Kubernetes only pays off once the cluster state lives in a repository rather than in the administrator's memory. This area covers the design of small highly available clusters, networking and storage for containers, and GitOps as a way of working rather than just a tool.
The API address jumps between nodes, and the network plugin, controllers and DNS restart in its wake. How to tell a kube-vip problem from slow etcd, the network or node resources, and what to change so the address stops moving.
A CI system, a GitOps platform, monitoring and a wiki can all sign users in with a domain account. Direct LDAPS and OIDC through a broker such as Dex or Keycloak give the user the same result and security a completely different one.
Without any network policy, every pod in the cluster can connect to every other pod. How to introduce default deny per namespace, allow DNS, traffic from the ingress controller and to the database, and not take the applications down in the process.
Three control plane nodes achieve nothing if clients connect to the API at the address of one of them. Three ways to keep a shared address, their configuration, a certificate with the right names, and how to check who really uses the address.
A Deployment pointing at app:latest works until the first time a pod restarts on another node. How to tag images with a version and commit hash, pin them by digest, protect tags in the registry and clean the registry up safely.
A Docker daemon in the pipeline means a privileged container or the host socket inside a CI job. How to build an image from the same Dockerfile in an ordinary pod, and what to choose now that the kaniko repository has been archived.
A script executes steps and exits; GitOps maintains state. Using an Argo CD Application as the example: automated sync, self-healing, resource ordering and detecting manual changes on the cluster.
Three nodes and etcd protect the cluster state, not the applications. What happens to pods, volumes and the API address after a node failure, and how to design replicas, spreading and disruption budgets in k3s.
A GitOps-managed cluster can be rebuilt from scratch in an hour, but the repository will not bring back volume data, secrets or API state. etcd snapshots in k3s, Velero, and a restore test to a separate cluster.
Containers have not replaced virtual machines, and the cluster itself runs on VMs. A decision table for typical workloads and the Hyper-V settings without which Kubernetes nodes lose memory, etcd consistency or quorum.