Kubernetes MOC

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

Kubernetes

If this were a book, this page is the table of contents. Each Part below is a chapter; each chapter links out to the concepts, designs, and platform notes that already exist elsewhere in this wiki instead of duplicating them. Unwritten chapters are listed as stub entries, not empty files.

Parts

00 — Cloud Native Foundations

The container and OCI fundamentals underneath every later Part — why Kubernetes exists as a reaction to the operational pain of running containers at scale, and the control-plane/API object model everything else in this book builds on.

1 — Why Kubernetes Exists — (stub)
2 — Linux Fundamentals — (stub)
3 — Containers & OCI — (stub)
4 — Kubernetes Architecture — (stub)
5 — Installing Kubernetes — (stub)
6 — Kubernetes API & Object Model — (stub)

01 — Kubernetes Core Objects

The primitives every workload is built from — Pods up through Deployments, StatefulSets, DaemonSets, and the namespace/resource boundaries that scope them. See Patterns → Kubernetes Patterns for the design patterns layered on top of these objects rather than re-deriving them here.

1 — Pods — (stub)
2 — Labels, Selectors & Annotations — (stub)
3 — ReplicaSets — (stub)
4 — Deployments — (stub)
5 — StatefulSets — (stub)
6 — DaemonSets — (stub)
7 — Jobs & CronJobs — (stub)
8 — Namespaces — (stub)
9 — Resource Management (Requests, Limits, QoS) — (stub)

02 — Configuration & Application Development (CKAD)

Application-facing configuration and health-signaling — ConfigMaps/Secrets, the Downward API, probes, and multi-container composition patterns. See Patterns → Sidecar for the sidecar pattern in depth rather than re-deriving it here.

1 — ConfigMaps — (stub)
2 — Secrets — (stub)
3 — Downward API — (stub)
4 — Environment Variables — (stub)
5 — Probes (Liveness, Readiness, Startup) — (stub)
6 — Init Containers — (stub)
7 — Sidecars — (stub)
8 — Multi-Container Pods — (stub)
9 — Application Health Patterns — (stub)
10 — ResourceQuota & LimitRange — (stub)

03 — Scheduling & Cluster Management (CKA)

How the scheduler places Pods and how cluster operators steer that placement — affinity, taints/tolerations, priority, and the lifecycle operations (maintenance, upgrades) that keep a cluster healthy.

1 — Scheduler Internals — (stub)
2 — nodeSelector — (stub)
3 — Node Affinity — (stub)
4 — Pod Affinity & Anti-Affinity — (stub)
5 — Taints & Tolerations — (stub)
6 — Priority Classes — (stub)
7 — Topology Spread Constraints — (stub)
8 — Node Maintenance — (stub)
9 — Cluster Lifecycle — (stub)
10 — Upgrades & Version Skew — (stub)

04 — Kubernetes Networking

The network model from CNI up through Services, Ingress, Gateway API, and NetworkPolicy. See System Design → Service Mesh for the general mesh pattern; this Part’s Service Mesh chapter covers running one operationally inside a cluster instead of re-deriving the pattern.

1 — Kubernetes Networking Model — (stub)
2 — CNI Architecture — (stub)
3 — Services — (stub)
4 — kube-proxy — (stub)
5 — CoreDNS — (stub)
6 — Ingress — (stub)
7 — Gateway API — (stub)
8 — Network Policies — (stub)
9 — Service Mesh Overview — (stub)

05 — Storage

Persistent storage — Volumes, PVs/PVCs, StorageClasses, and the CSI driver model that backs stateful workloads.

06 — Authentication & Authorization (CKA + CKS)

Who can talk to the API server and what they’re allowed to do — authentication, RBAC, service accounts, and admission control as the first security boundary.

1 — Authentication — (stub)
2 — Authorization — (stub)
3 — RBAC — (stub)
4 — Service Accounts — (stub)
5 — kubeconfig — (stub)
6 — Admission Controllers — (stub)
7 — API Server Security — (stub)
8 — Secret Encryption — (stub)

07 — Kubernetes Security (CKS Core)

Node- and pod-level isolation mechanisms — Pod Security Standards, security contexts, seccomp/AppArmor/SELinux, Linux capabilities, and sandboxed runtimes (gVisor, Kata) for stronger tenant isolation.

1 — Pod Security Standards — (stub)
2 — Security Contexts — (stub)
3 — Seccomp — (stub)
4 — AppArmor — (stub)
5 — SELinux — (stub)
6 — Capabilities — (stub)
7 — Linux Kernel Isolation — (stub)
8 — RuntimeClass — (stub)
9 — Sandboxed Containers (gVisor, Kata) — (stub)
10 — Protecting the Control Plane — (stub)

08 — Supply Chain Security (CKS)

Everything upstream of runtime — image provenance, signing (Sigstore/Cosign), SBOM and vulnerability scanning, and policy enforcement at admission time.

1 — Image Security — (stub)
2 — Image Signing — (stub)
3 — Sigstore & Cosign — (stub)
4 — SBOM — (stub)
5 — Vulnerability Scanning — (stub)
6 — Trusted Registries — (stub)
7 — Policy Enforcement (OPA Gatekeeper, Kyverno) — (stub)
8 — Software Supply Chain Security — (stub)
9 — SLSA Framework — (stub)

09 — Runtime Security (CKS)

Detecting and responding to compromise after a workload is already running — Falco/eBPF-based detection, audit logging, and the incident-response/forensics workflow specific to a Kubernetes cluster.

