Skip to content
academia.sh
tr
Log in

Course Advanced

Container Orchestration

Published Updated

By the end of this course

Start course

01

Cluster Architecture

The decision moving from human to system: where manual container management runs out, the control plane splitting into the API server, scheduler, controller manager, and state store, the duties of the node agent, runtime, and network proxy on the node side, the reconciliation loop that continuously compares desired state against actual state measured in delay and work, and the cost of the decision to run the cluster yourself.

  1. 01 The Need for Orchestration Manual management is scanned across machine and service counts: decision count grows linearly while the information examined per decision grows as a product, and failure-detection delay ties to round duration. The threshold for delegation is computed in days, and the number of copies the system misplaces when one of the six information items a decision depends on goes unwritten is counted.
  2. 02 Control Plane Components The party that takes on the decision is split into four parts, and a single request is traced end to end: how many components it passes through, which information each component reads and writes, and how many reads and writes land on the state store are counted. Then each component is brought down one at a time, and which decisions stop and which keep going is measured.
  3. 03 Node Components The information flow on the node side is measured: what the node agent reports, how often, how much of the report has actually changed. Scanning the liveness threshold counts how long the cluster believes the old fact, how many wrong dead declarations happen, and how many requests are lost; the network proxy's rule count is shown to grow with service count, while rule change spreads with node count.
  4. 04 The Reconciliation Loop The continuous comparison of desired state against actual state is written as a loop running at cluster scale, and report delay is scanned: how many unneeded copies the system opens, how many copies it deletes for nothing, and how wide the oscillation runs. The relationship between loop period and report delay is tested across fifty-six cells, and the missing information item is shown to be the system's own history.
  5. 05 Local and Managed Clusters Running the cluster yourself is compared against delegating its operation on the same items: delegated and remaining operational items, monthly hours, the version-upgrade window, the loss of access to the control plane, and exit cost. The loss of access is shown with a number for how it takes away the lever in the previous lesson's oscillation relation.

02

Core Objects

Deploying with declarative objects: what the smallest deployment unit holds together, declarative version management with the replica set and version object, stable in-cluster addressing, the routing and balancing layer for external access, rolling out configuration and secret objects, the persistent volume claim and driver interface, stateful applications that need a stable identity, one-shot and recurring tasks, and multi-tenant resource separation with namespaces and quotas.

  1. 01 Pod Measuring the smallest deployment unit declared to the cluster: what keeping three things together buys, the scale unit of packaging two processes into one pod versus two pods, and the difference in failure propagation, resource accounting, and network round trips.
  2. 02 Replica Sets and Version Objects Two measures of declarative version management: the controller's work per round reconciling the desired replica count against the actual one, and the effect of rollout settings — how many extra, how many missing replicas — on rollout rounds, below-capacity rounds, and the rollback window.
  3. 03 Service Objects Two measures of stable in-cluster addressing: how many times the name changes and how many times the list changes while eleven pods come and go, the number of requests that reach a not-ready endpoint with and without a readiness check, and the trade-off between the round added by name resolution's cache lifetime and requests that reach a stale endpoint.
  4. 04 External Access Two measures of the path opening to the outside of the cluster: the round added and the number of rules scanned by the four layers — external balancer, ingress rule, service object, and pod — and the difference between path-based and name-based routing in external hosts, identity items, and total surface.
  5. 05 Configuration and Secret Objects Two measures of passing application settings through the cluster: how many key-rounds late a change is reflected and how many rounds of outage it produces when the same fourteen keys are passed as environment variables versus a mounted file, and how many subjects within the cluster can read a secret object.
  6. 06 Storage and Volumes Matching a persistent volume claim against cluster supply: the volume pool the cluster offers against the size, access mode, and performance class the application declares, unmet requests counted by reason, the number of nodes the access mode eliminates from placement, and the wrong binding that appears when the inventory declaration goes stale.
  7. 07 Stateful Applications Measuring stable identity and persistent storage together: a stateful set and an unordered replica set are compared over the same sequence of six events, the persistence of the replica name and volume binding is counted, the round cost of ordered startup and shutdown is surveyed, and how cluster membership and data ownership break when order is not followed is modeled.
  8. 08 Jobs and Scheduled Jobs Modeling tasks expected to finish with a cluster object: a job object's completion guarantee is counted against the attempt limit, the round and empty-slot results of parallelism and completion-count settings are surveyed, a missed run on a scheduled job is measured, and the skip, queue, and run-parallel policies for overlap are compared separately.
  9. 09 Namespaces and Quotas Building multi-tenant resource separation with numbers: while three tenants share a cluster, how one tenant starves the others without a quota is measured, the number of requests rejected once a quota is set is compared against the capacity the quota leaves idle, and the effect of the default request value applied to undeclared pods on acceptance, overallocation, and node pressure is surveyed.

03

Scheduling and Scaling

Tying the placement and growth decision to numbers: the resource request and limit's effect on the scheduler's decision, placement constraints through label selection, affinity, and topology spread, taints and tolerations for node separation, eviction order and priorities under resource pressure, the delay-oscillation balance of metric-based horizontal scaling, vertical resizing, and node addition.

