Kubernetes administration is the work of keeping shared clusters schedulable, bounded, correctly authorized, configurable, and diagnosable. This course moves beyond basic workload deployment into the operational controls administrators use to maintain a cluster and recover unhealthy applications.
Working in a local Minikube cluster, you will perform node maintenance, isolate workloads with namespaces and quotas, test least-privilege RBAC, supply runtime configuration and secrets to Pods, and diagnose failures from status and events. The final rescue mission combines log analysis and Service discovery repair in a dedicated namespace.
What You Will Learn
- Cordon, drain, inspect, and uncordon a node while explaining the scheduling effect of each action
- Create a namespace and enforce aggregate CPU and memory requests and limits with a ResourceQuota
- Deploy a resource-constrained Pod and verify namespace scoping and quota consumption
- Define a namespaced read-only Role, bind it to a user, and test allowed and denied actions through impersonation
- Create ConfigMaps and Secrets, mount configuration as a file, and inject a secret key as an environment variable
- Diagnose an invalid container image through Pod status and events, apply a targeted correction, and observe recovery
- Repair a crashing Deployment and a mismatched Service selector until the workload is ready and endpoints exist
Who This Course Is For
This course is for DevOps learners, junior platform engineers, and Linux administrators who already understand basic Kubernetes Pods, Deployments, Services, and kubectl usage.
Prerequisites: Basic Linux terminal and YAML skills plus introductory Kubernetes workload knowledge; completing a Kubernetes fundamentals course first is recommended.
Learning environment: A browser-accessible Linux terminal with Docker, Minikube, kubectl, nano, and a local single-node Kubernetes cluster; no cloud account is required.
Frequently Asked Questions
Can a single-node Minikube cluster demonstrate node draining realistically?
It demonstrates the commands and scheduling consequences accurately, but there is no second node to receive evicted workloads. After the only node is drained, replacement Pods remain Pending until you uncordon it.
Does the RBAC lab create and authenticate a real user account?
No. It creates a namespaced Role and RoleBinding for the identity jane, then uses kubectl auth can-i --as jane to verify that Pod reads are allowed while creation and deletion are denied.
Are Kubernetes Secrets encrypted in this course?
No. The lab explicitly treats their displayed values as base64-encoded rather than encrypted. It introduces Secret references and environment-variable injection, while encryption at rest and external secret managers remain production concerns outside the lab.
What must I fix in the final challenge?
You apply an existing Deployment and Service in the rescue-mission namespace, use logs to find and remove a faulty command override, then align the Service selector with app: backend. Success is verified by one ready Deployment replica and at least one Service endpoint.
