Kubernetes for the Impatient
Pods, deployments, services, ingress, helm - the minimum you need to run something real.
“Kubernetes doesn't make your app more resilient. It makes your app more complicated and then gives you the tools to deal with that complication.”
What you'll learn
The minimum viable cluster in your head
A Pod is one or more containers that share a network namespace and, optionally, volumes. You almost never create a bare Pod in production. A Deployment owns ReplicaSets that own Pods. That chain is how rolling updates and rollbacks exist.
If you skip the Deployment 'just to try something', you will try something again at 2 a.m. with no undo. Start with a Deployment. Stay with a Deployment.
Services: the name other things should call
ClusterIP is the default and the correct default. It is a stable virtual IP plus DNS inside the cluster. NodePort punches a hole through every node. LoadBalancer asks the cloud for a bill. Ingress (or Gateway API) is how HTTP hostnames and paths reach Services without each app demanding its own cloud load balancer.
Selector labels must match Pod labels. This is the entire plot of half the 'my app is down' tickets. The other half is a NetworkPolicy nobody documented.
Ingress is not optional once you have a hostname
An Ingress resource is a request. An Ingress controller is the software that fulfills it. Installing one without the other is how you get a silent object that changes nothing.
Terminate TLS at the edge unless you have a reason. Cert-manager can issue certificates. You still have to point DNS at the right place. Kubernetes will not forgive a typo in a hostname the way a helpful PaS might.
ConfigMaps, Secrets, and the files you used to SCP
ConfigMaps hold non-secret config. Secrets hold things that should not appear in kubectl describe output on a shared screen — and then often do, because they are only base64. Treat in-cluster Secrets as better than git, not as a vault.
Mount config as files when the app expects files. Use env vars when the app expects env vars. Do not do both for the same key and then argue about precedence during an incident.
Helm: a package manager with opinions
Helm charts are templates plus a values.yaml that vendors hope you will read. You will not, the first time. Read it the second time, before you set replicaCount: 1 on a stateful thing and persistence.enabled: false on a database.
Pin chart versions. helm upgrade with a floating version is how a Tuesday becomes a changelog. helm rollback is why people tolerate Helm.
What 'running something real' actually means
Requests and limits. A readiness probe that checks a path the app can fail. A liveness probe that is not the same path if a slow request should not kill the process. A PodDisruptionBudget before the first node drain. Resource requests that are not fiction.
That list is shorter than a certification syllabus and longer than a tweet. It is also the difference between a demo and a service you can page someone for.