Glossary

173 terms from Kubernetes Beyond the Basics, in plain words, each with the chapter that teaches it.

Search the glossary

#

--clean (pg_dump): A pg_dump option that adds statements dropping each table before creating it, so a restore into an existing database doesn't fail; `--if-exists` avoids errors when a table is missing.

A

apiVersion: The field at the top of a manifest that names the API group and version of the object, such as `apps/v1` for a Deployment or `batch/v1` for a Job.
Application (Argo CD): An Argo CD custom resource that says which folder of which Git repository to keep applied to which namespace. The `shop` Application points at the `kc-shop` folder of `kc-cluster`.
appVersion: A field in Chart.yaml giving the version of the app inside the chart, such as the image tag 1.0.0. It is separate from the chart's own `version`.
Argo CD: A GitOps agent that runs in the cluster, watches a Git repository and keeps the cluster in step with it. It has a web UI showing each app's sync and health.
Authentication and authorization: Authentication proves who a caller is; authorization decides what that caller may do. Every request to the API server passes both checks.
automountServiceAccountToken: A setting that controls whether Kubernetes mounts the ServiceAccount's API token into containers; set to false for the web app, which never calls the API.

B

backendRefs: In an HTTPRoute rule, the Services that receive the matching requests (`backend.service` in an Ingress).
backoffLimit: A Job field for how many times to retry failed pods before the Job is marked failed (default 6). The backup Job uses 2.
base64 -d: A command that decodes base64 text. It is used to read the Argo CD admin password stored in a Secret.
BestEffort: The QoS class of pods with no requests or limits at all. They are evicted first when a node runs short of memory.
Burstable: The QoS class of pods with at least one request or limit that don't qualify as Guaranteed. The web pods are Burstable.

C

Calico and Cilium: Two network plugins (CNIs) you meet on other clusters that enforce NetworkPolicies.
capabilities: Special powers of the root user, such as changing file owners. Dropping ALL capabilities in a container's securityContext removes them.
cert-manager: An add-on that asks a certificate authority such as Let's Encrypt for trusted certificates, stores them in TLS Secrets and renews them. It needs a public DNS name.
Certificate: A public, signed document that names a host and is used for TLS so clients can trust the server. cert-manager also has a Certificate object that requests one.
certificate authority: An organization browsers trust to sign certificates, such as Let's Encrypt.
Chart: A folder of templates plus default values that Helm installs. The `kc-shop` chart holds the orders app's manifests.
Chart version: The version number of a Helm chart itself, which you can pin with `--version` so every install gets the same files.
Chart.yaml: The file at the top of a chart giving its name, description, `version` and `appVersion`.
cloud-provider-kind: A program run on your computer that acts like a cloud provider for kind: it gives LoadBalancer Services external IPs and includes an Ingress controller and a Gateway API implementation.
CloudNativePG: An operator that runs Postgres in a cluster with replicas, failover and backups.
Cluster autoscaler: A component that asks the cloud for more nodes when pods are Pending for lack of room and removes idle nodes later.
ClusterRole and ClusterRoleBinding: A ClusterRole holds rules for the whole cluster or rules to reuse in many namespaces; a ClusterRoleBinding gives it to callers cluster-wide.
CNI (Container Network Interface): The plugin that wires up pod networking and must enforce NetworkPolicies. kind's kindnet does, as do Calico and Cilium.
concurrencyPolicy: A CronJob field for what to do if the previous Job is still running: Allow runs both, Forbid skips the new one, Replace stops the old one.
Container registry: A server that stores container images so clusters can pull them. On a cloud cluster you push `kc-orders` to one instead of using `kind load`.
Control plane: The part of Kubernetes that runs the cluster: the API server, etcd, the scheduler and controllers. In a managed cluster the cloud provider runs it for you.
CoreDNS: The cluster's DNS service, on port 53, which lets pods find each other by name such as `db`. Egress lockdowns must allow it.
CreateContainerConfigError: A pod status meaning the container's configuration can't be applied, such as a missing Secret or a non-numeric user with runAsNonRoot.
createdb: Postgres commands that make or delete a database. The restore check uses `createdb` to make an empty `scratch` database.
cron syntax: Five space-separated fields (minute, hour, day of month, month, day of week) that give a CronJob's schedule. `0 3 * * *` means 3:00 every night.
CronJob: An object that creates a Job on a cron schedule. Kettle & Crane's `db-backup` CronJob dumps the database nightly.
curl --resolve and --cacert: curl options: `--resolve` uses a given IP for a name and port as if DNS had answered, and `--cacert` trusts your self-signed certificate.
Custom resource: A kind of object that a program adds to the Kubernetes API, such as Argo CD's Application or the Gateway API's Gateway.

