The Cluster That Puts It Back
A control plane, some nodes, and one loop that refuses to let your pod stay deleted — the idea the rest of this book rests on.
Kubernetes from Scratch
Containers, orchestrated — pods, deployments, services, and the reconcile loop, built up from an empty kind cluster to a running bookshop.
-
-
The Pod Is Not a Container
Why Kubernetes wraps your container in a thing you didn't ask for, what the 320 kB container you never deployed is doing on your node, and the pull-policy default that ruins everybody's first afternoon with kind.
-
The Rollout Said Success. The Client Saw a 000.
Deployments, ReplicaSets, and the default rolling update that drops live requests while kubectl reports a clean rollout — reproduced three times, then fixed.
-
Services, and the Lie nslookup Tells You
Pods get a new IP on every rollout, so a Service gives them one address that doesn't move — and then cluster DNS quietly reports that address as broken when it isn't.
-
ConfigMaps and Secrets: One Edit, Three Different Answers
Change one ConfigMap key and three consumers of it behave three different ways — one updates about a minute later, one updates never, and one updates never but looks identical in the YAML.
-
Storage: Where the Data Goes When the Pod Doesn't
Delete the Postgres pod and see whether the books survive — plus PVCs, StorageClasses, WaitForFirstConsumer, and why a Deployment is the wrong shape for a database.
-
Held Together by Strings: Namespaces, Labels, and Selectors
Kubernetes has almost no hard-coded relationships — a Service finds pods by label, and a quota can silently refuse every one of them.
-
Pending Forever: What the Scheduler Is Really Telling You
Requests place a pod, limits kill it, and a taint will never attract one — the asymmetries that decide where your workload runs.
-
Ready Is a Promise About Traffic, Not About Health
Readiness withdraws traffic, liveness kills your container, and pointing the wrong one at your database will restart the entire fleet at once.
-
The Front Door Kubernetes Doesn't Ship
Gateway API is CRDs and a controller — and a Gateway with no controller is a beautiful, inert YAML file. Then real traffic, a real canary, and an honest look at Ingress.
-
Everything Your Pod Can Do, and Nothing Else
Every pod carries an API token whether you asked for one or not. Here is what it can do (nothing), how to give it exactly enough, and why RBAC has no deny rule.
-
The Pod Is Lying to You
CrashLoopBackOff is not an error state, --previous is not how you debug one, and the pod that has no shell can still be debugged. The chapter that makes you self-sufficient.
-
A CRD With No Controller Is a Database Row With Good Manners
Custom resources, controllers, and the reconcile loop — by defining a new kind, watching nothing happen, and then writing the fifteen lines of shell that make it real.
-
Helm, Kustomize, and the Selector That Cost Me a Namespace
Two ways to stop copy-pasting YAML, the failures each one hands you, and an honest recommendation about which to reach for.
-
The Bookshop on Kubernetes: One Command, Fifteen Chapters
The whole application, assembled and running — and a line-by-line defence of every decision in it, each one paid for by a chapter that broke something first.