8 — Network Policies

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

2 — CNI Architecture

CNI is a thin exec-based plugin contract, not a networking stack itself — which is why Calico, Cilium, and Flannel can implement wildly different dataplanes (iptables, eBPF, VXLAN) behind the same interface.

5 — CoreDNS

CoreDNS resolves Service names by querying the API server, not by watching iptables — so a Service can be DNS-resolvable milliseconds before kube-proxy has actually wired up a route to it.

7 — Gateway API

Gateway API splits the single Ingress object into role-scoped resources (GatewayClass, Gateway, HTTPRoute) specifically so platform teams and app teams can own different layers without stepping on each other's config.

6 — Ingress

The Ingress resource is a portable schema with no built-in implementation — every annotation you add to make it actually do something ties you to one specific controller, quietly breaking portability.