D

default-deny: A NetworkPolicy that selects every pod and lists no rules, so nothing may connect until other policies allow it.
desired state: What the cluster should be running, which GitOps keeps in a Git repository.
Drain: Marking a node unschedulable and evicting its pods so they start elsewhere, done before maintenance or upgrades.
Drift: The gap between what is running in the cluster and what Git says, for example after someone runs `kubectl scale` by hand.

E

Egress: Traffic leaving a pod. An Egress NetworkPolicy limits connections a pod starts and must allow DNS on port 53.
EKS, GKE, AKS: The managed Kubernetes services of Amazon, Google and Microsoft Azure, where the provider runs the control plane.
eksctl, gcloud, az: The command-line tools for creating clusters on EKS, GKE and AKS respectively.
eviction: The kubelet removing pods from a node to free resources, lowest QoS class first, or a drain removing pods before maintenance.
External IP: An address outside the cluster that reaches a LoadBalancer Service. On kind, cloud-provider-kind supplies it.

F

Flux: The other main GitOps agent, an alternative to Argo CD.

G

Gateway: A Gateway API object that is one shared entrance to the cluster with an address and listeners for ports and protocols. The platform team usually owns it.
Gateway API: The successor to Ingress, splitting the job into a GatewayClass, a Gateway and routes such as HTTPRoute, each owned by a different team.
GatewayClass: A Gateway API object naming the software that implements Gateways. It is installed once per cluster.
GitOps: Running a cluster from Git: a repository holds the desired state, an agent syncs it, and the only way to change the cluster is to change the repository.
GKE Autopilot, EKS Auto Mode, AKS Automatic: Hands-off modes where the provider also picks, patches and scales the worker nodes for you.
Guaranteed: The top QoS class, for pods whose containers all have CPU and memory limits equal to requests. They are evicted last.

H

Headless Service: A Service with `clusterIP: None` that has no address of its own; DNS returns the pods' addresses and gives each pod its own name such as `db-0.db`.
Helm: The package manager for Kubernetes: you write manifests once as templates, put differences in values, and install the result as named releases.
Helm built-in objects: Data every template can read: `.Values` (from values.yaml), `.Release.Name` and `.Chart.Name`.
helm commands (install, upgrade, rollback, uninstall, history, list): Helm commands that manage releases: install one, change it, go back to an earlier revision, remove it, and list releases or a release's revisions. `helm upgrade --install` does install-or-upgrade in one command.
helm lint: A Helm command that checks a chart for mistakes without touching the cluster.
helm repo, search repo, show values: Commands to add a chart repository, refresh it, search for charts and read a chart's `values.yaml` before installing.
helm template: A Helm command that renders a chart to plain YAML on your screen without touching the cluster.
Host header: The part of an HTTP request that says which host name is wanted. Ingress controllers route on it, and `curl -H` lets you set it before DNS exists.
HPA (HorizontalPodAutoscaler): A built-in object that watches a Deployment and changes its replica count with load. For the web pods it aims for 70% average CPU of requests.
HTTP status codes: Three-digit numbers a web server sends back with its response to say how the request went. For example, 200 means success, and 404 (Not Found) means nothing matched the request, as when an ingress controller or Gateway has no rule for the request's `Host` header.
HTTPRoute: A Gateway API object that attaches to a Gateway and sends requests for its host names to Services. App teams own their own routes.
HTTPS: HTTP over TLS: web traffic that is encrypted and proves the server's name. HTTP is the plain, unencrypted form.

