS exam task, is actually performed with. See the kubectl tool guide and the kubectl fluency baseline.

kubeletThe agent that runs on every node, registering it with the API server and making sure the containers described in its assigned Pods are actually running and healthy, via the CRI. The only control-plane-adjacent component that runs on worker nodes.

kube-proxyThe per-node component that implements Service networking — programming iptables, IPVS, or (increasingly) eBPF rules so traffic to a Service's virtual IP gets load-balanced to one of its backing Pods.

KubernetesAn open-source container orchestration platform that automates scheduling, scaling, networking, and self-healing for containerized workloads across a cluster of machines, declaratively. Originated at Google, donated to the CNCF in 2015. This course's sibling Platform Engineering course treats it as a substrate a platform is built on top of, not the platform itself.

KubestronautThe Linux Foundation's credential for holding all five Kubernetes-ecosystem certifications at once — KCNA, KCSA, CKA, CKAD, and CKS — the five this course is built around. The next rung up is Golden Kubestronaut.

KustomizeA template-free way to customize raw Kubernetes YAML for different environments — a base plus per-environment overlays and patches — built into kubectl itself via kubectl apply -k. See the Kustomize tool guide.

LabelA key/value pair attached to an object's metadata, used to identify and group related objects — app: checkout, tier: frontend — for selection by Services, Deployments, NetworkPolicies, and almost everything else.

Label selectorThe query — equality-based (tier=frontend) or set-based (tier in (frontend, backend)) — that a Service, Deployment, or NetworkPolicy uses to decide which labeled objects it applies to.

LimitRangeA namespace-scoped object that sets default, minimum, and maximum resource requests/limits for Pods and containers created without their own explicit values — a guardrail against a workload that forgot to set limits entirely.

Liveness probeA health check the kubelet runs against a container to decide whether it's still functioning. A container that fails its liveness probe is killed and restarted, on the assumption a restart is more likely to fix it than leaving it running.

ManifestA YAML (or JSON) file describing one or more Kubernetes objects' desired state, applied to the cluster with kubectl apply -f.

metrics-serverA cluster add-on that collects CPU and memory usage from every kubelet and exposes it through the Kubernetes Metrics API — what kubectl top reads from, and the default metric source for the Horizontal Pod Autoscaler. See the metrics-server tool guide.

minikubeA tool that runs a single-node (or small local multi-node) Kubernetes cluster inside a VM or container on a laptop — the classic on-ramp for learning Kubernetes locally, with built-in support for common add-ons. See the minikube tool guide.

MITRE ATT&CK for ContainersA published matrix of adversary tactics and techniques specific to container and Kubernetes environments — initial access, privilege escalation, lateral movement — used as a shared vocabulary for threat modeling. Named explicitly in the KCSA Compliance and Security Frameworks domain.

Multi-container Pod patternsNamed ways to combine more than one container in a single Pod: the sidecar (a helper alongside the main container, e.g. a log shipper), the ambassador (a local proxy to an external service), and the adapter (normalizes the main container's output). Named directly in the CKAD Application Design and Build domain.

Mutating admission webhookAn admission controller, implemented as an external HTTP service, that can modify an object before it's persisted — injecting a sidecar container, adding a default label. Runs before validating admission webhooks in the request pipeline.

NamespaceA way to partition a single cluster's objects into isolated-by-name groups — team-a, team-b — so names don't collide and RBAC, ResourceQuotas, and NetworkPolicies can be scoped per team or environment. Not a security boundary on its own without RBAC and NetworkPolicy layered on top.

NetworkPolicyAn object that restricts Pod-to-Pod (and Pod-to-outside) traffic by label selector, namespace, and port — Kubernetes' native network firewall. Enforced by the CNI plugin, not the API server itself, so it's a no-op on a CNI that doesn't implement it.

NISTThe U.S. National Institute of Standards and Technology, publisher of widely referenced security and compliance frameworks (e.g. NIST 800-190 for container security). Named as a compliance-framework example in the KCSA curriculum.

NodeA worker machine, virtual or physical, that runs Pods — each one running a kubelet, a container runtime, and kube-proxy, and reporting its status and capacity back to the control plane.

NodePortA Service type that opens a static port (30000–32767 by default) on every node's IP, forwarding traffic on that port to the Service's backing Pods — a simple way to expose a Service outside the cluster without a cloud load balancer.

Object (Kubernetes object)A persistent record in etcd, exposed through the API server, that represents something in the cluster's desired or observed state — a Pod, a Deployment, a Secret. Almost everything in Kubernetes is an object with a spec (desired state) and a status (observed state).

OCI (Open Container Initiative)The industry body defining the open container image and runtime specifications that containerd, CRI-O, and Docker all implement, so an image built by one tool runs correctly under any OCI-compliant runtime.

OPA / GatekeeperOpen Policy Agent is a general-purpose policy engine; Gatekeeper packages it as a Kubernetes admission controller and CRD-based policy library, letting an operator write custom admission rules ("every image must come from our registry") without hand-rolling a webhook.