1 — Falco — (stub)
2 — eBPF Security — (stub)
3 — Runtime Threat Detection — (stub)
4 — Audit Logs — (stub)
5 — Incident Response — (stub)
6 — Forensics — (stub)
7 — Container Escape Techniques — (stub)
8 — Mitigations — (stub)
9 — Security Monitoring — (stub)

10 — Observability

Kubernetes-native signals — logging, Events, kubectl-based debugging, and production troubleshooting workflows.

1 — Logging — (stub)
2 — Metrics — (stub)
Prometheus — the dedicated Prometheus book (12 Parts) covers the TSDB, PromQL, and operating Prometheus at scale; not duplicated here.
OpenTelemetry — OTel SDKs and semantic conventions are covered in depth in the Observability book; this chapter doesn’t re-derive them.
3 — Tracing — (stub)
4 — Events — (stub)
5 — kubectl Debug — (stub)
6 — Troubleshooting Production Clusters — (stub)

11 — Kubernetes Internals (MAANG)

Control-plane mechanics at the depth MAANG L6/L7 interviews probe — scheduler, controller-manager, kubelet, etcd, and API server internals, plus admission webhooks and aggregated APIs.

12 — Platform Engineering

Kubernetes-native delivery tooling — Helm, Kustomize, Argo CD, Flux, and building your own operator.

1 — Helm — (stub)
2 — Kustomize — (stub)
3 — Argo CD — (stub)
4 — Flux — (stub)
5 — Operator Framework — (stub)

13 — Multi-Cluster & Cloud

Running Kubernetes across managed providers and multiple clusters — AKS/EKS/GKE trade-offs, Cluster API, and multi-region/hybrid topologies.

1 — AKS — (stub)
2 — EKS — (stub)
3 — GKE — (stub)
4 — Cluster API — (stub)
5 — Federation — (stub)
6 — Multi-Cluster Networking — (stub)
7 — Multi-Region Architecture — (stub)
8 — Hybrid Kubernetes — (stub)

14 — Performance & Scalability

Scaling a cluster and the workloads on it — HPA/VPA/Cluster Autoscaler/Karpenter, scheduler and network/storage performance, and design considerations at thousands of nodes.

1 — Resource Optimization — (stub)
2 — Scheduler Performance — (stub)
3 — Cluster Autoscaler — (stub)
4 — Karpenter — (stub)
5 — Vertical Pod Autoscaler — (stub)
6 — Horizontal Pod Autoscaler — (stub)
7 — Network Performance — (stub)
8 — Storage Performance — (stub)
9 — Large Cluster Design — (stub)

15 — Production Architecture

Running Kubernetes as durable production infrastructure — HA, DR, backup/restore, multi-tenancy, cost, and the anti-patterns and failure modes that show up at scale. See SRE → Disaster Recovery Patterns for the cross-system DR framing this Part applies to Kubernetes specifically.

1 — High Availability — (stub)
2 — Disaster Recovery — (stub)
3 — Backup & Restore — (stub)
4 — Multi-Tenancy — (stub)
5 — Cost Optimization — (stub)
6 — Reliability Engineering — (stub)
7 — Production Anti-Patterns — (stub)
8 — Kubernetes Failure Modes — (stub)
9 — Real Production Case Studies — (stub)

16 — MAANG System Design

Kubernetes as a building block in distributed-systems interviews — running it under thousands of microservices, AI/ML and event-driven platforms, and designing a control plane at scale. See System Design → Kubernetes Control Plane for a full worked case study rather than re-deriving one here.

1 — Kubernetes in Distributed Systems — (stub)
2 — Running Thousands of Microservices — (stub)
3 — Event-Driven Platforms — (stub)
4 — AI/ML Platforms on Kubernetes — (stub)
5 — Platform Engineering at Scale — (stub)
6 — Large-Scale Observability — (stub)
7 — Designing Control Planes — (stub)
8 — Architecture Interview Case Studies — (stub)

17 — Certification Preparation

Objectives, hands-on labs, and mock-exam tracking for CKAD, CKA, and CKS — the practice layer over the knowledge chapters above.

1 — CKAD Objectives — (stub)
2 — CKAD Hands-on Labs — (stub)
3 — CKAD Mock Exams — (stub)
4 — CKA Objectives — (stub)
5 — Cluster Administration Labs — (stub)
6 — CKA Mock Exams — (stub)
7 — CKS Objectives — (stub)
8 — CKS Security Labs — (stub)
9 — Runtime Security Labs — (stub)
10 — Incident Response Exercises — (stub)
11 — CKS Mock Exams — (stub)

18 — Interview Mastery

Turning the book above into interview performance — design and troubleshooting questions, internals deep-dives, incident walkthroughs, and a final revision pass.

1 — Kubernetes Design Questions — (stub)
2 — Kubernetes Troubleshooting Interviews — (stub)
3 — Kubernetes Internals Interviews — (stub)
4 — Production Incident Walkthroughs — (stub)
5 — Leadership & Architecture Discussions — (stub)
6 — Common MAANG Kubernetes Questions — (stub)
7 — Whiteboard Exercises — (stub)
8 — Final Revision Checklist — (stub)

Coverage Mapping

Objective	Parts (this book)
CKAD	00–05, 17 (CKAD section)
CKA	00–12, 14, 17 (CKA section)
CKS	06–09, 17 (CKS section)
MAANG L6/L7	11–18

Metadata


Author	Amit Singh
Scope	kubernetes