6 — Capabilities
Purpose
[stub: capabilities]
Metadata
| Author | Amit Singh |
| Scope | kubernetes |
Local graph
Linked from 2 notes
Kubernetes
A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.
Operating Systems for MAANG Interviews
A book-shaped table of contents for operating systems at MAANG interview depth: foundations through processes, threads, concurrency, CPU scheduling, memory management, file systems, I/O, security & isolation, Linux internals, cloud/Kubernetes/observability, advanced kernel topics, and interview preparation — cross-linking existing sre/linux-networking, kubernetes-security, and patterns/concurrency notes instead of duplicating them.
Related notes
4 — AppArmor
AppArmor confines a process with path-based file, network, and capability rules rather than syscall filtering, and since Kubernetes 1.30 it is configured as a first-class securityContext field instead of only through legacy annotations.
7 — Linux Kernel Isolation
Containers isolate processes using namespaces and cgroups on a single shared host kernel rather than virtualizing hardware, so a kernel-level exploit inside one container can compromise every other container scheduled on that node.
1 — Pod Security Standards
Pod Security Standards replaced the removed PodSecurityPolicy admission controller with three built-in profiles (Privileged, Baseline, Restricted) enforced declaratively via namespace labels.
10 — Protecting the Control Plane
Because etcd stores every cluster secret unencrypted by default, encryption at rest, mutual TLS between control plane components, and tightly scoped RBAC on kube-system are the highest-leverage hardening steps, not just API server firewalling.