I

if / if not (template conditionals): Template actions that include lines only when a value is true (or false). `{{-` trims whitespace before the action.
Ingress: An object mapping host names and paths to Services. It does nothing on its own without an ingress controller.
Ingress (traffic direction): Connections coming into a pod, the direction a NetworkPolicy's `ingress` rules limit.
Ingress controller: The program that reads Ingress objects and does the routing. A cluster can have several.
Ingress NGINX: The most common Ingress controller, retired in March 2026 and no longer getting fixes.
IngressClass: An object naming which ingress controller an Ingress uses; cloud-provider-kind's is `cloud-provider-kind`.
ipBlock: A NetworkPolicy source that allows a range of IP addresses such as `10.0.0.0/8`.
Issuer: A cert-manager object saying which certificate authority signs certificates, such as Let's Encrypt via ACME.

J

Job: An object that runs pods until a task finishes successfully, such as a backup, then leaves them alone.
jsonpath: A kubectl output form that prints one field of an object, such as a Gateway's address, by following the YAML path.

K

Karpenter: An AWS tool that adds nodes when pods are Pending and removes idle ones.
KEDA: An add-on that feeds event numbers, such as queue length, to an HPA so it can scale on them.
kind: A tool that runs a Kubernetes cluster in Docker on one computer. Its built-in network plugin, kindnet, enforces NetworkPolicies.
kind load docker-image: A command that copies a local Docker image into a kind cluster, since kind can't pull it from your computer otherwise.
kubeconfig context: A kubeconfig entry choosing which cluster kubectl talks to. `get-contexts` lists them and `use-context` switches.
kubectl auth can-i: A command that asks whether a request would be allowed; `--as` asks on someone else's behalf, such as Priya.
kubectl create job --from: Creates a Job straight away from a CronJob's template, to run a backup now.
kubectl expose: Creates a Service for an existing Deployment, using its labels as the selector.
kubectl label: Adds labels to an existing object; used to switch on Pod Security Admission for a namespace.
kubectl top: Shows live CPU and memory use of nodes or pods, once metrics-server is running.
kubelet: The agent on each node that starts and watches its pods, evicts them when the node runs short and reports CPU and memory use to metrics-server.
Kustomize: Another way to vary manifests per environment, built into kubectl; it patches plain YAML instead of templating it.

L

Label: A key-value tag on an object. Services, Deployments, policies and budgets use label selectors to pick the pods they apply to, such as `app: web`.
Least privilege: Giving each caller only the access its job needs, so a leaked password or token can do little harm.
Let's Encrypt: A certificate authority that issues free, trusted certificates, used through cert-manager.
LimitRange: A namespace object that fills in default requests and limits for containers that omit them and sets the smallest and largest allowed.
Limits: The most CPU or memory a container may use. Over its CPU limit it is throttled; over its memory limit it is OOMKilled.
listener: An entry on a Gateway saying which protocol and port it accepts (and optionally a host name and TLS certificate).
LoadBalancer Service: A Service type that gets an external address, but on a cloud each one is a separate paid load balancer that can't route by host name.

M

managed cluster: A cluster whose control plane (API server, etcd, scheduler) a cloud provider runs for you; you still own the nodes, workloads, access and bill.
managed database: A database such as Amazon RDS, Google Cloud SQL or Azure Database for PostgreSQL that the provider runs; the app just needs its address.
maxSkew: In a topology spread rule, the most that pod counts may differ between nodes.
metrics-server: A cluster add-on that collects CPU and memory use from each kubelet and serves it to `kubectl top` and the HPA.
Mi and Gi: Binary memory units: `128Mi` is 128 mebibytes and `1Gi` is 1,024 Mi.
Millicore: A thousandth of a CPU core; `100m` is a tenth of a core.

N

Namespace: A named space inside a cluster that groups objects, and the scope for Roles, quotas and NetworkPolicies. The shop runs in the `shop` namespace.
namespaceSelector: A NetworkPolicy source that picks every pod in the namespaces with matching labels.
nc (netcat): A tool that opens a network connection; `nc -zv -w 2 db 5432` checks whether the database port is reachable.
NetworkPolicy: An object that limits which connections may reach (or leave) a group of pods. Policies only allow and add up, and the CNI must enforce them.
nindent: A Helm template function that starts a new line and indents every line by a given number of spaces, used with `toYaml`.
Node loss: A node dying, so its pods must restart elsewhere. A PodDisruptionBudget can't prevent it, but replicas and spreading cover it.