OperatorThe pattern of packaging deep, application-specific operational knowledge into a controller that watches a CRD and manages a complex stateful application — provisioning, backup, failover — the way a human operator would, but continuously and automatically.

OwnerReferenceA field linking a dependent object to the object that created and manages it — a Pod's OwnerReference points at its ReplicaSet, which points at its Deployment — so deleting the owner (by default) cascades and deletes its dependents too.

PCI-DSSThe Payment Card Industry Data Security Standard, a compliance framework for any system that handles cardholder data. Named as a compliance-framework example in the KCSA curriculum alongside SOC 2 and ISO 27001.

Persistent Volume (PV)A cluster-scoped object representing a real piece of storage — a cloud disk, an NFS export — provisioned either ahead of time by an administrator or dynamically by a StorageClass, independent of any one Pod's lifecycle.

Persistent Volume Claim (PVC)A namespaced request for storage — "give me 10Gi, ReadWriteOnce" — that a Pod references instead of a PV directly. Kubernetes binds the claim to a matching (or dynamically provisioned) PV, decoupling application manifests from the specifics of the underlying storage.

PodThe smallest deployable unit in Kubernetes: one or more containers that share a network namespace (same IP, localhost between them) and can share storage volumes, always scheduled together onto the same node.

Pod Disruption Budget (PDB)An object that caps how many Pods of a given workload can be voluntarily disrupted at once — during a node drain or cluster upgrade — so an operator can't accidentally take an entire workload offline in the name of maintenance.

Pod Security Admission (PSA)The built-in admission controller that enforces Pod Security Standards at the namespace level via labels — pod-security.kubernetes.io/enforce: restricted — replacing the deprecated, cluster-wide PodSecurityPolicy.

Pod Security Standards (PSS)Three built-in policy levels — Privileged (unrestricted), Baseline (blocks known privilege escalations), and Restricted (heavily locked down, following hardening best practice) — that Pod Security Admission enforces per namespace.

PodTemplateThe spec.template block inside a Deployment, StatefulSet, DaemonSet, or Job that describes exactly what a Pod created by that controller should look like — every Pod it manages is stamped from this one template.

PreemptionThe scheduler evicting a lower-priority Pod to make room for a higher-priority one that can't otherwise be scheduled, based on each Pod's assigned PriorityClass.

ProbeA kubelet-run health check against a container — liveness (is it alive; restart if not), readiness (can it serve traffic; pull from Service if not), or startup (has it finished starting; delays the other two probes until it has).

QoS classThe Quality of Service tier — Guaranteed, Burstable, or BestEffort — Kubernetes derives automatically from a Pod's resource requests and limits, and uses to decide eviction order under node pressure: BestEffort goes first.

RBAC (Role-Based Access Control)Kubernetes' native authorization model: Roles (or ClusterRoles) define allowed verbs on resources, and RoleBindings (or ClusterRoleBindings) grant a Role to a subject — a user, group, or ServiceAccount. Least-exposure RBAC design is a named CKS Cluster Hardening competency.

Reconciliation loopThe repeating cycle at the heart of every Kubernetes controller: read desired state, read actual state, take action to close the gap, repeat. Neither side of the gap "wins" by force — the loop just keeps nudging actual state toward desired state forever.

ReplicaSetAn object that ensures a specified number of identical Pods are running at all times, replacing any that disappear. Rarely created directly — a Deployment manages a ReplicaSet on your behalf and adds rollout history and rollback on top.

Resource requests and limitsPer-container declarations of how much CPU and memory it needs (requests, used for scheduling) and the most it's allowed to use (limits, enforced by the kernel via cgroups). Requests without limits, or neither, changes both scheduling behavior and eviction risk.

ResourceQuotaA namespace-scoped object capping the total resources — CPU, memory, object counts — that namespace's workloads can consume in aggregate, distinct from a LimitRange's per-object defaults.

Role / RoleBindingA Role defines a set of allowed verbs (get, list, create, delete…) on resources within one namespace; a RoleBinding grants that Role to a subject, also scoped to that namespace. See RBAC.

RollbackReverting a Deployment to a previous revision — kubectl rollout undo — after a rollout causes a problem, using the revision history the Deployment controller keeps automatically.

Rolling updateA Deployment's default update strategy: new Pods are brought up and old ones torn down incrementally, controlled by maxSurge and maxUnavailable, so the workload never drops to zero available replicas during a release.

RuntimeClassAn object that lets a Pod request a specific container runtime configuration — the default runc, or a sandboxed one like gVisor or Kata Containers — by name in its spec, so isolation level can be chosen per workload rather than cluster-wide.

SBOM (software bill of materials)A structured, machine-readable inventory of every component and dependency in a shipped artifact, used to answer "are we affected by this CVE" quickly. Generating one as part of CI/CD is a named CKS Supply Chain Security competency — see the sibling DevSecOps course's supply chain security lesson.

Scheduler (kube-scheduler)The control-plane component that watches for Pods with no assigned node and picks one, filtering candidates against constraints (resource requests, taints, affinity) and scoring the survivors to pick a best fit.