  1. 01 Resource Requests and Limits Tying the placement decision to two numbers: the resource request sets the scheduler's ledger, the limit sets runtime behavior; the same workload set is placed under three request settings and compared by placed pod count against spare capacity; the request's drift from actual usage is scanned, and the waste of overstatement is weighed against the contention of understatement.
  2. 02 Scheduling Constraints Writing the scheduler as a constraint solver: as label selection, affinity, anti-affinity, and topology spread are added, the eligible node set narrows; unplaceable pods are counted, two constraints render each other unsolvable, and topology spread changes the number of replicas that survive a zone loss.
  3. 03 Taints and Tolerations Setting up node separation with taints and tolerations: how many nodes the general workload fits into once tainted nodes are set aside, the idle ratio of the set-aside capacity, measuring the taint's three effects (placement, continuing to run, eviction) separately, and how many pods a wrongly given toleration drops onto the wrong node.
  4. 04 Eviction and Priorities Modeling behavior under resource pressure: computing the eviction order under memory pressure for pods below their request, above their request, and with no request at all; three sort rules that evict different pods; how many pods a priority-class addition affects when making room and how many times the chain grows longer; and the system evicting the wrong pod because of the item it cannot see.
  5. 05 Horizontal Scaling Writing metric-based autoscaling as a controller and running it under fluctuating load: how oscillation, excess replica-turns, and shortfall turns change as the metric's delay grows, and how much the wait window and the step limit lower the oscillation and by how many turns they slow the reaction.
  6. 06 Vertical and Cluster Scaling Measuring resource resizing and node addition: comparing vertical resizing's cost — the restart count — against its gain — the drop in spare capacity; scanning a new node's readiness delay to count how many turns are spent short of capacity; and showing, with an example, the case where all three scaling types break each other.

04

Operations and Extension

Operating and extending the cluster: comparing the rolling update, blue-green, and canary deployment patterns in terms of escaped defects and rollback window, the distinction among liveness, readiness, and startup probes, bounding privilege with role-based access control, restricting traffic with network policies, security context, reusable charts and templating, extending the resource type, coding operating knowledge into a controller, cluster observability, and multi-cluster operation.

  1. 01 Deployment Patterns The rolling update, blue-green, and canary patterns are run against the same faulty-release sequence: the requests touched by the escaped defect, the rounds that pass undetected, the peak capacity kept active, and rollback's per-round cost are all counted. For canary, sample size is swept.
  2. 02 Health Checks The distinction between liveness, readiness, and startup probes is established with numbers: the unnecessary restarts and restart loop produced by a wrongly scoped liveness probe, the failed requests sent to a replica opened to traffic too early without a readiness probe, and the killing of a slow-starting replica without a startup probe are counted separately.
  3. 03 Role-Based Access Control A subject × verb × object × namespace privilege matrix is built, and the number of operations that drop going from broad privilege down to least privilege is counted: permitted operations, the line cost of role definitions, and the escalation paths by which one subject can reach another subject's privilege are all measured.
  4. 04 Network Policies This time the reachability matrix is built with policy, and the difference between default-open and default-closed is counted: how many paths close, how many legitimate paths close by mistake, how many rules the policy needs, and how many rules get updated when a new service is added.
  5. 05 Security Context How the cluster enforces its privilege and capability settings is measured: an admission-control rule is written and applied to the existing pod definitions; how many definitions violate policy, how many deployments the enforcement stops, the difference between warn mode and block mode, and how many definitions stay exposed once an exemption is granted are all counted.
  6. 06 Packaging and Templating The same application is set up in five environments, first by hand, then with a single template; lines written, values that vary per environment, and copy-paste drift are all counted. The template's own cost is measured too: number of variables, number of conditional branches, and how many lines can be known for certain just by reading the template.
  7. 07 Custom Resource Definitions A fictional resource type is defined and validated against three schema versions; how many invalid declarations get caught at admission, how many blow up at runtime, and how many silently produce a wrong result are all counted. As the schema grows, caught errors and writing burden grow together, and how many fields old declarations break on under the new schema is measured.
  8. 08 Operator Pattern For the previous lesson's resource type, a controller that genuinely runs is written: it reads the desired state, reads the real state, closes the gap, and does zero work on the second round. A manual operation's steps and minutes to close one event are compared against the controller's rounds; the coded operating knowledge is counted item by item, and the oscillation the one uncoded item produces is measured across eighty rounds.
  9. 09 Cluster Observability The cost of collecting logs, metrics, and traces at cluster scale is counted: how many resources, how many series per resource, how many records and how many bytes once multiplied by a retention period. Label cardinality's multiplicative growth in series count is shown; the bytes won and the detail lost are measured together once sampling and aggregation are applied.
  10. 10 Multi-Cluster Management Splitting by region and environment is tied to numbers: for every split axis, cluster count, fixed operating hours, upgrade window, and blast radius are all measured together. When the desired state is pushed from one place to many clusters, the propagation window, partial success, and drifted-cluster count are counted; an upper layer that assigns workloads to clusters is modeled, and which wrong decision it makes because of what it does not know is shown.

Final exam

Container Orchestration — Final Exam

In preparation

This course's question bank is not complete yet. The exam opens here automatically once enough questions are added.

Start typing to search.

↑↓ ↵ Esc navigate · open · close