Glossary¶

Short, plain-language definitions of the terms used across this site. If a page uses a word you have not met, it is probably here.

Cluster basics¶

Term	Definition
Node	A machine, physical or virtual, that runs your containers.
Cluster	A set of nodes plus the control plane that manages them.
Control plane	The components that decide what should happen: API server, scheduler, controller manager, and etcd. It does not run your application containers.
API server	The single entry point for every change to the cluster. Every other component reads and writes through it.
etcd	The distributed key-value store holding all cluster state. Only the API server talks to it directly.
kubectl	The command-line tool you use to talk to a cluster (pronounced "kube control").
kubelet	The agent on each node that starts containers and reports their status back to the API server.
Manifest	A YAML (or JSON) file describing one or more Kubernetes objects. What you feed to `kubectl apply`.

Term	Definition
Pod	The smallest thing Kubernetes runs: one or more containers scheduled together on one node, sharing an IP address.
Deployment	The controller that keeps a set of identical Pods running and updates them safely.
ReplicaSet	The object a Deployment creates to hold one specific version of a Pod template at a specific replica count.
StatefulSet	Like a Deployment, but for workloads whose replicas are not interchangeable - stable names, stable storage.
DaemonSet	Runs one copy of a Pod on every node (or every node matching a selector).
Job / CronJob	A workload that runs to completion, once (Job) or on a schedule (CronJob).
Service	A stable virtual address and DNS name in front of a changing set of Pods.
Ingress / Gateway API	HTTP and TLS routing for traffic entering the cluster from outside.
ConfigMap / Secret	Namespace-scoped objects holding configuration values and sensitive values respectively.
Namespace	A logical partition inside a cluster. Partitions object names and policy scope - not the network.

Term	Definition
Controller	A loop that watches objects and takes action until the observed state matches the declared state.
Reconciliation	That process of closing the gap between `spec` (what you want) and `status` (what is true).
spec / status	The two halves of almost every Kubernetes object: declared intent, and observed reality.
Label	An arbitrary key-value tag attached to an object, e.g. `app: web`.
Selector	A query over labels. This is how a Service finds its Pods and a Deployment finds its ReplicaSet.
Admission controller	Code that runs inside the API server after authorization but before an object is stored, able to modify it (mutating) or reject it (validating).
Operator / CRD	A CustomResourceDefinition adds your own object type to the API; an operator is the controller that reconciles it.

Term	Definition
RBAC	Role-Based Access Control. The system that decides which users and workloads may read or change which objects.
Service account	The identity a Pod uses when it calls the API server.
NetworkPolicy	Rules restricting which Pods may talk to which. Requires a CNI that implements it.
PSA / Pod Security Standards	Per-namespace limits on what a Pod is allowed to declare, such as running as root.
CNI	Container Network Interface. The plugin standard Kubernetes uses to hand pod networking to an implementation such as Cilium, Calico, or Flannel.
CIDR	A way of writing a range of IP addresses, like `10.244.0.0/16`. The number after the slash says how many leading bits are fixed.
NAT	Network Address Translation: rewriting the source or destination IP of a packet in flight. The pod network deliberately avoids it between Pods.
Overlay network	Pod traffic wrapped inside another packet so it can cross a network that knows nothing about pod IPs.
East-west / north-south	Traffic between workloads inside the cluster, versus traffic entering or leaving it.
IAM / KMS	Your cloud provider's identity system, and its key management service (used to encrypt Secrets at rest).

Term	Definition
Request	The amount of CPU or memory a container is guaranteed. The scheduler places Pods using requests, not actual usage.
Limit	The ceiling a container may use. Exceeding a CPU limit throttles the process; exceeding a memory limit kills it.
QoS class	Guaranteed, Burstable, or BestEffort - derived from requests and limits, and used to decide eviction order.
Taint / toleration	A taint marks a node as repelling Pods; a toleration lets a specific Pod land there anyway.
Affinity	Rules expressing which nodes a Pod may or prefers to run on, or which other Pods it wants to sit near or apart from.
PV / PVC / StorageClass	The actual storage, the request for storage, and the template that provisions the first from the second.