A controller watches the gap and takes action until the gap is zero. This is why Kubernetes is declarative not imperative: you don't say "start container", you say "I want 3 copies running" and it maintains that.
HOW pods behave: Pods are ephemeral and mortal. They get a Pod IP, but if a Pod dies it is not resurrected with the same identity — a new Pod with a new IP appears. This is the single most important fact:
HOW a rolling update works (derive the safety):
You have replicas = R. The update strategy has two knobs:
maxUnavailable = how many Pods may be down at once
maxSurge = how many extra Pods may be temporarily created
During the update the number of Pods P available satisfies:
R−maxUnavailable≤PavailableandPtotal≤R+maxSurge
So capacity never drops below R−maxUnavailable → zero-downtime upgrade. If the new version is broken, you rollback and the Deployment recreates the old ReplicaSet's Pods.
What is the smallest deployable unit in Kubernetes?
A Pod (one or more containers sharing network namespace and storage).
Why must you never hardcode a Pod's IP?
Pods are ephemeral; restart/reschedule/scale gives a new Pod with a new IP. Use a Service for a stable address.
What does a Deployment manage and via what?
A set of identical Pods, via a ReplicaSet, maintaining a desired replica count and handling rolling updates/rollbacks.
How does a Service know which Pods to send traffic to?
Via a label selector; it tracks the matching healthy Pods' IPs (Endpoints) and load-balances across them.
Name the three main Service types and their reach.
ClusterIP (internal only), NodePort (port on every node's IP), LoadBalancer (external cloud LB with public IP).
What does an Ingress do that a Service cannot?
L7 (HTTP) routing by host/path and TLS termination, exposing many Services through one entry point.
What two knobs control a rolling update's safety?
maxUnavailable (how many Pods may be down) and maxSurge (how many extra Pods may be created).
What is the reconciliation loop?
Kubernetes continuously acts to close the gap between desired state and observed state (declarative model).
Why use Ingress instead of one LoadBalancer per Service?
One LB per Service is costly; Ingress gives a single entry point routing many Services by URL.
What runs the actual Ingress rules?
An Ingress Controller (e.g. nginx, Traefik) — the rules do nothing without it.
Recall Feynman: explain to a 12-year-old
Imagine a pizza shop. Pods are the cooks — they actually make pizzas, but any cook might call in sick and a new one takes their place. The Deployment is the manager who makes sure there are always, say, 3 cooks working, and trains new ones one at a time so the kitchen never stops. The Service is the phone number of the shop — it never changes even when cooks change, and it routes your call to whichever cook is free. The Ingress is the front door with signs: "Pizza → kitchen, Drinks → bar", sending each customer to the right counter. You just tell the manager "I want 3 cooks", and Kubernetes keeps it true forever.
Dekho, Kubernetes ko ek smart manager samjho jo bolta hai "tum bas batao kya chahiye, baaki main sambhaal lunga". Yahi declarative model hai — tum desired state likhte ho (jaise "3 copies chahiye"), aur Kubernetes apne reconciliation loop se hamesha actual state ko desired ke barabar rakhta hai. Crash ho jaaye, traffic badh jaaye — woh khud manage karta hai.
Chaar cheezein yaad rakho, neeche se upar. Pod sabse chhoti unit hai — isme tumhara container chalta hai, par yeh ephemeral hai, kabhi bhi mar ke naya ban jaata hai aur uska IP badal jaata hai. Isiliye Pod ka IP kabhi hardcode mat karna — yeh sabse common galti hai. Deployment ek manager hai jo bolta hai "3 Pods hamesha zinda raho" aur rolling update se ek-ek karke naya version laata hai bina downtime ke (maxUnavailable aur maxSurge knobs se control hota hai).
Service ek stable phone number jaisa hai — Pods badalte rehte hain par Service ka IP fixed rehta hai. Yeh label selector (jaise app=cart) se decide karta hai kaunse Pods ko traffic bhejna hai, aur load-balance karta hai. Types: ClusterIP (sirf andar), NodePort, LoadBalancer (bahar public IP). Ingress sabse upar HTTP-level router hai — ek hi entry point se URL ke hisaab se (host aur path dekh kar) alag-alag Services ko traffic bhejta hai, plus HTTPS/TLS handle karta hai.
Matter kyun karta hai? Kyunki real production mein machines crash hoti hain, traffic spike hota hai, aur zero-downtime deploy chahiye. Indirection — yaani Pod ke aage Service, Service ke aage Ingress — wahi magic hai jo scaling aur healing ko automatic bana deta hai, bina clients ko kuch change kiye.
