Kubernetes Guide 2026: Pods, Services, Deployments, Ingress, Helm, and Operators

The smallest deployable unit in Kubernetes. Contains one or more containers sharing network namespace (same IP, localhost communication) and storage volumes. Pods are ephemeral; Deployments manage their lifecycle. Most pods run a single container.

A controller managing a set of identical Pods via ReplicaSets. Provides: declarative updates, rolling updates (zero-downtime), rollback, and scaling. The standard way to run stateless applications in Kubernetes.

A stable network endpoint for a set of Pods. Types: ClusterIP (internal), NodePort (expose on node port), LoadBalancer (cloud LB), ExternalName (DNS alias). Services use label selectors to match Pods.

HTTP/HTTPS routing from external traffic to Services. Rules define path-based and host-based routing. Requires an Ingress Controller (NGINX, Traefik, Envoy). TLS termination via Secrets. Being supplemented by Gateway API.

Virtual cluster within a physical cluster. Provides: resource isolation, access control (RBAC per namespace), resource quotas, and network policies. Default namespaces: default, kube-system, kube-public.

Stores non-sensitive configuration as key-value pairs. Consumed as: environment variables, command-line arguments, or mounted files. Decouples configuration from container images. Not for secrets (use Secret resource).

Stores sensitive data: passwords, tokens, TLS certificates. Base64-encoded (not encrypted by default). Enable encryption at rest. Mount as files or env vars. External secret managers: Vault, AWS Secrets Manager via External Secrets Operator.

Manages stateful applications. Provides: stable network identity (pod-0, pod-1), persistent storage per Pod (PVC templates), ordered deployment/scaling, and ordered rolling updates. Used for: databases, Kafka, Elasticsearch.

Ensures one Pod runs on every node (or selected nodes). Used for: log collectors (Fluentd), monitoring agents (Prometheus node-exporter), storage drivers, and network plugins. Pods are automatically scheduled on new nodes.

Runs Pods to completion (not continuously). For: batch processing, data migration, backups. completions: how many Pods must complete. parallelism: how many run simultaneously. CronJob schedules Jobs on a cron schedule.

The package manager for Kubernetes. Charts are packages of pre-configured K8s resources. Values.yaml customizes charts. Commands: helm install, helm upgrade, helm rollback. Artifact Hub hosts community charts. Alternative: Kustomize.

A custom controller that extends Kubernetes with domain-specific automation. Encodes operational knowledge (install, upgrade, backup, failover) in code. Examples: PostgreSQL Operator, Prometheus Operator, Cert-Manager. Built with Operator SDK or kubebuilder.

Automatically scales Pod replicas based on metrics. Default: CPU utilization. Custom metrics: requests/second, queue depth, memory. Scales between minReplicas and maxReplicas. KEDA extends HPA with event-driven scaling (0 to N).

A piece of storage provisioned in the cluster. PersistentVolumeClaim (PVC) requests storage. StorageClass defines the provisioner (EBS, GCE PD, NFS). Dynamic provisioning creates PVs automatically from PVCs. Access modes: ReadWriteOnce, ReadOnlyMany, ReadWriteMany.

Role-Based Access Control: controls who can do what in the cluster. Role/ClusterRole: defines permissions (verbs on resources). RoleBinding/ClusterRoleBinding: assigns roles to users/groups/ServiceAccounts. Principle of least privilege.

Firewall rules for Pod-to-Pod communication. Default: all Pods can communicate. NetworkPolicy restricts ingress and egress by: namespace, Pod labels, IP ranges, and ports. Requires a CNI that supports network policies (Calico, Cilium).

A container that runs and completes before main containers start. Used for: database migration, config generation, waiting for dependencies. Run sequentially; Pod does not start until all init containers succeed.

A container running alongside the main container in the same Pod. Used for: logging, monitoring, proxying (Envoy/Istio), TLS termination. Shares network and can communicate via localhost. K8s 1.28+ has native sidecar support.

Schedules Jobs to run on a cron schedule. Used for: backups, report generation, cleanup tasks. Cron syntax: minute hour day-of-month month day-of-week. Handles: concurrent policies, job history limits, deadlines.

Infrastructure layer for service-to-service communication. Provides: mTLS, traffic management, observability, resilience. Istio (Envoy-based), Linkerd (lightweight), Cilium (eBPF). Deployed as sidecar proxies alongside each Pod.

