6 — Admission Webhooks

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

7 — Aggregated APIs

How the aggregation layer lets extension API servers, like metrics-server, register under the same /apis path so kubectl, RBAC, and discovery treat them identically to built-in resources.

5 — API Server Internals

Why every request, regardless of which controller or kubectl call triggered it, passes through the same authn -> authz -> admission -> validation chain, making the API server the single enforcement point for cluster policy.

2 — Controller Manager

Why every built-in controller is level-triggered against the informer cache rather than edge-triggered off individual watch events, which is what makes reconciliation idempotent after a restart.

4 — etcd Internals

How etcd's MVCC revision counter, not object timestamps, is what makes watch resumption after a disconnect and optimistic concurrency via resourceVersion possible.