SeccompA Linux kernel feature that restricts which syscalls a process may make. Kubernetes can apply a seccomp profile per Pod or container to shrink its syscall surface — a named CKS System Hardening competency alongside AppArmor.

SecretAn API object for holding sensitive data — passwords, tokens, TLS keys — base64-encoded (not encrypted) by default in etcd unless encryption at rest is configured. Kubernetes Secrets management, including that caveat, is a named CKS Minimize Microservice Vulnerabilities competency.

ServiceA stable network endpoint — a fixed virtual IP and DNS name — that load-balances traffic across a changing set of Pods matched by a label selector, so callers never need to track individual Pod IPs as Pods come and go.

Service AccountAn identity Pods use to authenticate to the API server (as opposed to a User Account, for humans). Every Pod gets a default ServiceAccount's token auto-mounted unless explicitly disabled — a named CKS Cluster Hardening competency: "use ServiceAccounts cautiously."

Service meshAn infrastructure layer — Istio, Linkerd, or Cilium's sidecar-free mesh mode — that handles service-to-service traffic (mTLS, retries, load balancing, observability) uniformly across a cluster, typically via a sidecar proxy injected into every Pod. Pod-to-Pod encryption via a mesh is a named CKS competency.

Sidecar containerA helper container running alongside a Pod's main container to handle a cross-cutting concern — log shipping, a service-mesh proxy, TLS termination — without changing the main container's code. See multi-container Pod patterns.

SOC 2A widely referenced auditing standard (Service Organization Control 2) for how a service provider handles customer data — security, availability, confidentiality. Named as a compliance-framework example in the KCSA curriculum.

StatefulSetAn API object for workloads that need stable, unique network identities and stable storage per replica — a database, a message queue — giving each Pod a predictable name (db-0, db-1) and its own PersistentVolumeClaim that survives a reschedule.

Static analysisScanning Kubernetes manifests or Helm charts for misconfiguration before they're ever applied — tools like Kubesec and KubeLinter, named directly in the CKS Supply Chain Security domain's "static analysis of user workloads" competency.

Static PodA Pod defined by a manifest file sitting directly on a node's filesystem and managed by that node's kubelet alone, bypassing the API server and any scheduler decision. How kubeadm itself runs the API server, scheduler, and controller-manager as Pods on the control-plane node before there's a working API server to schedule them normally.

StorageClassAn object that describes one "class" of storage a cluster can dynamically provision — its provisioner, parameters, and reclaim policy — so a PVC can request "fast SSD storage" by class name instead of an administrator hand-creating a matching PV for every claim.

STRIDEA threat-modeling framework categorizing attacks as Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, or Elevation of privilege. Named explicitly in the KCSA Compliance and Security Frameworks domain as a threat-modeling framework, alongside MITRE ATT&CK for Containers.

Supply chain securitySecuring everything that produces a running container before it ever reaches the cluster — base images, CI/CD pipelines, artifact repositories, image signing and validation, static analysis — the whole CKS Supply Chain Security domain (20% of the exam) in one phrase.

Taint and TolerationA taint on a node repels Pods from scheduling there unless the Pod carries a matching toleration — the inverse of affinity, which attracts rather than repels. Used to dedicate nodes (GPU nodes, control-plane nodes) to specific workloads.

Threat model (the 4Cs)KCSA's layered framing of where security controls apply: Cloud (the infrastructure underneath), Cluster (Kubernetes itself), Container (the image and runtime), and Code (the application). Each outer layer's compromise can cascade inward, which is the model's core argument for defense in depth.

Validating admission webhookAn admission controller, implemented as an external HTTP service, that can only accept or reject an object — never modify it — and runs after any mutating webhooks have already had their turn.

VeleroA tool for backing up and restoring Kubernetes cluster resources and persistent volume data, and for migrating workloads between clusters. See the Velero tool guide.

Vertical Pod Autoscaler (VPA)A controller that recommends or automatically applies changed CPU/memory requests and limits for a workload's containers based on observed usage, resizing Pods instead of adding more of them. Contrast with the Horizontal Pod Autoscaler.

VolumeStorage attached to a Pod and mounted into one or more of its containers — ranging from an ephemeral emptyDir that dies with the Pod to a PersistentVolumeClaim backed by durable, network-attached storage.

Volume mountThe container-level field that says where inside a container's filesystem a Pod's volume should appear — the same volume can be mounted at different paths in different containers of the same Pod.

Workload resourceThe general term for any Kubernetes API object whose job is to run and manage Pods — Deployment, StatefulSet, DaemonSet, Job, and CronJob are the five built-in workload resources.

YAMLThe human-readable, indentation-sensitive data format nearly every Kubernetes manifest is written in — a strict superset of JSON with far less punctuation, and the format every kubectl apply -f in this course expects.

Zero trustA security posture that grants no implicit trust based on network location alone — every request is authenticated and authorized on its own merits, even one originating inside the cluster. The underlying philosophy behind pairing RBAC, NetworkPolicy, and mTLS rather than relying on any one of them alone.