The next generation of Ingress. More expressive, extensible, and role-oriented. Resources: GatewayClass, Gateway, HTTPRoute, TCPRoute. Supports: header-based routing, traffic splitting, mirrors. Gradually replacing Ingress.

Configuration management built into kubectl. Overlays patch base YAML without templates. kustomization.yaml defines resources, patches, and transformers. Simpler than Helm for straightforward customization. kubectl apply -k .

GitOps continuous delivery tool. Git repository is the source of truth. ArgoCD watches Git, detects drift, and syncs to the cluster. Supports: Helm, Kustomize, plain YAML. UI, CLI, and API. Multi-cluster management.

Limits the number of Pods that can be down simultaneously during voluntary disruptions (node drain, upgrades). Ensures minimum availability. Example: minAvailable: 2 or maxUnavailable: 1. Essential for production workloads.

Requests: guaranteed resources for scheduling. Limits: maximum resources a container can use. CPU: millicores (100m = 0.1 CPU). Memory: bytes (128Mi, 1Gi). Set requests for scheduling, limits for protection. QoS classes: Guaranteed, Burstable, BestEffort.

Checks if the container is running. If it fails, kubelet restarts the container. Types: HTTP GET, TCP socket, exec command. Configure: initialDelaySeconds, periodSeconds, failureThreshold. Detect: deadlocks, frozen processes.

Checks if the container is ready to serve traffic. If it fails, the Pod is removed from Service endpoints (no traffic). Detect: startup time, dependency unavailable, overloaded. Do not confuse with liveness (readiness does not restart).

Default Deployment strategy. Gradually replaces old Pods with new ones. Controls: maxSurge (extra Pods during update), maxUnavailable (Pods that can be unavailable). Zero-downtime when combined with readiness probes.

Deploy new version to small traffic subset, monitor, then scale up. Not built into K8s; use: Istio VirtualService, Argo Rollouts, Flagger. Safer than rolling update for catching subtle issues.

Distributed key-value store used as Kubernetes backing store. Stores all cluster state: resources, configs, secrets. Uses Raft consensus. Critical component; backup regularly. Managed by cloud providers in managed K8s.

Node agent that runs on every node. Ensures containers described in PodSpecs are running and healthy. Communicates with the API server. Manages: Pod lifecycle, probes, resource enforcement, volume mounting.

Command-line tool for Kubernetes. Commands: apply (create/update), get (list), describe (details), logs (container logs), exec (run command in container), port-forward (local access). The primary Kubernetes CLI.

Software that runs containers. containerd is the K8s default (Docker removed as runtime in K8s 1.24). CRI-O is an alternative. The Container Runtime Interface (CRI) defines the standard. Docker images still work via containerd.

Plugin interface for configuring container networking. Popular CNIs: Calico (network policies, BGP), Cilium (eBPF, observability), Flannel (simple overlay), AWS VPC CNI (native VPC networking). Determines: Pod networking, network policies, performance.

Rules for Pod scheduling preferences. Node affinity: schedule on nodes with specific labels. Pod affinity: schedule near specific Pods. Pod anti-affinity: avoid co-location (spread across zones). Required (hard) or preferred (soft) rules.

Taints on nodes repel Pods unless the Pod has a matching toleration. Used for: dedicated nodes (GPU), node conditions (not-ready), and eviction. Effect: NoSchedule, PreferNoSchedule, NoExecute. Master nodes are tainted by default.

Automates TLS certificate management in Kubernetes. Issues certificates from: Let us Encrypt, Vault, self-signed. Manages: creation, renewal, and rotation. Integrates with Ingress for automatic TLS. Essential for production HTTPS.

Kubernetes Event-Driven Autoscaling. Scales workloads from 0 to N based on event sources: Kafka messages, SQS queue depth, cron schedules, Prometheus metrics, HTTP requests. Extends HPA with many scalers. Essential for event-driven and serverless patterns on K8s.

Built-in security policies replacing PodSecurityPolicy (removed in K8s 1.25). Three levels: Privileged (unrestricted), Baseline (prevent known escalations), Restricted (hardened). Applied per namespace via labels. Enforces: no root, no host networking, read-only root filesystem.

Backup and disaster recovery tool for Kubernetes. Backs up: K8s resources (YAML) and persistent volumes (snapshots). Schedules: cron-based backups. Restore: full cluster or selective resources. Migrate workloads between clusters.