O

OCI registry: A registry that stores container images and, increasingly, Helm charts, which you can install straight from an `oci://` address.
OOMKilled: A container stopped by the kernel for going over its memory limit; Kubernetes then restarts it.
openssl: A command-line tool used to make a self-signed certificate and key, or read a certificate's dates.
Operator: A program running in the cluster that manages one kind of application for you, such as CloudNativePG running Postgres with failover.

P

parentRefs: The HTTPRoute field naming the Gateway the route attaches to.
pathType (Prefix): A path match that covers the given path and everything below it, so `/` matches every page.
Pending: A pod's state while no node has room for it yet; events like `Insufficient cpu` explain why.
PersistentVolumeClaim (PVC): A request for disk storage that outlives pods. The backup PVC `db-backups` and the database's `data-db-0` keep their files when pods go away.
pg_dump: A Postgres program that writes a whole database as SQL statements which can later be replayed to rebuild it. The nightly backup uses it.
pipe (|) in templates: In Helm templates, `|` passes the result of one function to the next, as in a shell.
Pod Security Admission: A part of the API server that applies a Pod Security Standard to a namespace through labels, with `enforce` to reject and `warn` to only print a warning.
Pod Security Standards: Three levels of pod safety: `privileged` (no limits), `baseline` (blocks known dangerous settings) and `restricted` (requires non-root, no capabilities and more).
PodDisruptionBudget: An object that sets the fewest pods that must stay up during voluntary disruptions such as a drain. The shop's PDB keeps at least one web pod running.
podManagementPolicy: StatefulSet fields: `podManagementPolicy: Parallel` starts and stops all pods at once, and `rollingUpdate.partition` updates only pods at or above a number so you can try a version on one pod.
podSelector: A label-based choice of pods. In a NetworkPolicy, the top-level one picks the protected pods and `from` entries pick allowed sources; `{}` means all pods in the namespace.
port-forward: A kubectl command that forwards a local port to a Service or pod, so you can reach it from your computer.
Postgres: The database the orders app uses; `psql` is its command-line client, and `-f` runs the SQL in a file.
Private key: The secret half of a certificate pair, known only to the server. Keep it out of Git.
prune: An Argo CD setting that deletes cluster objects whose files were removed from Git; without it they keep running.

Q

QoS class: Guaranteed, Burstable or BestEffort, set from a pod's requests and limits; it decides eviction order when a node runs short of memory.
quote: A Helm template function that wraps a value in double quotes, keeping values like `*/15 * * * 1-5` valid YAML.

R

RBAC (role-based access control): The usual authorization system: you list what is allowed in a role, bind it to users or ServiceAccounts, and everything else is refused.
RBAC verbs and rules: The parts of a rule: `apiGroups` (`""` is the core group), `resources` (plural names like `pods`) and `verbs` such as get, list, watch, create, update, patch, delete.
readiness probe: A check Kubernetes runs on a container, such as `pg_isready`, to decide whether the pod is ready for traffic or healthy.
Release: One installed copy of a Helm chart with its own name; the same chart could be installed as `shop` and `shop-test`.
Release tag: A Git label such as `v3.5.3` that marks one exact version.
repository (Helm): A web server that hosts charts for others to install, added with `helm repo add`.
Requests: What a container needs. The scheduler only places a pod on a node with that much unreserved room, and the HPA measures utilization against requests.
required (Helm function): A Helm function that stops rendering with your message when a value is empty, catching typos in value names.
ResourceQuota: A namespace object capping the total requests, limits or object counts of all pods in it, so one team can't fill the cluster.
restartPolicy: A pod setting for what happens when a container ends. Jobs use `Never` (a new pod is made) or `OnFailure` (the container restarts in the same pod); `Always` isn't allowed.
Restore check: Loading a backup into a scratch database to prove the backup works. A backup nobody has restored may be empty.
Revision: One numbered version of a Helm release. Each upgrade adds one, and a rollback adds a new revision that copies an old one.
Role and RoleBinding: A Role is a set of allowed actions in one namespace; a RoleBinding grants it to users or ServiceAccounts in that namespace.
Rolling update: A Deployment's way of changing pods gradually, starting new ones and removing old ones so the app keeps serving. It happens when the pod template changes.
runAsNonRoot: securityContext settings that refuse to start a container as root and set the numeric user ID it runs as.

