Kubernetes from First Principles

A linear-thinking (线性思维) derivation of Kubernetes itself. We start with one process you want to keep alive for the world, and at every step we name the exact failure the previous tool leaves behind — then derive the one primitive that fixes it. Container, Pod, control plane, controllers, Services, storage, scheduler, security, operators: nothing appears "because Kubernetes has it." Each noun is the forced answer to a broken chain. By the end you could have re-invented Kubernetes yourself.

The one idea

Kubernetes is a single move applied over and over: stop issuing commands; declare the desired state, and let a control loop continuously drive the actual state toward it. Lesson 00 builds that loop. Every later lesson adds the next noun the loop needs — and exposes the next failure that forces the lesson after it.

How this differs from "Generative AI on Kubernetes"

This track teaches Kubernetes fundamentally — the substrate. The sibling Generative AI on Kubernetes track assumes these fundamentals and layers LLM serving, GPUs, and AI platforms on top. Read this one first; then every GenAI-on-Kubernetes lesson reads as "these same primitives under GPU and memory pressure."

The Derivation Chain

manual ops fails
   -> 00 declare + reconcile (the loop)
   -> 01 container        (a unit to reconcile)
   -> 02 pod + node       (the atom, and the hands that run it)
   -> 03 control plane    (one durable source of truth)
   -> 04 controllers+labels(pods are mortal; find them by query)
   -> 05 deployments      (change the version safely)
   -> 06 networking+svc   (mortal pod IPs -> stable virtual IP)
   -> 07 dns + ingress    (names, and one L7 front door)
   -> 08 config + storage (state that outlives the pod)
   -> 09 workloads        (stateful / batch / per-node, not just servers)
   -> 10 scheduler        (which node does a pod land on?)
   -> 11 health + autoscale(running != healthy; fixed count is wrong)
   -> 12 security         (many tenants, no boundaries)
   -> 13 operators        (teach the loop your own nouns) + capstone

Lessons

The One Idea: Declare, Then Reconcile

Why manual ops doesn't survive scale or failure, and the leap to declarative desired state driven by a level-triggered control loop — the engine of everything that follows.

Part I — The engine and the unit.

The Container: Boxing a Process

Namespaces (what it sees), cgroups (what it gets), and the image (a frozen filesystem). Why a bare process can't be the unit you reconcile.

Part I — The engine and the unit.

The Pod and the Node: the Atom and the Hands

The Pod as the smallest schedulable unit (shared IP, localhost, volumes); the node, kubelet, and container runtime that actually run it and report the truth back.

Part I — The engine and the unit.

The Control Plane: One Source of Truth

etcd as the consistent store, the API server as the only door (authn, authz, admission, watch). Why everyone talks to the API server and no one touches etcd.

Part II — The control plane and the loop.

Controllers & Labels: the Loop Made Real, and Its Glue

The ReplicaSet controller that keeps N pods alive (pods are mortal), and the label-selector model — loose coupling by query, the structural idea that wires the whole system.

Part II — The control plane and the loop.

Deployments: Changing Desired State Safely

A controller of ReplicaSets: rolling updates with maxSurge/maxUnavailable, revision history, one-command rollback, and the canary/blue-green substrate.

Part II — The control plane and the loop.

Networking & Services: Flat IPs and a Stable Front

The flat pod-IP network model and CNI; the Service as a stable virtual IP load-balancing over ephemeral pod IPs via EndpointSlices and kube-proxy.

Part III — Reaching the workload.

DNS, Ingress & the Front Door

CoreDNS names so workloads discover each other; Ingress and the Gateway API for one L7 entrypoint, host/path routing, and TLS termination.

Part III — Reaching the workload.

Config & Storage: State That Outlives the Pod

ConfigMaps and Secrets (and why a Secret is base64, not encryption); Volumes, the PV/PVC claim indirection, StorageClasses, and CSI dynamic provisioning.

Part IV — State and config.

Beyond the Stateless Server: StatefulSets, Jobs, DaemonSets

Stable identity and per-replica storage for databases; run-to-completion and scheduled work; exactly-one-per-node agents. When a Deployment is the wrong shape.

Part IV — State and config.

The Scheduler: How a Pod Finds a Node

Requests vs limits, the filter→score→bind loop, affinity/anti-affinity, taints & tolerations, topology spread, QoS classes, and the eviction order.

Part V — How the cluster decides and defends.

Health & Autoscaling: Closing the Loop on Reality

Liveness/readiness/startup probes and self-healing; then HPA, VPA, and the Cluster Autoscaler — three nested control loops that make the replica count itself reconciled.

Part V — How the cluster decides and defends.

Security & Multi-Tenancy: Who Can Do What

The API request lifecycle (authn → authz → admission), RBAC and ServiceAccounts, namespaces and quotas, Pod Security, and NetworkPolicy default-deny.

Part V — How the cluster decides and defends.

Extending Kubernetes, and the Whole Machine

CRDs and operators — teach the loop your own nouns. Then trace one apply and one request through every component, recap the whole derivation, and bridge to the GenAI track.

Part VI — Extension and synthesis.

External Anchors To Keep Current

Kubernetes controllers and the cluster components — the control-loop model this track is built around.
Services, Gateway API, and PersistentVolumes for the networking and storage models.
RBAC, Pod Security Standards, and Custom Resources for governance and extension.