Stage 7 · Master
KCNA — Kubernetes & Cloud Native Associate
Container Orchestration (22%)
Runtimes, security, networking, service mesh, and storage — how Kubernetes orchestrates containers.
Container Runtimes
The container runtime is the software responsible for running containers. Since Kubernetes 1.24, dockershim was removed and the CRI (Container Runtime Interface) is the standard. The most common runtimes are containerd and CRI-O.
| Runtime | Maintained By | Key Feature |
|---|---|---|
| containerd | CNCF / Docker | Industry standard, Docker-compatible |
| CRI-O | Red Hat / IBM | Kubernetes-only, minimal scope |
| gVisor (runsc) | Sandboxed kernel for untrusted workloads | |
| Kata Containers | Intel / Red Hat | Lightweight VMs per container |
Kubernetes communicates with container runtimes through the CRI gRPC interface. This abstraction means you can swap runtimes without changing any manifests or kubelet configuration.
Container Networking
Every Pod gets its own IP address. Containers within a Pod share the same network namespace and can communicate via localhost. Cross-Pod communication uses the CNI (Container Network Interface) plugin.
- CNI plugins — Calico, Cilium, Flannel, Weave Net
- Service networking — kube-proxy provides load balancing across Pods
- DNS — CoreDNS resolves Service names to cluster IPs
- Network policies — Kubernetes-native firewall rules for Pods
Service Mesh
A service mesh adds observability, security, and traffic management between services without changing application code. It works by injecting a sidecar proxy (like Envoy) into each Pod.
| Mesh | Data Plane | Key Feature |
|---|---|---|
| Istio | Envoy | Full-featured, most popular |
| Linkerd | linkerd2-proxy | Lightweight, simple |
| Cilium | eBPF | Kernel-level, no sidecars |
Container Storage
Kubernetes abstracts storage through PersistentVolumes (PV), PersistentVolumeClaims (PVC), and StorageClasses. Storage is independent of Pod lifecycle — volumes persist when Pods are deleted.
- PersistentVolume (PV) — A piece of storage in the cluster.
- PersistentVolumeClaim (PVC) — A request for storage by a user.
- StorageClass — Defines the provisioner and parameters for dynamic provisioning.
- Volume types — emptyDir, hostPath, ConfigMap, Secret, CSI drivers.
Image Registries
Container images are stored in registries. Docker Hub is the default, but production clusters use private registries. Kubernetes authenticates to registries using imagePullSecrets.
kubectl create secret docker-registry regcred \
--docker-server=registry.example.com \
--docker-username=user \
--docker-password=pass
# Reference in a Pod spec
# imagePullSecrets:
# - name: regcredThe kubectl create secret docker-registry command creates a Secret that Kubernetes uses to authenticate when pulling images from a private registry.
RuntimeClasses
RuntimeClasses allow you to specify different container runtimes for different Pods. This is useful when some workloads need additional isolation (e.g., gVisor for untrusted code) while others use the default runtime for performance.
Security Context
A SecurityContext defines privilege and access control settings for a Pod or container. It controls runAsUser, runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation, and capabilities.
On both the KCNA and CKA exams, running containers as root is a security anti-pattern. Always set runAsNonRoot: true and runAsUser to a non-zero value unless explicitly instructed otherwise.
Commands and Best Practices
kubectl get pods -o jsonpath='{.items[*].spec.containers[*].image}'
kubectl top pods # Resource usage
kubectl top nodes # Node resource usage
kubectl describe node <name> # Node details
kubectl get pods --field-selector=status.phase=RunningThe top command requires Metrics Server to be installed. On the KCNA, you need to know what Metrics Server provides — resource utilization data for Pods and nodes.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.