Kubernetes Architecture
kubectl — Your Primary Interface to the Cluster
Sending commands, checking resource status, and troubleshooting.
Interview: Practical competency with kubectl is critical. Interviewers may ask you to explain how ~/.kube/config is structured (clusters, users, contexts), and what diagnostic commands you would run to inspect an application crash or print resource JSON paths.
Introduction
kubectl is the official command-line utility used to communicate with a Kubernetes cluster's API Server. It converts CLI commands into authenticated REST API calls.
Why It Matters
During production outages, quick diagnostics are vital. Knowing how to locate logs, inspect resource states, switch contexts, and query metadata fields using JSONPath filters minimizes mean-time-to-resolution (MTTR).
Real-World Analogy
Using kubectl is like using a universal remote control for a giant television system. The remote doesn't do the broadcasting or tuning itself; it just sends signals (API requests) to the main controller box. If you want to change channels (switch namespaces) or adjust volume (scale replicas), you press the buttons on the remote.
How It Works
By default, kubectl reads its configuration from the file located at ~/.kube/config. This file coordinates cluster access through three sections:
- clusters: Details target API Server endpoints (URLs) and certificates.
- users: Holds access credentials (tokens, client certs).
- contexts: Groups clusters and users into alias pairs, mapping active defaults.
Internal Architecture
When you run a command like kubectl get pods, the binary validates arguments, builds a JSON request payload, signs it with context certificates, and sends a REST HTTP call. The API Server processes it and returns JSON, which kubectl formats cleanly for terminal output.
Visual Explanation
Practical Example
Here is a standard diagnostic command reference for daily cluster operations:
Common Mistakes
1. Context Confusion: Running delete commands in production by mistake because you forgot to check your active context. Always inspect context states or use prompt plugins showing current targets in your terminal interface.
2. Missing Namespaces: Running commands without namespaces when resources are in another namespace. If your pod is in namespace staging, running kubectl get pods will return empty results. You must pass -n staging.
Quick Quiz
Q1: Which kubeconfig element binds a specific user credential to a specific target cluster URL?
A) User Profiles
B) Cluster Configs
C) Contexts
Answer: C — Contexts define user-to-cluster pairings, allowing quick context switching.
Scenario-Based Challenge
Scenario:
Your manager asks for a list of all pod IP addresses in the namespace banking for firewall audits. They forbid you from copy-pasting values manually. How do you extract this cleanly?
Use the -o jsonpath filter option:
Debugging Exercise
Failure Case:
Running kubectl get nodes returns: The connection to the server localhost:8080 was refused - did you specify the right host or port?.
How would you debug this?
View Solution
By default, if kubectl cannot find its config file at ~/.kube/config, it defaults to connecting to localhost:8080.
Fix: Ensure the config file exists and contains correct clusters. If the file is placed elsewhere, export the environment variable:
Interview Questions
1. How do you view log histories of a container that crashed and restarted?
By running the logs command passing the -p (or --previous) flag: kubectl logs -p <pod-name>.
2. What three root sections make up ~/.kube/config?
clusters (API URLs), users (authentication details), and contexts (binding cluster/user pairs).
Production Considerations
In production pipelines, use narrow RBAC service accounts with limited API privileges. Avoid using full admin kubeconfigs inside CI/CD automation systems.