All Kubernetes diagrams
143 animated diagrams of how Kubernetes works inside, each explained step by step. Pick one to read it, or browse them as a grid.
Cluster
Control Plane
- Cluster Architecture
- Object Create Path
- Admission Chain
- ResourceQuota and LimitRange
- List-Watch and Informers
- Server-side Apply and Field Ownership
- Scheduler Decision Cycle
- Taints and Tolerations
- Pod Priority and Preemption
- Cascading Deletion and Finalizers
- ETCD Raft Consensus
- Leader Election via Lease
Node Runtime
- Kubelet Reconcile Loop
- Pod Sandbox via CRI
- Static Pods and Mirror Pods
- Node Allocatable
- Pod cgroup Hierarchy
- CPU Throttling and CFS Quota
- Container OOMKill
- Image and Container GC
Node Lifecycle
Workloads
Pods Bootstrap
- Pod Pending and Init States
- Pod Scheduling Gates
- Pod Startup Conditions
- Image Pull and Registry Auth
- Init Containers and Native Sidecars
- Environment Before PID 1
- Effective Pod Resource Requests
- Pod QoS Classes
Pods Lifecycle
- Pod Lifecycle Phases
- Pod Restart Policy
- CrashLoopBackOff and Restart Backoff
- Container Restarts and lastState
- Ephemeral Debug Containers
- Startup, Liveness and Readiness Probes
- In-place Pod Resize
- postStart and preStop Hooks
- Graceful Pod Shutdown
- Container Termination Order
- Force Deletion and Stuck Terminating Pods
- Pod Garbage Collection
Controllers
- Workload Controller Kinds
- ReplicaSet Reconcile and Ownership
- Deployment Rolling Update
- RollingUpdate or Recreate
- Deployment Rollback and Revision History
- StatefulSet Ordered Rollout
- StatefulSet Update Strategy
- DaemonSet Controller
- Job Parallelism and Completions
- Automatic Cleanup for Finished Jobs
- CronJob Schedule and Concurrency
- Pod Replacement Guarantees
Networking
Network Foundations
- Flat Pod Network Model
- IPAM and Pod CIDR Allocation
- Service CIDR and ClusterIP Allocation
- Dual-Stack IPv4 and IPv6
- Network Namespaces
- kube-proxy: iptables vs IPVS
- Rule Resync and minSyncPeriod
- Connection Tracking and NAT
- The Netfilter Path a Packet Takes
- eBPF Dataplane
- Packet Classification by Destination
- How a NetworkPolicy Blocks a Pod
Pod Networking
- Containers Share Localhost
- hostNetwork and hostPort
- Wiring a Pod via CNI
- Pod IP and the veth Pair
- Pod-to-Pod on the Same Node
- Pod-to-Pod Across Nodes
- MTU Overhead and PMTU Blackholes
- Pod Egress and SNAT
Services & Endpoints
- ClusterIP, NodePort, LoadBalancer and the Rest
- ClusterIP via kube-proxy
- Debugging Service Traffic
- Service and EndpointSlice
- Terminating Endpoints and Draining
- Session Affinity and Traffic Distribution
- Internal Traffic Cluster vs Local
- ExternalName and Services without Selectors
External Traffic
- NodePort and LoadBalancer
- External Traffic Cluster vs Local
- LoadBalancer without a Cloud
- LoadBalancer Straight to Pods
- Ingress Controller Routing
- Gateway API
- Traffic Splitting with HTTPRoute
- Preserving the Client IP
DNS & Service Discovery
Storage
Volume Foundations
- Pod Volume Model
- Where Volume Data Lives
- Container Filesystem Layers
- emptyDir Lifecycle
- hostPath Volumes
- ConfigMap and Secret as Files
- Downward API Volume
- Projected Volumes
- Image Volumes
- subPath Mounts
- Ephemeral Storage Limit Eviction
- Recursive Read-Only Mounts
Volumes & Claims
- PVC to PV Binding
- Default StorageClass
- Dynamic Volume Provisioning
- Access Modes
- Filesystem vs Block
- Immediate vs WaitForFirstConsumer
- CSI Storage Capacity
- Online Volume Expansion
- PVC Protection Finalizers
- Reclaim Policy
- PV Lifecycle Phases
- Reserving a PersistentVolume
CSI & Mount Path
- CSI Architecture
- CSIDriver Object
- Attach and Mount Chain
- VolumeAttachment
- Mount Namespaces and Propagation
- CSI Ephemeral Volumes
- fsGroup and Volume Ownership
- Node Volume Attach Limits
- Multi-Attach Error
- Detach on Node Failure