Core Concepts: Pods, Deployments, Services

After this lesson, you will be able to: Recognise the core Kubernetes objects: Pods, Deployments, Services, Namespaces, ConfigMaps, Secrets. Read their YAML.

Kubernetes is a vocabulary problem before it's a config problem. Learn the six core objects and 80% of K8s YAML stops being scary.

Prerequisites:What Kubernetes Is

Pod: the smallest deployable unit

A Pod is one or more containers that share network and storage. Most Pods have ONE container; multi-container Pods are for tightly-coupled sidecars (e.g. app + log shipper). You almost never create Pods directly. You create Deployments, which create Pods. Pods get an IP inside the cluster. They're ephemeral, when a Pod dies, it's replaced with a new Pod with a new IP.

Deployment: how many Pods of this kind

A Deployment is the K8s object you actually create. It says 'I want N copies of this Pod template running'. If a Pod dies, the Deployment makes a new one. If you change the Pod template, the Deployment does a rolling update (replace old Pods with new ones gradually). Almost every workload in K8s is a Deployment. (Other options: StatefulSets for databases, DaemonSets for per-node agents, Jobs for one-shots.)

Service: stable address in front of changing Pods

Pods come and go; their IPs change. A Service is a stable DNS name + IP that load-balances to the Pods behind it. Service types: ClusterIP (default, internal only), NodePort (expose on every node's port), LoadBalancer (cloud LB), ExternalName (DNS alias). Inside the cluster, services are reachable by their name: `http://my-app:80`.

Namespace, ConfigMap, Secret

Namespace: a logical partition of the cluster (think 'folder'). Use namespaces to separate environments (staging vs prod) or teams. Default is `default`; system stuff lives in `kube-system`. ConfigMap: non-sensitive key/value config. Mounted into Pods as env vars or files. Secret: sensitive data (passwords, API keys). Same shape as ConfigMap but base64-encoded and treated specially. NOT encrypted at rest by default, use sealed-secrets or external secret stores for real prod.

A real Deployment + Service YAML

Drop into k8s/myapp.yaml. Apply with kubectl apply -f.

sql

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - name: web
          image: nginx:1.27-alpine
          ports:
            - containerPort: 80
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 128Mi
---
apiVersion: v1
kind: Service
metadata:
  name: myapp
  namespace: default
spec:
  selector:
    app: myapp
  ports:
    - port: 80
      targetPort: 80
  type: ClusterIP

Common mistakes only experienced engineers avoid

Creating Pods directly instead of Deployments. Pods don't self-heal; Deployments do. Mismatched labels between Deployment selector and Pod template labels. The Service can't find anything. Storing real secrets in Secret objects without encryption at rest. Add sealed-secrets, External Secrets Operator, or AWS Secrets Manager. Skipping resource requests/limits. K8s can't schedule effectively without them; one rogue Pod eats the whole node. Putting everything in the `default` namespace. Use namespaces from day one.

Quick Check

Pod A dies and a new Pod B with a different IP takes its place. How do other services keep reaching the app?

Pick the K8s mechanism.

DNS magicA Service in front of the Pods provides a stable name + IP; it routes to whichever Pods match its selectorThe Pod's IP doesn't actually changeManual config update

←What Kubernetes Is and When NOT to Use It

Back to Kubernetes

kubectl→