S

ScheduleAnyway: A spread setting that prefers an even spread but never stops a pod from starting.
Scheduler: The control plane part that picks which node each new pod runs on, using the pods' requests to find a node with enough unreserved room.
Scratch database: A throwaway database used to test a restore without touching real data.
Sealed Secrets and External Secrets Operator: Tools that let you keep secrets safely with Git by encrypting them (Sealed Secrets) or fetching them from elsewhere (External Secrets Operator), since plain Secrets must not be stored in Git.
seccompProfile: A securityContext setting; `RuntimeDefault` blocks rarely needed kernel calls.
Secret: A Kubernetes object that holds sensitive data such as passwords or a TLS certificate and key. Keep Secrets out of Git.
securityContext: A pod's or container's settings for the user it runs as and which privileges it has, such as non-root and no capabilities.
Self-heal: Argo CD undoing changes made by hand so the cluster matches Git again.
Self-signed certificate: A certificate you sign yourself, which browsers don't trust. Fine for practice, with `--cacert` telling curl to trust it.
Server-side apply: A mode of `kubectl apply` where the API server works out the changes, avoiding a size limit on very large objects.
ServiceAccount: An identity for programs running in pods. The `default` account is used unless told otherwise; the chart gives `web` one with no token.
serviceName: The StatefulSet field naming its headless Service, which creates the per-pod DNS names.
shell variable and command substitution: `IP=$(...)` stores a command's output in a shell variable for later use.
stabilization window: The 5-minute wait before the HPA scales down, so a short pause in orders doesn't remove pods needed again soon.
StatefulSet: Runs pods with stable names (`db-0`), ordered start and stop, and their own volume each. It suits a database like Kettle & Crane's Postgres.
StorageClass: An object that says how the cluster makes a volume when a PVC asks for one. A PVC that names no class gets the cluster's default.
subresource: A part of a resource with its own permission in RBAC, such as `pods/log` for reading logs.
Sync: Applying Git's state to the cluster. Argo CD's `automated` sync policy does it on every new commit.
Synced and OutOfSync: Argo CD's sync status: Synced when the cluster matches Git and OutOfSync when not. Health status is separate: Healthy, Progressing or Degraded.

T

Template and template action: A template is a YAML file with gaps; a template action is a `{{ }}` gap that Helm fills when it renders the chart.
Throttled: A container that wants more CPU than its limit is slowed down rather than killed.
TLS (Transport Layer Security): Encryption for traffic that also proves the server's name: the S in HTTPS. A Gateway terminates TLS by decrypting requests and passing plain HTTP on.
TLS Secret: A Secret of type `kubernetes.io/tls` holding exactly the keys `tls.crt` and `tls.key`, referenced by a Gateway listener or Ingress.
topologySpreadConstraints: A pod setting that spreads matching pods across nodes or zones, so a dead node takes only some of them.
toYaml: A Helm template function that turns a values block back into YAML text, usually piped to `nindent`.
ttlSecondsAfterFinished: A Job field that deletes the finished Job and its pods after that many seconds.

V

valueFiles: An Argo CD setting listing extra values files in the chart folder, read after `values.yaml`, like `-f`. The production layer uses it.
values.yaml: A chart's file of default settings that templates read. Override with `--set` or `-f` files; later files win and `--set` wins over all.
view, edit, admin: Built-in ClusterRoles: view reads most things but not Secrets, edit changes most things, admin does everything in a namespace including roles.
volumeClaimTemplates: A StatefulSet's pattern for creating one PVC per pod, such as `data-db-0` for `db-0`.
Voluntary disruption: A planned pod removal, such as a drain or cluster upgrade. A PodDisruptionBudget limits these but not crashes.
VPA (VerticalPodAutoscaler): An add-on that changes each pod's requests to fit what it really uses, instead of changing the pod count.

W

Workload Identity (cloud identity for pods): Linking a ServiceAccount to a cloud identity so pods get short-lived credentials instead of a cloud password in a Secret.